@caelo-cms/provisioning 0.11.9 → 0.11.11

package/dist/scheduler-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler-setup.js","sourceRoot":"","sources":["../src/scheduler-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,gBAAgB,EAChB,4BAA4B,EAC5B,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAoB,eAAe,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,kEAAkE;AAClE,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,0CAA0C;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,+BAA+B;IAC/B,0BAA0B;IAC1B,+BAA+B;CACvB,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,aAAa;IACb,cAAc;IACd,cAAc;IACd,YAAY;IACZ,8BAA8B;IAC9B,+BAA+B;IAC/B,yBAAyB;IACzB,iBAAiB;IACjB,yBAAyB;IACzB,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,uBAAuB;CACf,CAAC;AAwBX;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,QAAgB;IAEhB,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;IACxF,CAAC;IACD,IACE,CAAC,CAAC,QAAQ,KAAK,QAAQ;QACvB,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC;QACzC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI;QACN,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EACjC,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,8BAA8B;SAC/E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACC,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C,OAAO;;;;;;;sBAOa,EAAE;sBACF,EAAE;sBACF,MAAM;;8BAEE,oBAAoB;;;;sFAIoC,EAAE;;;;;;;;;kBAStE,MAAM,GAAG,mBAAmB;;;qBAGzB,8BAA8B;;;;CAIlD,CAAC;AACF,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA2B,EAC3B,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,4BAA4B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAuB,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAChE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IAED,WAAW;IACX,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,UAAU,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACrE,IAAI,CAAC,IAAI,CAAC,iBAAiB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEzD,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,yBAAyB,CAAC,GAAG,CAAC;YAC9B,qCAAqC;YACrC,2HAA2H;YAC3H,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,wCAAwC;IACxC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;QACvB,KAAK;QACL,kBAAkB;QAClB,wBAAwB;QACxB,EAAE;QACF,YAAY,MAAM,EAAE;QACpB,6CAA6C;QAC7C,kBAAkB;QAClB,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,qDAAqD,EAAE,IAAI,CAAC,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,sDAAsD,EAAE,oBAAoB,CAAC,CAAC;IAExF,KAAK,MAAM,CAAC,IAAI;QACd,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,gDAAgD,EAAE;QAC1F,EAAE,IAAI,EAAE,yBAAyB,EAAE,GAAG,EAAE,gCAAgC,EAAE;KAC3E,EAAE,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC;QACtB,KAAK;QACL,KAAK;QACL,wBAAwB;QACxB,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnC,YAAY,MAAM,EAAE;QACpB,wCAAwC;QACxC,kBAAkB;QAClB,OAAO;QACP,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,4DAA4D,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,CAAC;IAElG,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACpC,aAAa,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;YAC1F,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;YACzB,WAAW;YACX,QAAQ;YACR,QAAQ;YACR,YAAY,IAAI,EAAE;YAClB,cAAc,MAAM,EAAE;YACtB,qBAAqB,EAAE,EAAE;YACzB,kCAAkC;YAClC,qDAAqD,MAAM,CAAC,MAAM,GAAG,mBAAmB,EAAE;YAC1F,OAAO;YACP,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,QAAQ,WAAW,MAAM,CAAC,MAAM,GAAG,mBAAmB,GAAG,CAAC,CAAC;IAEjF,kCAAkC;IAClC,MAAM,YAAY,GAAG;QACnB,GAAG;QACH,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,cAAc,IAAI,EAAE;QACpB,qBAAqB;QACrB,+DAA+D,SAAS,cAAc,MAAM,cAAc,QAAQ,aAAa;QAC/H,oBAAoB;QACpB,iCAAiC,EAAE,EAAE;QACrC,uEAAuE;QACvE,qEAAqE;QACrE,wBAAwB;QACxB,SAAS;KACV,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,WAAW;QACX,MAAM;QACN,UAAU;QACV,GAAG;QACH,cAAc,MAAM,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC;QACxB,WAAW;QACX,MAAM;QACN,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QACjC,MAAM;QACN,GAAG,YAAY;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,YAAY,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,CAAC,uBAAuB,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC;IAEvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;AAChD,CAAC"}

package/dist/seal-key-rotation.d.ts

@@ -1,22 +1,22 @@
 import type { GcloudRunner } from "./gcloud-retry.js";
-/** The gateway env var holding the previous key during a rotation. */
+/** The MCP-Auth-Proxy env var holding the previous key during a rotation. */
 export declare const SEAL_KEY_PREVIOUS_ENV = "CAELO_MCP_OAUTH_SEAL_KEY_PREVIOUS";
-/** The gateway env var holding the current key (stack-contract SERVICE_SECRET_ENV). */
+/** The MCP-Auth-Proxy env var holding the current key (stack-contract SERVICE_SECRET_ENV). */
 export declare const SEAL_KEY_ENV = "CAELO_MCP_OAUTH_SEAL_KEY";
-/** Label on the gateway service: when the rotation started (epoch ms). */
+/** Label on the MCP-Auth-Proxy service: when the rotation started (epoch ms). */
 export declare const SEAL_ROTATION_LABEL = "caelo-seal-rotation-started";
 /**
  * Days the previous key must stay: the broker's refresh-token lifetime
- * (api-gateway mcp/token.ts REFRESH_MAX_LIFETIME_SECONDS, 30 days).
+ * (apps/mcp-auth-proxy token.ts REFRESH_MAX_LIFETIME_SECONDS, 30 days).
  */
 export declare const SEAL_KEY_ROTATION_WINDOW_DAYS = 30;
-/** The deployed gateway a rotation works on. */
+/** The deployed MCP-Auth-Proxy a rotation works on. */
 export interface SealRotationTarget {
     readonly projectId: string;
     readonly region: string;
     readonly env: string;
-    /** Deployed (Pulumi-suffixed) gateway Cloud Run service name. */
-    readonly gatewayService: string;
+    /** Deployed (Pulumi-suffixed or fixed) MCP-Auth-Proxy Cloud Run service name. */
+    readonly proxyService: string;
 }
 export interface SealRotationReport {
     readonly ok: boolean;

package/dist/seal-key-rotation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seal-key-rotation.d.ts","sourceRoot":"","sources":["../src/seal-key-rotation.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAKtD,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,sCAAsC,CAAC;AACzE,uFAAuF;AACvF,eAAO,MAAM,YAAY,6BAA6B,CAAC;AACvD,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAIhD,gDAAgD;AAChD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAuDD,6EAA6E;AAC7E,wBAAsB,oBAAoB,CACxC,CAAC,EAAE,kBAAkB,EACrB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAwE7B;AAED,2EAA2E;AAC3E,wBAAsB,qBAAqB,CACzC,CAAC,EAAE,kBAAkB,EACrB,IAAI,GAAE,gBAAqB,EAC3B,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,OAAO,CAAC,kBAAkB,CAAC,CA4C7B"}
+{"version":3,"file":"seal-key-rotation.d.ts","sourceRoot":"","sources":["../src/seal-key-rotation.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAKtD,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB,sCAAsC,CAAC;AACzE,8FAA8F;AAC9F,eAAO,MAAM,YAAY,6BAA6B,CAAC;AACvD,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AACjE;;;GAGG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAIhD,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAuDD,6EAA6E;AAC7E,wBAAsB,oBAAoB,CACxC,CAAC,EAAE,kBAAkB,EACrB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAwE7B;AAED,2EAA2E;AAC3E,wBAAsB,qBAAqB,CACzC,CAAC,EAAE,kBAAkB,EACrB,IAAI,GAAE,gBAAqB,EAC3B,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,OAAO,CAAC,kBAAkB,CAAC,CA4C7B"}

package/dist/seal-key-rotation.js

@@ -4,7 +4,7 @@
  * every connected MCP client out.
  *
  * The broker seals its OAuth state, codes and refresh tokens under
- * `CAELO_MCP_OAUTH_SEAL_KEY` (api-gateway mcp/seal.ts, envelope v2 with a
+ * `CAELO_MCP_OAUTH_SEAL_KEY` (apps/mcp-auth-proxy seal.ts, envelope v2 with a
  * key id). While `CAELO_MCP_OAUTH_SEAL_KEY_PREVIOUS` is set it also opens
  * values sealed under that key, and seals everything new under the current
  * one. Refresh tokens live at most {@link SEAL_KEY_ROTATION_WINDOW_DAYS}
@@ -13,7 +13,7 @@
  *
  * Two steps, both `cms-provision rotate-secret mcp-oauth-seal-key`:
  *
- *   start   — add a new version to the secret, then roll the gateway with
+ *   start   — add a new version to the secret, then roll the MCP-Auth-Proxy with
  *             the current key at `latest` and the previous key PINNED to
  *             the version that was latest before (a pinned version never
  *             follows the new one), labelled with the start time.
@@ -26,7 +26,7 @@
  * progress (a second start would pin the CURRENT key as "previous" and drop
  * the real previous one early), and finishing before the window ends.
  *
- * A `cms-provision upgrade` whose `pulumi up` rewrites the gateway template
+ * A `cms-provision upgrade` whose `pulumi up` rewrites the MCP-Auth-Proxy template
  * during the window drops the previous key (the stack does not declare it):
  * clients sealed under it sign in again. That fails safe — no token lives
  * longer than intended — and is documented in the rotate output.
@@ -35,31 +35,31 @@ import { gcloud as defaultGcloud } from "./gcloud.js";
 import { gcpSecretId } from "./gcp-names.js";
 import { initialSecretValue } from "./runtime-secrets.js";
 import { liveContainerEnv } from "./stack-converge.js";
-/** The gateway env var holding the previous key during a rotation. */
+/** The MCP-Auth-Proxy env var holding the previous key during a rotation. */
 export const SEAL_KEY_PREVIOUS_ENV = "CAELO_MCP_OAUTH_SEAL_KEY_PREVIOUS";
-/** The gateway env var holding the current key (stack-contract SERVICE_SECRET_ENV). */
+/** The MCP-Auth-Proxy env var holding the current key (stack-contract SERVICE_SECRET_ENV). */
 export const SEAL_KEY_ENV = "CAELO_MCP_OAUTH_SEAL_KEY";
-/** Label on the gateway service: when the rotation started (epoch ms). */
+/** Label on the MCP-Auth-Proxy service: when the rotation started (epoch ms). */
 export const SEAL_ROTATION_LABEL = "caelo-seal-rotation-started";
 /**
  * Days the previous key must stay: the broker's refresh-token lifetime
- * (api-gateway mcp/token.ts REFRESH_MAX_LIFETIME_SECONDS, 30 days).
+ * (apps/mcp-auth-proxy token.ts REFRESH_MAX_LIFETIME_SECONDS, 30 days).
  */
 export const SEAL_KEY_ROTATION_WINDOW_DAYS = 30;
 const DAY_MS = 24 * 60 * 60 * 1000;
-async function gatewayState(run, t) {
+async function proxyState(run, t) {
     const r = await run([
         "run",
         "services",
         "describe",
-        t.gatewayService,
+        t.proxyService,
         "--region",
         t.region,
         `--project=${t.projectId}`,
         "--format=json",
     ]);
     if (!r.ok)
-        return { ok: false, error: `read the gateway service: ${r.stderr.trim()}` };
+        return { ok: false, error: `read the MCP-Auth-Proxy service: ${r.stderr.trim()}` };
     const env = liveContainerEnv(r.stdout);
     const labels = JSON.parse(r.stdout).metadata?.labels ??
         {};
@@ -69,7 +69,7 @@ async function gatewayState(run, t) {
     if (current?.kind !== "secret") {
         return {
             ok: false,
-            error: `${SEAL_KEY_ENV} on ${t.gatewayService} is not a Secret Manager reference — run \`cms-provision upgrade\` first (it installs remote MCP's secrets).`,
+            error: `${SEAL_KEY_ENV} on ${t.proxyService} is not a Secret Manager reference — run \`cms-provision upgrade\` first (it installs remote MCP's secrets).`,
         };
     }
     return {
@@ -82,7 +82,7 @@ function rollFlip(t) {
         "run",
         "services",
         "update-traffic",
-        t.gatewayService,
+        t.proxyService,
         "--region",
         t.region,
         `--project=${t.projectId}`,
@@ -98,7 +98,7 @@ export async function startSealKeyRotation(t, deps = {}) {
     const secretId = gcpSecretId(t.env, "mcp-oauth-seal-key");
     const project = `--project=${t.projectId}`;
     const steps = [];
-    const live = await gatewayState(run, t);
+    const live = await proxyState(run, t);
     if (!live.ok)
         return { ok: false, steps, error: live.error };
     if (live.state.previousPinned) {
@@ -137,7 +137,7 @@ export async function startSealKeyRotation(t, deps = {}) {
         "run",
         "services",
         "update",
-        t.gatewayService,
+        t.proxyService,
         "--region",
         t.region,
         project,
@@ -151,10 +151,10 @@ export async function startSealKeyRotation(t, deps = {}) {
         return {
             ok: false,
             steps,
-            error: `The new key is stored but the gateway does not use it yet. Do not rotate again — roll the gateway:\n    gcloud ${update.join(" ")}\n    gcloud ${rollFlip(t).join(" ")}\n(${flipped.stderr.trim()})`,
+            error: `The new key is stored but the MCP-Auth-Proxy does not use it yet. Do not rotate again — roll the MCP-Auth-Proxy:\n    gcloud ${update.join(" ")}\n    gcloud ${rollFlip(t).join(" ")}\n(${flipped.stderr.trim()})`,
         };
     }
-    steps.push(`rolled the gateway onto the new key; tokens sealed under version ${version} keep working`, `finish after ${new Date(now + SEAL_KEY_ROTATION_WINDOW_DAYS * DAY_MS).toISOString()} with: cms-provision rotate-secret mcp-oauth-seal-key --finish`, "a `cms-provision upgrade` before then drops the previous key early: clients sealed under it sign in again");
+    steps.push(`rolled the MCP-Auth-Proxy onto the new key; tokens sealed under version ${version} keep working`, `finish after ${new Date(now + SEAL_KEY_ROTATION_WINDOW_DAYS * DAY_MS).toISOString()} with: cms-provision rotate-secret mcp-oauth-seal-key --finish`, "a `cms-provision upgrade` before then drops the previous key early: clients sealed under it sign in again");
     return { ok: true, steps };
 }
 /** Finish a rotation: drop the previous key once the window has passed. */
@@ -162,14 +162,14 @@ export async function finishSealKeyRotation(t, deps = {}, opts = {}) {
     const run = deps.run ?? defaultGcloud;
     const now = (deps.nowMs ?? Date.now)();
     const steps = [];
-    const live = await gatewayState(run, t);
+    const live = await proxyState(run, t);
     if (!live.ok)
         return { ok: false, steps, error: live.error };
     if (!live.state.previousPinned) {
         return {
             ok: false,
             steps,
-            error: `No seal-key rotation is in progress on ${t.gatewayService} (${SEAL_KEY_PREVIOUS_ENV} is not set). Start one with \`cms-provision rotate-secret mcp-oauth-seal-key\`.`,
+            error: `No seal-key rotation is in progress on ${t.proxyService} (${SEAL_KEY_PREVIOUS_ENV} is not set). Start one with \`cms-provision rotate-secret mcp-oauth-seal-key\`.`,
         };
     }
     const started = live.state.startedAtMs;
@@ -179,7 +179,7 @@ export async function finishSealKeyRotation(t, deps = {}, opts = {}) {
             ok: false,
             steps,
             error: due === null
-                ? `The gateway has ${SEAL_KEY_PREVIOUS_ENV} but no ${SEAL_ROTATION_LABEL} label, so the rotation's start is unknown. Wait ${SEAL_KEY_ROTATION_WINDOW_DAYS} days from when it started, then run --finish --now.`
+                ? `The MCP-Auth-Proxy has ${SEAL_KEY_PREVIOUS_ENV} but no ${SEAL_ROTATION_LABEL} label, so the rotation's start is unknown. Wait ${SEAL_KEY_ROTATION_WINDOW_DAYS} days from when it started, then run --finish --now.`
                 : `The previous key still opens refresh tokens until ${new Date(due).toISOString()} (${SEAL_KEY_ROTATION_WINDOW_DAYS}-day lifetime). Finishing now would sign those clients out; run --finish after that time, or --finish --now if the old key leaked.`,
         };
     }
@@ -187,7 +187,7 @@ export async function finishSealKeyRotation(t, deps = {}, opts = {}) {
         "run",
         "services",
         "update",
-        t.gatewayService,
+        t.proxyService,
         "--region",
         t.region,
         `--project=${t.projectId}`,
@@ -198,9 +198,9 @@ export async function finishSealKeyRotation(t, deps = {}, opts = {}) {
     const rolled = await run(update);
     const flipped = rolled.ok ? await run(rollFlip(t)) : rolled;
     if (!flipped.ok) {
-        return { ok: false, steps, error: `roll the gateway: ${flipped.stderr.trim()}` };
+        return { ok: false, steps, error: `roll the MCP-Auth-Proxy: ${flipped.stderr.trim()}` };
     }
-    steps.push("removed the previous seal key from the gateway; the rotation is complete");
+    steps.push("removed the previous seal key from the MCP-Auth-Proxy; the rotation is complete");
     return { ok: true, steps };
 }
 //# sourceMappingURL=seal-key-rotation.js.map

package/dist/seal-key-rotation.js.map

@@ -1 +1 @@
-{"version":3,"file":"seal-key-rotation.js","sourceRoot":"","sources":["../src/seal-key-rotation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AACzE,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,0BAA0B,CAAC;AACvD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AACjE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6BnC,KAAK,UAAU,YAAY,CACzB,GAAiB,EACjB,CAAqB;IAErB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,UAAU;QACV,UAAU;QACV,CAAC,CAAC,cAAc;QAChB,UAAU;QACV,CAAC,CAAC,MAAM;QACR,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GACT,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAwD,CAAC,QAAQ,EAAE,MAAM;QAC7F,EAAE,CAAC;IACL,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,OAAO,CAAC,CAAC,cAAc,8GAA8G;SAC5J,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,OAAO;QACL,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,CAAC,CAAC,cAAc;QAChB,UAAU;QACV,CAAC,CAAC,MAAM;QACR,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,CAAqB,EACrB,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,6CAA6C,KAAK,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,2FAA2F,6BAA6B,0EAA0E;SACjT,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,SAAS;QACT,UAAU;QACV,UAAU;QACV,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,+BAA+B,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SACtI,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE;QACxF,KAAK,EAAE,QAAQ,EAAE;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,QAAQ,iCAAiC,OAAO,GAAG,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG;QACb,KAAK;QACL,UAAU;QACV,QAAQ;QACR,CAAC,CAAC,cAAc;QAChB,UAAU;QACV,CAAC,CAAC,MAAM;QACR,OAAO;QACP,oBAAoB,YAAY,IAAI,QAAQ,WAAW,qBAAqB,IAAI,QAAQ,IAAI,OAAO,EAAE;QACrG,mBAAmB,mBAAmB,IAAI,GAAG,EAAE;QAC/C,SAAS;KACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,kHAAkH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;SAC7M,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,oEAAoE,OAAO,eAAe,EAC1F,gBAAgB,IAAI,IAAI,CAAC,GAAG,GAAG,6BAA6B,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,gEAAgE,EACpJ,2GAA2G,CAC5G,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,CAAqB,EACrB,OAAyB,EAAE,EAC3B,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,0CAA0C,CAAC,CAAC,cAAc,KAAK,qBAAqB,kFAAkF;SAC9K,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,6BAA6B,GAAG,MAAM,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EACH,GAAG,KAAK,IAAI;gBACV,CAAC,CAAC,mBAAmB,qBAAqB,WAAW,mBAAmB,oDAAoD,6BAA6B,sDAAsD;gBAC/M,CAAC,CAAC,qDAAqD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,6BAA6B,oIAAoI;SAC7P,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,KAAK;QACL,UAAU;QACV,QAAQ;QACR,CAAC,CAAC,cAAc;QAChB,UAAU;QACV,CAAC,CAAC,MAAM;QACR,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,oBAAoB,qBAAqB,EAAE;QAC3C,mBAAmB,mBAAmB,EAAE;QACxC,SAAS;KACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"seal-key-rotation.js","sourceRoot":"","sources":["../src/seal-key-rotation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AACzE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,YAAY,GAAG,0BAA0B,CAAC;AACvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AACjE;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6BnC,KAAK,UAAU,UAAU,CACvB,GAAiB,EACjB,CAAqB;IAErB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,UAAU;QACV,UAAU;QACV,CAAC,CAAC,YAAY;QACd,UAAU;QACV,CAAC,CAAC,MAAM;QACR,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC9F,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GACT,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAwD,CAAC,QAAQ,EAAE,MAAM;QAC7F,EAAE,CAAC;IACL,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,YAAY,OAAO,CAAC,CAAC,YAAY,8GAA8G;SAC1J,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAqB;IACrC,OAAO;QACL,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,CAAC,CAAC,YAAY;QACd,UAAU;QACV,CAAC,CAAC,MAAM;QACR,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,CAAqB,EACrB,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,6CAA6C,KAAK,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,2FAA2F,6BAA6B,0EAA0E;SACjT,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,SAAS;QACT,UAAU;QACV,UAAU;QACV,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,+BAA+B,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SACtI,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE;QACxF,KAAK,EAAE,QAAQ,EAAE;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,QAAQ,iCAAiC,OAAO,GAAG,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG;QACb,KAAK;QACL,UAAU;QACV,QAAQ;QACR,CAAC,CAAC,YAAY;QACd,UAAU;QACV,CAAC,CAAC,MAAM;QACR,OAAO;QACP,oBAAoB,YAAY,IAAI,QAAQ,WAAW,qBAAqB,IAAI,QAAQ,IAAI,OAAO,EAAE;QACrG,mBAAmB,mBAAmB,IAAI,GAAG,EAAE;QAC/C,SAAS;KACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,gIAAgI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;SAC3N,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,2EAA2E,OAAO,eAAe,EACjG,gBAAgB,IAAI,IAAI,CAAC,GAAG,GAAG,6BAA6B,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,gEAAgE,EACpJ,2GAA2G,CAC5G,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,CAAqB,EACrB,OAAyB,EAAE,EAC3B,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EAAE,0CAA0C,CAAC,CAAC,YAAY,KAAK,qBAAqB,kFAAkF;SAC5K,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,6BAA6B,GAAG,MAAM,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK;YACL,KAAK,EACH,GAAG,KAAK,IAAI;gBACV,CAAC,CAAC,0BAA0B,qBAAqB,WAAW,mBAAmB,oDAAoD,6BAA6B,sDAAsD;gBACtN,CAAC,CAAC,qDAAqD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,6BAA6B,oIAAoI;SAC7P,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,KAAK;QACL,UAAU;QACV,QAAQ;QACR,CAAC,CAAC,YAAY;QACd,UAAU;QACV,CAAC,CAAC,MAAM;QACR,aAAa,CAAC,CAAC,SAAS,EAAE;QAC1B,oBAAoB,qBAAqB,EAAE;QAC3C,mBAAmB,mBAAmB,EAAE;QACxC,SAAS;KACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/self-hosted-db-tls.d.ts

@@ -0,0 +1,37 @@
+/** The directory under `.caelo/` that holds the install's database TLS files. */
+export declare const SELF_HOSTED_TLS_DIR = "postgres-tls";
+/** The host name the services dial Postgres by on the Compose network. */
+export declare const SELF_HOSTED_DB_HOST = "postgres";
+/** File names inside {@link SELF_HOSTED_TLS_DIR}. */
+export declare const SELF_HOSTED_TLS_FILES: {
+    readonly caCert: "ca.crt";
+    readonly caKey: "ca.key";
+    readonly serverCert: "server.crt";
+    readonly serverKey: "server.key";
+};
+/** The PEM files of an install's database TLS. */
+export interface DatabaseTlsFiles {
+    readonly caCert: string;
+    readonly caKey: string;
+    readonly serverCert: string;
+    readonly serverKey: string;
+}
+/** A fresh CA and a server certificate it signed. */
+export declare function generateDatabaseTls(now?: Date): DatabaseTlsFiles;
+/** Why `serverCert` must be re-issued, or null when it is fine. */
+export declare function serverCertProblem(caCert: string, serverCert: string, now: Date): string | null;
+/**
+ * Make sure `<caeloDir>/postgres-tls/` holds the install's CA and a valid
+ * server certificate; returns what it did (empty when nothing changed).
+ * The CA is created once and never replaced.
+ */
+export declare function ensureSelfHostedDbTls(caeloDir: string, now?: Date): string[];
+/**
+ * SHA-256 (hex) of the install's database server certificate, which the
+ * Compose file carries on the Postgres service so a renewed certificate
+ * recreates it (compose.ts `dbTlsServerCertSha256`).
+ *
+ * @throws when the certificate is missing: call {@link ensureSelfHostedDbTls} first.
+ */
+export declare function selfHostedDbTlsServerCertSha256(caeloDir: string): string;
+//# sourceMappingURL=self-hosted-db-tls.d.ts.map

package/dist/self-hosted-db-tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-hosted-db-tls.d.ts","sourceRoot":"","sources":["../src/self-hosted-db-tls.ts"],"names":[],"mappings":"AAsCA,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAElD,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAE9C,qDAAqD;AACrD,eAAO,MAAM,qBAAqB;;;;;CAKxB,CAAC;AAiHX,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AA4BD,qDAAqD;AACrD,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,IAAiB,GAAG,gBAAgB,CAgB5E;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAe9F;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,EAAE,CAmCxF;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGxE"}

package/dist/self-hosted-db-tls.js

@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #1338 (gateway hardening L6) — verify-full TLS between the self-hosted
+ * Compose services and their Postgres.
+ *
+ * The admin and the gateway reach Postgres over the Compose network as
+ * `postgres:5432`. With `sslmode=verify-full` they need a server
+ * certificate for exactly that host name, signed by a CA they trust. No
+ * public CA issues a certificate for `postgres`, so every install makes its
+ * own: an ECDSA P-256 CA, generated once and kept in `.caelo/postgres-tls/`
+ * (like the install's other secrets in `.caelo/`), and a server certificate
+ * it signs. The CA certificate is mounted read-only into the admin and the
+ * gateway at shared `SELF_HOSTED_CA_FILE`; the server key only into
+ * Postgres.
+ *
+ * Generated with `node:crypto` and a minimal DER encoder below, so an
+ * install needs neither openssl on the host nor a new dependency (§3).
+ * Postgres reads ECDSA keys; Bun's TLS verifies the chain and the host.
+ *
+ * Re-runs keep what exists (the CA never changes once made, so no client
+ * ever needs a new trust anchor); a server certificate that is missing,
+ * does not chain to the CA, does not name `postgres`, or expires within a
+ * year is re-issued from the stored CA key.
+ */
+import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, sign, X509Certificate, } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/** The directory under `.caelo/` that holds the install's database TLS files. */
+export const SELF_HOSTED_TLS_DIR = "postgres-tls";
+/** The host name the services dial Postgres by on the Compose network. */
+export const SELF_HOSTED_DB_HOST = "postgres";
+/** File names inside {@link SELF_HOSTED_TLS_DIR}. */
+export const SELF_HOSTED_TLS_FILES = {
+    caCert: "ca.crt",
+    caKey: "ca.key",
+    serverCert: "server.crt",
+    serverKey: "server.key",
+};
+const YEAR_MS = 365 * 24 * 3600 * 1000;
+const CA_VALIDITY_YEARS = 30;
+const SERVER_VALIDITY_YEARS = 10;
+/** A server certificate closer than this to its end is re-issued. */
+const RENEW_BEFORE_MS = YEAR_MS;
+// ---------------------------------------------------------------------------
+// Minimal DER (X.690) — only what an X.509 v3 certificate needs.
+// ---------------------------------------------------------------------------
+function derLength(n) {
+    if (n < 0x80)
+        return Buffer.from([n]);
+    const bytes = [];
+    for (let v = n; v > 0; v = Math.floor(v / 256))
+        bytes.unshift(v & 0xff);
+    return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+function tlv(tag, value) {
+    return Buffer.concat([Buffer.from([tag]), derLength(value.length), value]);
+}
+const seq = (...items) => tlv(0x30, Buffer.concat(items));
+const set = (...items) => tlv(0x31, Buffer.concat(items));
+const explicit = (n, inner) => tlv(0xa0 + n, inner);
+const octets = (b) => tlv(0x04, b);
+/** A BIT STRING; `unused` trailing bits of the last byte (DER: minimal for named bits). */
+const bitString = (b, unused = 0) => tlv(0x03, Buffer.concat([Buffer.from([unused]), b]));
+const utf8 = (s) => tlv(0x0c, Buffer.from(s, "utf8"));
+const bool = (v) => tlv(0x01, Buffer.from([v ? 0xff : 0]));
+function integer(b) {
+    let v = b;
+    while (v.length > 1 && v[0] === 0 && (v[1] ?? 0) < 0x80)
+        v = v.subarray(1);
+    if ((v[0] ?? 0) >= 0x80)
+        v = Buffer.concat([Buffer.from([0]), v]);
+    return tlv(0x02, v);
+}
+function oid(dotted) {
+    const parts = dotted.split(".").map(Number);
+    const out = [40 * (parts[0] ?? 0) + (parts[1] ?? 0)];
+    for (const p of parts.slice(2)) {
+        const chunk = [p & 0x7f];
+        for (let v = Math.floor(p / 128); v > 0; v = Math.floor(v / 128))
+            chunk.unshift(0x80 | (v & 0x7f));
+        out.push(...chunk);
+    }
+    return tlv(0x06, Buffer.from(out));
+}
+/** UTCTime until 2049, GeneralizedTime from 2050 (RFC 5280 §4.1.2.5). */
+function time(d) {
+    const iso = d.toISOString().replace(/[-:T]/g, "").slice(0, 14);
+    return d.getUTCFullYear() < 2050
+        ? tlv(0x17, Buffer.from(`${iso.slice(2)}Z`))
+        : tlv(0x18, Buffer.from(`${iso}Z`));
+}
+const ECDSA_SHA256 = seq(oid("1.2.840.10045.4.3.2"));
+const name = (cn) => seq(set(seq(oid("2.5.4.3"), utf8(cn))));
+const extension = (id, critical, value) => seq(oid(id), ...(critical ? [bool(true)] : []), octets(value));
+function certificatePem(spec) {
+    const spki = spec.publicKey.export({ type: "spki", format: "der" });
+    const exts = [
+        extension("2.5.29.19", true, spec.ca ? seq(bool(true)) : seq()),
+        // keyCertSign + cRLSign for the CA; digitalSignature for the server.
+        extension("2.5.29.15", true, spec.ca ? bitString(Buffer.from([0x06]), 1) : bitString(Buffer.from([0x80]), 7)),
+        ...(spec.ca
+            ? []
+            : [
+                extension("2.5.29.37", false, seq(oid("1.3.6.1.5.5.7.3.1"))),
+                extension("2.5.29.17", false, seq(...(spec.dnsNames ?? []).map((n) => tlv(0x82, Buffer.from(n, "ascii"))))),
+            ]),
+    ];
+    const tbs = seq(explicit(0, integer(Buffer.from([2]))), integer(Buffer.concat([Buffer.from([0x01]), randomBytes(15)])), ECDSA_SHA256, name(spec.issuer), seq(time(spec.notBefore), time(spec.notAfter)), name(spec.subject), spki, explicit(3, seq(...exts)));
+    const signature = sign("sha256", tbs, { key: spec.signingKey, dsaEncoding: "der" });
+    const der = seq(tbs, ECDSA_SHA256, bitString(signature));
+    const b64 = der.toString("base64").replace(/.{64}/g, "$&\n").replace(/\n$/, "");
+    return `-----BEGIN CERTIFICATE-----\n${b64}\n-----END CERTIFICATE-----\n`;
+}
+function newKeyPair() {
+    return generateKeyPairSync("ec", { namedCurve: "P-256" });
+}
+/** A server certificate for {@link SELF_HOSTED_DB_HOST}, signed by the CA. */
+function issueServer(ca, now) {
+    const server = newKeyPair();
+    const caSubject = new X509Certificate(ca.cert).subject.replace(/^CN=/, "");
+    return {
+        serverCert: certificatePem({
+            subject: SELF_HOSTED_DB_HOST,
+            issuer: caSubject,
+            publicKey: server.publicKey,
+            signingKey: ca.key,
+            notBefore: new Date(now.getTime() - 3600 * 1000),
+            notAfter: new Date(now.getTime() + SERVER_VALIDITY_YEARS * YEAR_MS),
+            ca: false,
+            dnsNames: [SELF_HOSTED_DB_HOST],
+        }),
+        serverKey: server.privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    };
+}
+/** A fresh CA and a server certificate it signed. */
+export function generateDatabaseTls(now = new Date()) {
+    const ca = newKeyPair();
+    const caCert = certificatePem({
+        subject: "Caelo self-hosted database CA",
+        issuer: "Caelo self-hosted database CA",
+        publicKey: ca.publicKey,
+        signingKey: ca.privateKey,
+        notBefore: new Date(now.getTime() - 3600 * 1000),
+        notAfter: new Date(now.getTime() + CA_VALIDITY_YEARS * YEAR_MS),
+        ca: true,
+    });
+    return {
+        caCert,
+        caKey: ca.privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        ...issueServer({ cert: caCert, key: ca.privateKey }, now),
+    };
+}
+/** Why `serverCert` must be re-issued, or null when it is fine. */
+export function serverCertProblem(caCert, serverCert, now) {
+    try {
+        const ca = new X509Certificate(caCert);
+        const server = new X509Certificate(serverCert);
+        if (!server.verify(ca.publicKey))
+            return "it is not signed by the install's CA";
+        if (server.checkHost(SELF_HOSTED_DB_HOST) !== SELF_HOSTED_DB_HOST) {
+            return `it does not name ${SELF_HOSTED_DB_HOST}`;
+        }
+        if (Date.parse(server.validTo) - now.getTime() < RENEW_BEFORE_MS) {
+            return `it expires ${server.validTo}`;
+        }
+        return null;
+    }
+    catch (e) {
+        return `it does not parse (${e instanceof Error ? e.message : String(e)})`;
+    }
+}
+/**
+ * Make sure `<caeloDir>/postgres-tls/` holds the install's CA and a valid
+ * server certificate; returns what it did (empty when nothing changed).
+ * The CA is created once and never replaced.
+ */
+export function ensureSelfHostedDbTls(caeloDir, now = new Date()) {
+    const dir = join(caeloDir, SELF_HOSTED_TLS_DIR);
+    const path = (f) => join(dir, SELF_HOSTED_TLS_FILES[f]);
+    // The CA key and the server key are secrets; the certificates are not,
+    // but every container reads them through a bind mount, so 0644.
+    const write = (f, content) => writeFileSync(path(f), content, { mode: f.endsWith("Key") ? 0o600 : 0o644 });
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const done = [];
+    if (!existsSync(path("caCert")) || !existsSync(path("caKey"))) {
+        if (existsSync(path("caCert")) !== existsSync(path("caKey"))) {
+            throw new Error(`${dir} holds only half of the database CA (${SELF_HOSTED_TLS_FILES.caCert} / ${SELF_HOSTED_TLS_FILES.caKey}). Restore the missing file from your backup of .caelo/, or delete both to make a new CA (every service is re-created with it on the next \`cms-provision up\`).`);
+        }
+        const files = generateDatabaseTls(now);
+        for (const f of Object.keys(SELF_HOSTED_TLS_FILES)) {
+            write(f, files[f]);
+        }
+        done.push(`created the install's database CA and the server certificate for ${SELF_HOSTED_DB_HOST}`);
+        return done;
+    }
+    const caCert = readFileSync(path("caCert"), "utf8");
+    const problem = existsSync(path("serverCert"))
+        ? serverCertProblem(caCert, readFileSync(path("serverCert"), "utf8"), now)
+        : "it is missing";
+    if (problem === null && existsSync(path("serverKey")))
+        return done;
+    const key = createPrivateKey(readFileSync(path("caKey"), "utf8"));
+    const issued = issueServer({ cert: caCert, key }, now);
+    write("serverCert", issued.serverCert);
+    write("serverKey", issued.serverKey);
+    done.push(`re-issued the database server certificate (${problem ?? "its key was missing"})`);
+    return done;
+}
+/**
+ * SHA-256 (hex) of the install's database server certificate, which the
+ * Compose file carries on the Postgres service so a renewed certificate
+ * recreates it (compose.ts `dbTlsServerCertSha256`).
+ *
+ * @throws when the certificate is missing: call {@link ensureSelfHostedDbTls} first.
+ */
+export function selfHostedDbTlsServerCertSha256(caeloDir) {
+    const cert = readFileSync(join(caeloDir, SELF_HOSTED_TLS_DIR, SELF_HOSTED_TLS_FILES.serverCert));
+    return createHash("sha256").update(cert).digest("hex");
+}
+//# sourceMappingURL=self-hosted-db-tls.js.map

package/dist/self-hosted-db-tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-hosted-db-tls.js","sourceRoot":"","sources":["../src/self-hosted-db-tls.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,mBAAmB,EAEnB,WAAW,EACX,IAAI,EACJ,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAElD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE9C,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,QAAQ;IACf,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,YAAY;CACf,CAAC;AAEX,MAAM,OAAO,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,qEAAqE;AACrE,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC,8EAA8E;AAC9E,iEAAiE;AACjE,8EAA8E;AAE9E,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,GAAG,CAAC,GAAW,EAAE,KAAa;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAG,KAAe,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACpE,MAAM,GAAG,GAAG,CAAC,GAAG,KAAe,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACpE,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;AACpE,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,2FAA2F;AAC3F,MAAM,SAAS,GAAG,CAAC,CAAS,EAAE,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpE,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI;QAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI;QAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,GAAG,CAAC,MAAc;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAa,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAa,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC;YAC9D,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,yEAAyE;AACzE,SAAS,IAAI,CAAC,CAAO;IACnB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,cAAc,EAAE,GAAG,IAAI;QAC9B,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;AACrD,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACrE,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,QAAiB,EAAE,KAAa,EAAE,EAAE,CACjE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAcjE,SAAS,cAAc,CAAC,IAAc;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG;QACX,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/D,qEAAqE;QACrE,SAAS,CACP,WAAW,EACX,IAAI,EACJ,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAChF;QACD,GAAG,CAAC,IAAI,CAAC,EAAE;YACT,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBAC5D,SAAS,CACP,WAAW,EACX,KAAK,EACL,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAC7E;aACF,CAAC;KACP,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,CACb,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACtC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAC9D,YAAY,EACZ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAClB,IAAI,EACJ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAC1B,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,gCAAgC,GAAG,+BAA+B,CAAC;AAC5E,CAAC;AAUD,SAAS,UAAU;IACjB,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAClB,EAAoC,EACpC,GAAS;IAET,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3E,OAAO;QACL,UAAU,EAAE,cAAc,CAAC;YACzB,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,EAAE,CAAC,GAAG;YAClB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;YAChD,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,qBAAqB,GAAG,OAAO,CAAC;YACnE,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC,mBAAmB,CAAC;SAChC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KACjF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,mBAAmB,CAAC,MAAY,IAAI,IAAI,EAAE;IACxD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,cAAc,CAAC;QAC5B,OAAO,EAAE,+BAA+B;QACxC,MAAM,EAAE,+BAA+B;QACvC,SAAS,EAAE,EAAE,CAAC,SAAS;QACvB,UAAU,EAAE,EAAE,CAAC,UAAU;QACzB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QAChD,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,iBAAiB,GAAG,OAAO,CAAC;QAC/D,EAAE,EAAE,IAAI;KACT,CAAC,CAAC;IACH,OAAO;QACL,MAAM;QACN,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QACxE,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAAkB,EAAE,GAAS;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC;YAAE,OAAO,sCAAsC,CAAC;QAChF,IAAI,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,mBAAmB,EAAE,CAAC;YAClE,OAAO,oBAAoB,mBAAmB,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,EAAE,CAAC;YACjE,OAAO,cAAc,MAAM,CAAC,OAAO,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,sBAAsB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,MAAY,IAAI,IAAI,EAAE;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,CAAqC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,KAAK,GAAG,CAAC,CAAqC,EAAE,OAAe,EAAE,EAAE,CACvE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/E,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9D,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,wCAAwC,qBAAqB,CAAC,MAAM,MAAM,qBAAqB,CAAC,KAAK,kKAAkK,CAC9Q,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAA2C,EAAE,CAAC;YAC7F,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,IAAI,CACP,oEAAoE,mBAAmB,EAAE,CAC1F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC;QAC1E,CAAC,CAAC,eAAe,CAAC;IACpB,IAAI,OAAO,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IACvD,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,8CAA8C,OAAO,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B,CAAC,QAAgB;IAC9D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;IACjG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/dist/self-hosted-release.d.ts

@@ -46,6 +46,8 @@ export interface SelfHostedRelease {
     readonly images: {
         readonly admin: string;
         readonly gateway: string;
+        /** #1328 — absent in records of releases from before the MCP-Auth-Proxy. */
+        readonly "mcp-auth-proxy"?: string;
     };
     readonly installedAt: string;
     /** Newest last; capped at {@link HISTORY_LIMIT}. */
@@ -78,7 +80,7 @@ export type VerifiedRelease = {
     readonly error: string;
 };
 /**
- * Resolve the admin + gateway images of release `tag` in GHCR to digests,
+ * Resolve every release image of `tag` (RELEASE_SERVICES) in GHCR to digests,
  * then cosign-verify each digest against the Caelo release workflow
  * identity (unless `skipVerify`, the escape hatch for forks). The returned
  * references are digest-pinned, so what was verified is exactly what runs.

package/dist/self-hosted-release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self-hosted-release.d.ts","sourceRoot":"","sources":["../src/self-hosted-release.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAiC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAUjF,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;OAOG;IACH,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7E;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,UAwB3B,CAAC;AAEF,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAClD;AAID,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAqBtE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAChD,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,EACtC,GAAG,GAAE,IAAiB,GACrB,iBAAiB,CAenB;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACrB,IAAI,CAON;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD,GACA,OAAO,CAAC,eAAe,CAAC,CAmD1B"}
+{"version":3,"file":"self-hosted-release.d.ts","sourceRoot":"","sources":["../src/self-hosted-release.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAiC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAWjF,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;OAOG;IACH,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7E;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,UAwB3B,CAAC;AAEF,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,4EAA4E;QAC5E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;KACpC,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAClD;AAID,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,CAEvE;AAYD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAuBtE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAChD,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,EACtC,GAAG,GAAE,IAAiB,GACrB,iBAAiB,CAenB;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACrB,IAAI,CAON;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD,GACA,OAAO,CAAC,eAAe,CAAC,CA+D1B"}