@caelo-cms/provisioning 0.11.9 → 0.11.11

package/dist/agent/run.js

@@ -153,7 +153,11 @@ export async function runAgentOnce(deps) {
                 requestId: request.id,
                 targetVersion: m.version,
                 trigger: request.trigger,
-                digests: { admin: m.digests.admin, gateway: m.digests.gateway },
+                digests: {
+                    admin: m.digests.admin,
+                    gateway: m.digests.gateway,
+                    ...(m.digests["mcp-auth-proxy"] ? { "mcp-auth-proxy": m.digests["mcp-auth-proxy"] } : {}),
+                },
                 cliPath: cli.cliPath,
             });
         }

package/dist/agent/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/agent/run.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,kCAAkC,EAA8B,MAAM,mBAAmB,CAAC;AAGnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAe,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAiEjD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,qBAAqB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,yCAAyC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,OAAiD,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC;IACxB,MAAM,CAAC,GAAG,aAAa,CACrB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EACzE,GAAG,EACH,OAAO,CAAC,EAAE,CACX,CAAC;IACF,IAAI,OAAO,GAAwB,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,uCAAuC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,EACpB,MAAuB,EACvB,KAAwB,EACxB,MAAc,EACW,EAAE;QAC3B,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC;QACT,MAAM,GAAG,GAAc;YACrB,MAAM;YACN,MAAM;YACN,KAAK;YACL,gBAAgB,EACd,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;SAClF,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjB,CAAC,CAAC,IAAI,CACJ,uBAAuB,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,YAAY,4CAA4C,OAAO,CAAC,aAAa,GAAG,CACjI,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,MAAM,QAAQ,CACnB,QAAQ,EACR,CAAC,WAAW,CAAC,EACb,wBAAwB,OAAO,0CAA0C,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qEAAqE;YACrE,oEAAoE;YACpE,4BAA4B;YAC5B,IAAI,CAAC,YAAY,oBAAoB,EAAE,CAAC;gBACtC,OAAO,MAAM,QAAQ,CACnB,QAAQ,EACR,CAAC,cAAc,CAAC,EAChB,wBAAwB,SAAS,CAAC,CAAC,CAAC,kCAAkC,CACvE,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,wBAAwB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,SAAmC,CAAC;QACxC,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE,wBAAwB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,OAAO;YACP,QAAQ;YACR,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE;YAC9E,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,OAAO,CACP,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,OAAO,gDAAgD,CACpG,CAAC;YACF,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CACjB,sBAAsB,CAAC,CAAC,OAAO,gDAAgD,CAChF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/B,qEAAqE;YACrE,yCAAyC;YACzC,MAAM,OAAO,GAAG,CAAC,kBAAkB,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvF,OAAO,MAAM,QAAQ,CACnB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAC9B,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EACzB,+CAA+C,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,sBAAsB,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CAC7K,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CACP,aAAa,CAAC,CAAC,OAAO,iEAAiE,CACxF,CAAC;QACF,CAAC,CAAC,IAAI,CACJ,GAAG,SAAS,EAAE,OAAO,MAAM,CAAC,CAAC,OAAO,+BAA+B,CAAC,CAAC,OAAO,4BAA4B,CACzG,CAAC;QACF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAEhB,MAAM,IAAI,GAAG,WAAW,CACtB,GAAG,EAAE;YACH,KAAK;iBACF,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;iBAC9E,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;gBACpB,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;QACP,CAAC,EACD,IAAI,CAAC,gBAAgB,IAAI,kCAAkC,GAAG,IAAI,CACnE,CAAC;QACF,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;gBAC/B,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,aAAa,EAAE,CAAC,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;gBAC/D,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,EAAE,CAAC;QACT,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxF,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,OAAO,4BAA4B,OAAO,CAAC,QAAQ,gHAAgH,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/O,MAAM,GAAG,GAAc;YACrB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YAC7B,KAAK,EAAE,CAAC,OAAO,CAAC;YAChB,gBAAgB,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM;SAC7C,CAAC;QACF,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5F,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,MAAM,QAAQ,CACnB,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,0CAA0C,SAAS,CAAC,CAAC,CAAC,sEAAsE,CAC7H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAiB,EAAE,SAAiB,EAAE,CAAkB;IACjF,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;QAC5B,gBAAgB,EAAE,CAAC,CAAC,QAAQ;QAC5B,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ;QACzC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;QAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO;KACjC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/agent/run.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,kCAAkC,EAA8B,MAAM,mBAAmB,CAAC;AAGnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAe,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAsEjD,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAkB;IACnD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,qBAAqB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,yCAAyC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,OAAiD,CAAC;IACtD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC;IACxB,MAAM,CAAC,GAAG,aAAa,CACrB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EACzE,GAAG,EACH,OAAO,CAAC,EAAE,CACX,CAAC;IACF,IAAI,OAAO,GAAwB,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,uCAAuC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,EACpB,MAAuB,EACvB,KAAwB,EACxB,MAAc,EACW,EAAE;QAC3B,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC;QACT,MAAM,GAAG,GAAc;YACrB,MAAM;YACN,MAAM;YACN,KAAK;YACL,gBAAgB,EACd,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;SAClF,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;IACrE,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjB,CAAC,CAAC,IAAI,CACJ,uBAAuB,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,YAAY,4CAA4C,OAAO,CAAC,aAAa,GAAG,CACjI,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,MAAM,QAAQ,CACnB,QAAQ,EACR,CAAC,WAAW,CAAC,EACb,wBAAwB,OAAO,0CAA0C,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qEAAqE;YACrE,oEAAoE;YACpE,4BAA4B;YAC5B,IAAI,CAAC,YAAY,oBAAoB,EAAE,CAAC;gBACtC,OAAO,MAAM,QAAQ,CACnB,QAAQ,EACR,CAAC,cAAc,CAAC,EAChB,wBAAwB,SAAS,CAAC,CAAC,CAAC,kCAAkC,CACvE,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,wBAAwB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,SAAmC,CAAC;QACxC,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,CAAC,eAAe,CAAC,EAAE,wBAAwB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,OAAO;YACP,QAAQ;YACR,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE;YAC9E,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,OAAO,CACP,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,OAAO,gDAAgD,CACpG,CAAC;YACF,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CACjB,sBAAsB,CAAC,CAAC,OAAO,gDAAgD,CAChF,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/B,qEAAqE;YACrE,yCAAyC;YACzC,MAAM,OAAO,GAAG,CAAC,kBAAkB,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvF,OAAO,MAAM,QAAQ,CACnB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAC9B,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EACzB,+CAA+C,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,sBAAsB,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CAC7K,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CACP,aAAa,CAAC,CAAC,OAAO,iEAAiE,CACxF,CAAC;QACF,CAAC,CAAC,IAAI,CACJ,GAAG,SAAS,EAAE,OAAO,MAAM,CAAC,CAAC,OAAO,+BAA+B,CAAC,CAAC,OAAO,4BAA4B,CACzG,CAAC;QACF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAEhB,MAAM,IAAI,GAAG,WAAW,CACtB,GAAG,EAAE;YACH,KAAK;iBACF,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;iBAC9E,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;gBACpB,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC,CAAC,CAAC;QACP,CAAC,EACD,IAAI,CAAC,gBAAgB,IAAI,kCAAkC,GAAG,IAAI,CACnE,CAAC;QACF,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;gBAC/B,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,aAAa,EAAE,CAAC,CAAC,OAAO;gBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE;oBACP,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO;oBAC1B,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1F;gBACD,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,EAAE,CAAC;QACT,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxF,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,OAAO,4BAA4B,OAAO,CAAC,QAAQ,gHAAgH,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/O,MAAM,GAAG,GAAc;YACrB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YAC7B,KAAK,EAAE,CAAC,OAAO,CAAC;YAChB,gBAAgB,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM;SAC7C,CAAC;QACF,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5F,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChB,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,MAAM,QAAQ,CACnB,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,0CAA0C,SAAS,CAAC,CAAC,CAAC,sEAAsE,CAC7H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,KAAiB,EAAE,SAAiB,EAAE,CAAkB;IACjF,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE;QAC5B,gBAAgB,EAAE,CAAC,CAAC,QAAQ;QAC5B,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ;QACzC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;QAC5B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO;KACjC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/agent-db.js

@@ -7746,6 +7746,9 @@ var updatePolicySchema = object({
 var AUTO_UPDATE_BASES = ["security", "patch", "minor"];
 // ../shared/src/base-css.ts
 var BASE_TECHNICAL_CSS = "*,*::before,*::after{box-sizing:border-box}" + "body{margin:0}" + "img,picture,video,canvas,svg{display:block;max-width:100%}" + "input,button,textarea,select{font:inherit}" + "body{font-family:var(--font-body,system-ui,sans-serif)}";
+// ../shared/src/body-cap.ts
+var DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+var HARD_MAX_BODY_BYTES = 1024 * 1024;
 // ../shared/src/bug-intake.ts
 var BUG_INTAKE_PROTOCOL_VERSION = 1;
 var BUG_INTAKE_MAX_CLOCK_SKEW_MS = 5 * 60 * 1000;
@@ -8100,6 +8103,11 @@ var JOURNALED_TABLES = {
 };
 // ../shared/src/css-scope-scan.ts
 var GROUPING_AT_RULES = new Set(["media", "supports", "layer", "container", "document"]);
+// ../shared/src/database-tls.ts
+var DATABASE_CA_DIR = "/etc/caelo/db-ca";
+var CLOUD_SQL_CA_BUNDLE = `${DATABASE_CA_DIR}/cloudsql-global.pem`;
+var AWS_RDS_CA_BUNDLE = `${DATABASE_CA_DIR}/aws-rds-global.pem`;
+var SELF_HOSTED_CA_FILE = `${DATABASE_CA_DIR}/self-hosted-ca.pem`;
 // ../shared/src/interactions.ts
 var MOBILE_NAV_CSS = ".caelo-nav-menu .caelo-nav-toggle{display:none;background:none;border:0;cursor:pointer;padding:0.5rem;color:inherit;font:inherit}" + ".caelo-nav-menu .caelo-nav-toggle .caelo-nav-bar{display:block;width:1.25em;height:2px;background:currentColor;margin:0.25em 0}" + "@media (max-width: 720px){" + ".caelo-nav-menu .caelo-nav-toggle{display:inline-block}" + ".caelo-nav-menu > ul{display:none}" + '.caelo-nav-menu[data-nav-open="true"] > ul{display:block}' + "}";
 var MOBILE_NAV_JS = "(function(){" + `var S='[data-caelo-ui="mobile-nav"]';` + "function set(nav,open){nav.setAttribute('data-nav-open',String(open));" + "var b=nav.querySelector('.caelo-nav-toggle');if(b)b.setAttribute('aria-expanded',String(open));return b;}" + "document.addEventListener('click',function(e){" + "var t=e.target;if(!(t instanceof Element))return;" + "var b=t.closest('.caelo-nav-toggle');if(!b)return;var nav=b.closest(S);if(!nav)return;" + "set(nav,nav.getAttribute('data-nav-open')!=='true');});" + "document.addEventListener('keydown',function(e){" + "if(e.key!=='Escape')return;var t=e.target;if(!(t instanceof Element))return;" + `var nav=t.closest(S+'[data-nav-open="true"]');if(!nav)return;` + "var b=set(nav,false);if(b)b.focus();});" + "})();";
@@ -9296,6 +9304,17 @@ var PROPOSAL_STATUSES = ["pending", "applied", "rejected", "superseded"];
 var proposalStatus = _enum(PROPOSAL_STATUSES);
 // ../shared/src/redirect-emit-cloudfront.ts
 var CLOUDFRONT_KVS_MAX_TOTAL_BYTES = 5 * 1024 * 1024;
+// ../shared/src/redirect-emit-gcp.ts
+var GCP_GATEWAY_PATHS = ["/api/*"];
+var GCP_MCP_AUTH_PROXY_PATHS = [
+  "/api/mcp/*",
+  "/.well-known/oauth-protected-resource/*",
+  "/.well-known/oauth-authorization-server/*"
+];
+var GCP_PUBLIC_BASE_PATHS = [
+  ...GCP_GATEWAY_PATHS,
+  ...GCP_MCP_AUTH_PROXY_PATHS
+];
 // ../shared/src/redirect-plan.ts
 var REDIRECT_STATUSES = new Set([301, 302, 307, 308]);
 // ../shared/src/release-manifest.ts
@@ -9309,8 +9328,18 @@ var ReleaseManifestSchema = object({
   manifestVersion: literal(1),
   version: string2().regex(SEMVER2, "expected a SemVer version without a leading v"),
   channel: _enum(RELEASE_CHANNELS),
-  digests: object({ admin: digest, gateway: digest, ops: digest }),
-  platformDigests: object({ admin: digest, gateway: digest, ops: digest }).optional(),
+  digests: object({
+    admin: digest,
+    gateway: digest,
+    ops: digest,
+    "mcp-auth-proxy": digest.optional()
+  }),
+  platformDigests: object({
+    admin: digest,
+    gateway: digest,
+    ops: digest,
+    "mcp-auth-proxy": digest.optional()
+  }).optional(),
   minFromVersion: string2().regex(SEMVER2),
   infraContractVersion: number2().int().positive(),
   migrations: object({
@@ -9344,6 +9373,13 @@ function err(error) {
 function isErr(result) {
   return !result.ok;
 }
+// ../shared/src/session-cookie.ts
+var SESSION_ENTRY = {
+  visitorId: "vid",
+  login: "login",
+  staging: "staging"
+};
+var KNOWN_KEYS = new Set(Object.values(SESSION_ENTRY));
 // ../shared/src/skills.ts
 var skillAutoEngagementHints = object({
   keywords: array(string2().min(1).max(80)).default([]),
@@ -9414,6 +9450,12 @@ var stageStatusRunSchema = object({
 // ../shared/src/staging-gate.ts
 var STAGING_SESSION_TTL_SECONDS = 12 * 60 * 60;
 var ENCODER = new TextEncoder;
+// ../shared/src/staging-plugin-stub.ts
+var STAGING_PREVIEW_ERROR_KIND = "StagingPreview";
+var STAGING_PLUGIN_STUB_BODY = JSON.stringify({
+  ok: false,
+  error: { kind: STAGING_PREVIEW_ERROR_KIND }
+});
 // ../shared/src/static-cache-policy.ts
 var PINNED_FONT_SLICE_FILE_PATTERN = "[0-9a-f]{64}\\.[0-9a-f]{12}\\.[a-z]+(?:-[a-z]+)?\\.[0-9a-f]{12}\\.woff2";
 var PINNED_FONT_SLICE_FILE_RE = new RegExp(`^${PINNED_FONT_SLICE_FILE_PATTERN}$`);
@@ -19325,12 +19367,14 @@ class DatabaseAdapter {
   #adminRaw;
   #publicRaw;
   #adminUrl;
+  #tls;
   #publicUrl;
   #listeners = new Map;
   #listenLost = new Map;
   #listenersClosing = false;
   #skipVerify;
   #roles;
+  #publicDatabase;
   #acquireTimeoutMs;
   #guard = new PoolGuard;
   #verifyPromise = null;
@@ -19339,6 +19383,7 @@ class DatabaseAdapter {
   #drizzleOptions;
   constructor(config) {
     this.#roles = config.expectedRoles ?? DEFAULT_ROLES;
+    this.#publicDatabase = config.publicDatabase ?? "cms_public";
     if (config.adminDatabaseUrl === null !== (this.#roles.admin === null)) {
       throw new Error("DatabaseAdapter: a public-only adapter (adminDatabaseUrl: null) must expect no admin role, and an adapter with an admin URL must expect one");
     }
@@ -19346,7 +19391,9 @@ class DatabaseAdapter {
     const poolMax = resolvePoolMax(config.poolMax);
     const publicPoolMax = resolvePublicPoolMax(config.publicPoolMax, config.poolMax);
     const idleTimeout = config.poolIdleTimeoutSeconds ?? POOL_IDLE_TIMEOUT_SECONDS;
-    const open = (url, max) => new SQL3(url, max === undefined ? { idleTimeout } : { max, idleTimeout });
+    this.#tls = config.tls ?? null;
+    const tls = this.#tls ? { tls: this.#tls } : {};
+    const open = (url, max) => new SQL3(url, max === undefined ? { idleTimeout, ...tls } : { max, idleTimeout, ...tls });
     this.#adminRaw = config.adminDatabaseUrl === null ? null : open(config.adminDatabaseUrl, poolMax);
     this.#publicRaw = open(config.publicDatabaseUrl, publicPoolMax);
     this.#adminUrl = config.adminDatabaseUrl;
@@ -19478,8 +19525,8 @@ class DatabaseAdapter {
       }
       return;
     }
-    if (id.database !== "cms_public") {
-      throw new Error(`DatabaseAdapter public pool expected database cms_public but connected to ${id.database}. Check PUBLIC_DATABASE_URL / PUBLIC_ADMIN_DATABASE_URL.`);
+    if (id.database !== this.#publicDatabase) {
+      throw new Error(`DatabaseAdapter public pool expected database ${this.#publicDatabase} but connected to ${id.database}. Check ${this.#publicDatabase === "cms_public" ? "PUBLIC_DATABASE_URL / PUBLIC_ADMIN_DATABASE_URL" : "PUBLIC_DATABASE_URL / PUBLIC_STAGING_ADMIN_DATABASE_URL"}.`);
     }
     if (!this.#roles.public.includes(id.user)) {
       throw new Error(`DatabaseAdapter public pool expected user ${this.#roles.public.join(" or ")}, got ${id.user}.`);
@@ -19668,6 +19715,7 @@ class DatabaseAdapter {
     if (!conn) {
       conn = new SQL3(url, {
         max: LISTEN_CONNECTIONS_PER_INSTANCE,
+        ...this.#tls ? { tls: this.#tls } : {},
         onclose: (cause) => {
           if (this.#listenersClosing)
             return;
@@ -19833,12 +19881,23 @@ class DatabaseAdapter {
     const outcome = await this.#transaction("public", "provisionPluginPublicSchema", async (tx) => {
       return provisionPluginSchemaInTx(tx, "provisionPluginPublicSchema", opts);
     });
-    if (outcome.droppedColumns.length > 0) {
-      await this.#transaction("admin", "provisionPluginPublicSchema", async (tx) => {
-        await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
-        await auditDroppedColumns(tx, "cms_public", opts.pluginId, outcome);
-      });
+    const result = {
+      database: this.#publicDatabase,
+      schemaName: outcome.schemaName,
+      droppedColumns: outcome.droppedColumns
+    };
+    if (outcome.droppedColumns.length > 0 && this.#adminRaw !== null) {
+      await this.auditPluginSchemaDrop(opts.pluginId, result);
     }
+    return result;
+  }
+  async auditPluginSchemaDrop(pluginId, outcome) {
+    if (outcome.droppedColumns.length === 0)
+      return;
+    await this.#transaction("admin", "provisionPluginPublicSchema", async (tx) => {
+      await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
+      await auditDroppedColumns(tx, outcome.database, pluginId, outcome);
+    });
   }
   async provisionPluginAdminSchema(opts) {
     if (!/^[0-9a-f-]{36}$/i.test(opts.pluginId)) {

package/dist/aws-task-roles.d.ts

@@ -10,11 +10,13 @@
 /** The Secrets Manager entries the AWS stack creates (`caelo-<env>-<name>`). */
 export type AwsSecret = "postgres-password" | "public-role-password" | "csrf-secret" | "cookie-secret" | "anthropic-api-key" | "resend-api-key";
 /** A service with its own ECS task role. */
-export type AwsTaskService = "admin" | "gateway";
+export type AwsTaskService = "admin" | "gateway" | "mcp-auth-proxy";
 /**
  * The secrets each service's task role may read. The admin side (admin and
  * its in-process workers) reads all of them; the gateway reads only
- * public_role's password — its one database login.
+ * public_role's password — its one database login; the MCP-Auth-Proxy
+ * (#1328) reads none: remote MCP is not available on AWS, so it holds
+ * neither a database login nor the broker's keys.
  */
 export declare const AWS_SERVICE_SECRETS: Readonly<Record<AwsTaskService, readonly AwsSecret[]>>;
 /**

package/dist/aws-task-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws-task-roles.d.ts","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,MAAM,MAAM,SAAS,GACjB,mBAAmB,GACnB,sBAAsB,GACtB,aAAa,GACb,eAAe,GACf,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,SAAS,EAAE,CAAC,CAUtF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQvE"}
+{"version":3,"file":"aws-task-roles.d.ts","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,MAAM,MAAM,SAAS,GACjB,mBAAmB,GACnB,sBAAsB,GACtB,aAAa,GACb,eAAe,GACf,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,SAAS,EAAE,CAAC,CAWtF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQvE"}

package/dist/aws-task-roles.js

@@ -2,7 +2,9 @@
 /**
  * The secrets each service's task role may read. The admin side (admin and
  * its in-process workers) reads all of them; the gateway reads only
- * public_role's password — its one database login.
+ * public_role's password — its one database login; the MCP-Auth-Proxy
+ * (#1328) reads none: remote MCP is not available on AWS, so it holds
+ * neither a database login nor the broker's keys.
  */
 export const AWS_SERVICE_SECRETS = {
     admin: [
@@ -14,6 +16,7 @@ export const AWS_SERVICE_SECRETS = {
         "resend-api-key",
     ],
     gateway: ["public-role-password"],
+    "mcp-auth-proxy": [],
 };
 /**
  * The IAM policy document letting a task role read exactly `secretArns`.

package/dist/aws-task-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws-task-roles.js","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAwBnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2D;IACzF,KAAK,EAAE;QACL,mBAAmB;QACnB,sBAAsB;QACtB,aAAa;QACb,eAAe;QACf,mBAAmB;QACnB,gBAAgB;KACjB;IACD,OAAO,EAAE,CAAC,sBAAsB,CAAC;CAClC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA6B;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE;SACxF;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"aws-task-roles.js","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAwBnC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2D;IACzF,KAAK,EAAE;QACL,mBAAmB;QACnB,sBAAsB;QACtB,aAAa;QACb,eAAe;QACf,mBAAmB;QACnB,gBAAgB;KACjB;IACD,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,gBAAgB,EAAE,EAAE;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA6B;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE;SACxF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/caddy.d.ts

@@ -1,6 +1,11 @@
 export interface CaddyDomainSpec {
     readonly hostname: string;
-    readonly kind: "admin" | "public";
+    /**
+     * `mcp` (#1328) is the MCP-Auth-Proxy's own host: remote MCP's sign-in
+     * pages and its forwarder must never share an origin with the site, whose
+     * module JS could otherwise read them same-origin or toss their cookies.
+     */
+    readonly kind: "admin" | "public" | "mcp";
     readonly env: "production" | "staging";
 }
 /**
@@ -19,16 +24,28 @@ export interface CaddyfileSpec {
     readonly adminUpstream: string;
     /** `host:port` of the API gateway as Caddy reaches it (Compose: `caelo-gateway:8090`). */
     readonly gatewayUpstream: string;
+    /** `host:port` of the MCP-Auth-Proxy as Caddy reaches it (Compose: `caelo-mcp-auth-proxy:8095`). */
+    readonly mcpAuthProxyUpstream: string;
     readonly domains: ReadonlyArray<CaddyDomainSpec>;
 }
 /** The host the admin of a self-hosted install answers on (same convention as GCP). */
 export declare function selfHostedAdminHost(domain: string): string;
+/** #1328 — the host the MCP-Auth-Proxy of a self-hosted install answers on. */
+export declare function selfHostedMcpHost(domain: string): string;
 /**
  * The vhosts every self-hosted install serves before an Owner adds domains
  * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
- * the staging site on its own host. The admin needs its own host — it
- * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
- * public site, and Caddy refuses two site blocks for the same address.
+ * the staging site on its own host. The admin needs its own host — it routes
+ * from `/` (`/setup`, `/login`, …), so it cannot share one with the public
+ * site, and Caddy refuses two site blocks for the same address.
+ *
+ * #1328 — the MCP-Auth-Proxy's vhost (`mcp.<domain>`, kind `mcp`) is not
+ * seeded: remote MCP needs an identity proxy in front of the admin (§11.B),
+ * which a self-hosted install does not have yet, so the proxy runs
+ * unexposed on the Compose network (E14 a: provisioned, fixed 404) — the
+ * same honest refusal as on aws and azure. Seeding it would make Caddy
+ * fetch and retry an ACME certificate for a host nobody has a DNS record
+ * for. The vhost comes with remote MCP on self-hosted.
  */
 export declare function selfHostedSeedDomains(domain: string, stagingDomain: string): CaddyDomainSpec[];
 /**

package/dist/caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAoEA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAYD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAOzF;AAWD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA4C7D"}
+{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAsEA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAYD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAOzF;AAWD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA6C7D"}

package/dist/caddy.js

@@ -10,6 +10,8 @@
  * Per-vhost shape:
  *   <hostname> {
  *     # admin   → reverse_proxy <adminUpstream>
+ *     # mcp     → reverse_proxy <mcpAuthProxyUpstream> (#1328: the
+ *     #           MCP-Auth-Proxy on its own host, never the site's origin)
  *     # public  → /api/* → <gatewayUpstream>; everything else is the
  *     #           static site (try_files + file_server, 404 → /404.html)
  *   }
@@ -61,12 +63,24 @@ import { CONTENT_HASHED_PATH_PATTERN, caddyRedirectsImport, IMMUTABLE_CACHE_CONT
 export function selfHostedAdminHost(domain) {
     return `admin.${domain}`;
 }
+/** #1328 — the host the MCP-Auth-Proxy of a self-hosted install answers on. */
+export function selfHostedMcpHost(domain) {
+    return `mcp.${domain}`;
+}
 /**
  * The vhosts every self-hosted install serves before an Owner adds domains
  * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
- * the staging site on its own host. The admin needs its own host — it
- * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
- * public site, and Caddy refuses two site blocks for the same address.
+ * the staging site on its own host. The admin needs its own host — it routes
+ * from `/` (`/setup`, `/login`, …), so it cannot share one with the public
+ * site, and Caddy refuses two site blocks for the same address.
+ *
+ * #1328 — the MCP-Auth-Proxy's vhost (`mcp.<domain>`, kind `mcp`) is not
+ * seeded: remote MCP needs an identity proxy in front of the admin (§11.B),
+ * which a self-hosted install does not have yet, so the proxy runs
+ * unexposed on the Compose network (E14 a: provisioned, fixed 404) — the
+ * same honest refusal as on aws and azure. Seeding it would make Caddy
+ * fetch and retry an ACME certificate for a host nobody has a DNS record
+ * for. The vhost comes with remote MCP on self-hosted.
  */
 export function selfHostedSeedDomains(domain, stagingDomain) {
     return [
@@ -113,6 +127,7 @@ export function generateCaddyfile(spec) {
     assertSafeCaddyToken("stagingSiteRoot", spec.stagingSiteRoot, "token");
     assertSafeCaddyToken("adminUpstream", spec.adminUpstream, "token");
     assertSafeCaddyToken("gatewayUpstream", spec.gatewayUpstream, "token");
+    assertSafeCaddyToken("mcpAuthProxyUpstream", spec.mcpAuthProxyUpstream, "token");
     const hostnames = new Set();
     for (const d of spec.domains) {
         assertSafeCaddyToken("hostname", d.hostname, "address");
@@ -150,6 +165,15 @@ function vhost(d, spec) {
         return `${d.hostname} {${noindex}
   reverse_proxy ${spec.adminUpstream}
 }
+`;
+    }
+    if (d.kind === "mcp") {
+        // Everything on this host goes to the proxy: it answers its own 404s.
+        return `${d.hostname} {
+  header X-Robots-Tag "noindex"
+  header X-Content-Type-Options "${NOSNIFF}"
+  reverse_proxy ${spec.mcpAuthProxyUpstream}
+}
 `;
     }
     // public — API routes go to the gateway, the rest is the static site.

package/dist/caddy.js.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,EACvB,OAAO,EACP,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AA4B3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAyB;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,2DAA2D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa,EAAE,IAAyB;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,OAAO,4FAA4F,CAC9J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACrE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACvE,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAEvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;mCAG9B,OAAO;;yCAED,gBAAgB;;oBAErC,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}
+{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,EACvB,OAAO,EACP,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAmC3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,OAAO,MAAM,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAyB;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,2DAA2D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa,EAAE,IAAyB;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,OAAO,4FAA4F,CAC9J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACrE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACvE,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACvE,oBAAoB,CAAC,sBAAsB,EAAE,IAAI,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAEjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACrB,sEAAsE;QACtE,OAAO,GAAG,CAAC,CAAC,QAAQ;;mCAEW,OAAO;kBACxB,IAAI,CAAC,oBAAoB;;CAE1C,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;mCAG9B,OAAO;;yCAED,gBAAgB;;oBAErC,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}

package/dist/cli-routing.js

@@ -136,7 +136,7 @@ export const CLI_COMMANDS = [
 ];
 /** The text `cms-provision --help` prints, built from {@link CLI_COMMANDS}. */
 export function cliUsage() {
-    return (`Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] [--local|--install-job] | <${CLI_COMMANDS.map((c) => c.name).join("|")}> [options]\n` +
+    return (`Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r> [--scheduler-interval-minutes 1-15]] [--local|--install-job] | <${CLI_COMMANDS.map((c) => c.name).join("|")}> [options]\n` +
         "With several installs on this machine, pick one with --install <install-id or domain> (status, upgrade and backup also take --install all); in a terminal you are asked otherwise.\n" +
         "Pass --no-wizard with no sub-command to print this usage instead of the wizard.");
 }

package/dist/cli-routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B;IACpD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,sIAAsI;QAC5I,OAAO,EACL,4MAA4M;KAC/M;IACD;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE;QACR,OAAO,EACL,iHAAiH;KACpH;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EACL,oGAAoG;KACvG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,2DAA2D;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,4JAA4J;QAClK,OAAO,EACL,sGAAsG;KACzG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,2CAA2C;QACjD,OAAO,EACL,2IAA2I;KAC9I;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,8BAA8B;QACpC,OAAO,EACL,gHAAgH;KACnH;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+EAA+E;KACzF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0GAA0G;KAC7G;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,sFAAsF;KAChG;IACD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EACL,8FAA8F;KACjG;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,wFAAwF;QAC9F,OAAO,EACL,mHAAmH;KACtH;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,mCAAmC;QACzC,OAAO,EACL,wGAAwG;KAC3G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,iEAAiE;QACvE,OAAO,EAAE,mFAAmF;KAC7F;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qFAAqF;KAC/F;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0HAA0H;KAC7H;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,0BAA0B;KACpC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,QAAQ;IACtB,OAAO,CACL,sJAAsJ,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe;QAC9M,sLAAsL;QACtL,iFAAiF,CAClF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC;AAYD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA6B;IACpD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,sIAAsI;QAC5I,OAAO,EACL,4MAA4M;KAC/M;IACD;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE;QACR,OAAO,EACL,iHAAiH;KACpH;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EACL,oGAAoG;KACvG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,2DAA2D;KACrE;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,4JAA4J;QAClK,OAAO,EACL,sGAAsG;KACzG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,2CAA2C;QACjD,OAAO,EACL,2IAA2I;KAC9I;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,8BAA8B;QACpC,OAAO,EACL,gHAAgH;KACnH;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,+EAA+E;KACzF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0GAA0G;KAC7G;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,2EAA2E;KACrF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,sFAAsF;KAChG;IACD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ;QACd,OAAO,EACL,8FAA8F;KACjG;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,wFAAwF;QAC9F,OAAO,EACL,mHAAmH;KACtH;IACD;QACE,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,mCAAmC;QACzC,OAAO,EACL,wGAAwG;KAC3G;IACD;QACE,IAAI,EAAE,eAAe;QACrB,IAAI,EAAE,iEAAiE;QACvE,OAAO,EAAE,mFAAmF;KAC7F;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,qFAAqF;KAC/F;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,EAAE;QACR,OAAO,EACL,0HAA0H;KAC7H;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,0BAA0B;KACpC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,QAAQ;IACtB,OAAO,CACL,0LAA0L,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe;QAClP,sLAAsL;QACtL,iFAAiF,CAClF,CAAC;AACJ,CAAC"}

package/dist/cli.js

@@ -41,12 +41,14 @@ import { generateBootstrapToken } from "./bootstrap-token.js";
 import { caddyTokenProblem, generateCaddyfile, selfHostedAdminHost, selfHostedSeedDomains, } from "./caddy.js";
 import { redactCredentials } from "./checkpoint-secrets.js";
 import { cliUsage, initDelegatesToWizard, resolveCliRoute } from "./cli-routing.js";
-import { BOOTSTRAP_DIR, COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM, composeProjectName, generateDockerCompose, isPublishablePort, MEDIA_DIR, SITE_OUTPUT_ROOT, selfHostedSiteUrl, } from "./compose.js";
+import { BOOTSTRAP_DIR, COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM, COMPOSE_MCP_AUTH_PROXY_UPSTREAM, composeProjectName, generateDockerCompose, isPublishablePort, MEDIA_DIR, SITE_OUTPUT_ROOT, selfHostedSiteUrl, } from "./compose.js";
 import { tightenPrivateTree, writePrivateFile } from "./private-file.js";
 import { selfCommand } from "./self-command.js";
+import { ensureSelfHostedDbTls, selfHostedDbTlsServerCertSha256 } from "./self-hosted-db-tls.js";
 import { ensureInternalSecret, writeInternalSecret } from "./self-hosted-internal-secret.js";
 import { bunHostRunner, readRelease, recordRelease, releaseImages, resolveVerifiedRelease, } from "./self-hosted-release.js";
-import { convergeSelfHostedRoles, decideUp, selfHostedBootstrapScript, } from "./self-hosted-roles.js";
+import { applyPreMigrationRoles, convergeSelfHostedRoles, decideUp, selfHostedBootstrapScript, } from "./self-hosted-roles.js";
+import { parseSchedulerIntervalMinutes } from "./stack-contract.js";
 const REPO_ROOT = resolve(import.meta.dir, "../../..");
 /**
  * Whether this CLI runs from a Caelo source checkout (contributor) rather
@@ -138,6 +140,15 @@ function loadConfig() {
         cfg.composeProject ??= "caelo";
         saveConfig(cfg);
     }
+    // #1329 — the staging gateway's login came with the staging database. An
+    // install from before gets its own password now; the next `up` or
+    // upgrade creates the role with it (self-hosted-roles.ts) before anything
+    // uses it, so the roles count as not converged until then.
+    if (cfg.rolePasswords && !cfg.rolePasswords.publicStaging) {
+        cfg.rolePasswords = { ...cfg.rolePasswords, publicStaging: randomSecret(32) };
+        cfg.rolesConverged = false;
+        saveConfig(cfg);
+    }
     return cfg;
 }
 function saveConfig(c) {
@@ -151,9 +162,9 @@ function arg(name) {
         return undefined;
     return process.argv[idx + 1];
 }
-/** Fresh passwords for the two application roles. */
+/** Fresh passwords for the application roles. */
 function newRolePasswords() {
-    return { admin: randomSecret(32), public: randomSecret(32) };
+    return { admin: randomSecret(32), public: randomSecret(32), publicStaging: randomSecret(32) };
 }
 function emitConfig(cfg, extraDomains = []) {
     // Back-fill caeloSecretKek for installs created before P18. Persists
@@ -189,6 +200,7 @@ function writeCaddyfile(cfg, extraDomains) {
         // localhost (#707).
         adminUpstream: COMPOSE_ADMIN_UPSTREAM,
         gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+        mcpAuthProxyUpstream: COMPOSE_MCP_AUTH_PROXY_UPSTREAM,
         domains: dedupeDomains([
             ...selfHostedSeedDomains(cfg.domain, cfg.stagingDomain),
             ...extraDomains,
@@ -222,6 +234,10 @@ function renderCompose(cfg, images) {
     if (!cfg.ports || !cfg.composeProject) {
         throw new Error("config has no ports / composeProject — they are back-filled on load; this is a bug");
     }
+    // #1338 — the install's database CA + server certificate the Compose file
+    // mounts (created once, the server certificate renewed when due).
+    for (const line of ensureSelfHostedDbTls(CAELO_DIR))
+        console.log(`  database TLS: ${line}`);
     return generateDockerCompose({
         domain: cfg.domain,
         postgresPassword: cfg.postgresPassword,
@@ -229,6 +245,7 @@ function renderCompose(cfg, images) {
         caeloSecretKek: cfg.caeloSecretKek,
         // #770 — every render (up, upgrade, agent apply) hands the admin the
         // secret host-side commands sign their /api/internal/* tokens with.
+        dbTlsServerCertSha256: selfHostedDbTlsServerCertSha256(CAELO_DIR),
         internalSecret: ensureInternalSecret(CAELO_DIR, {
             randomSecret: () => randomSecret(48),
             report: (line) => console.log(line),
@@ -239,6 +256,9 @@ function renderCompose(cfg, images) {
         images,
         ports: cfg.ports,
         project: cfg.composeProject,
+        ...(cfg.schedulerIntervalMinutes !== undefined
+            ? { schedulerIntervalMinutes: cfg.schedulerIntervalMinutes }
+            : {}),
         ...(activeAgent(cfg) ? { agent: activeAgent(cfg) } : {}),
     });
 }
@@ -275,6 +295,20 @@ function agentContext(cfg) {
                 ...(activeAgent(cfg) ? { agentPassword: activeAgent(cfg)?.dbPassword } : {}),
             });
         },
+        applyPreMigrationRoles: () => {
+            if (!cfg.rolePasswords) {
+                return Promise.resolve({
+                    ok: false,
+                    reachable: true,
+                    error: "config.json has no role passwords — run `cms-provision up` first",
+                });
+            }
+            return applyPreMigrationRoles({
+                probe: postgresIsUp,
+                psql: superuserPsql,
+                stagingPassword: cfg.rolePasswords.publicStaging,
+            });
+        },
         renderCompose: (images) => renderCompose(cfg, images),
         refreshCaddy: () => refreshCaddyfile(cfg),
         randomSecret: () => randomSecret(32),
@@ -413,7 +447,7 @@ async function init() {
         return;
     }
     if (!domain || !ownerEmail) {
-        console.error("Usage: cms-provision init [--provider self-hosted] --domain example.com [--staging-domain staging.example.com] --owner-email me@example.com [--version x.y.z] [--skip-verify] [--dev] [--tls acme|internal] [--http-port 80] [--https-port 443]\n" +
+        console.error("Usage: cms-provision init [--provider self-hosted] --domain example.com [--staging-domain staging.example.com] --owner-email me@example.com [--version x.y.z] [--skip-verify] [--dev] [--tls acme|internal] [--http-port 80] [--https-port 443] [--scheduler-interval-minutes 5]\n" +
             "Cloud providers (gcp | gcp-firebase | aws | azure) run the wizard: cms-provision --provider <name>");
         process.exit(2);
     }
@@ -427,6 +461,18 @@ async function init() {
         console.error("--http-port and --https-port must differ");
         process.exit(2);
     }
+    const schedulerArg = arg("scheduler-interval-minutes");
+    let schedulerIntervalMinutes;
+    try {
+        schedulerIntervalMinutes =
+            schedulerArg === undefined
+                ? undefined
+                : parseSchedulerIntervalMinutes(schedulerArg, "--scheduler-interval-minutes");
+    }
+    catch (e) {
+        console.error(e.message);
+        process.exit(2);
+    }
     const stagingArg = arg("staging-domain");
     const stagingProblem = stagingArg
         ? stagingHostProblem(stagingArg, {
@@ -494,6 +540,7 @@ async function init() {
         tls,
         ports,
         composeProject: composeProjectName(domain),
+        ...(schedulerIntervalMinutes !== undefined ? { schedulerIntervalMinutes } : {}),
     };
     saveConfig(cfg);
     // P15.1 — the shared HMAC secret for /api/internal/* endpoints, read by
@@ -825,7 +872,7 @@ async function upgradeSelfHostedCommand(opts) {
     if (cfg.imageMode === "dev") {
         console.error("This is a DEV MODE install: the admin + gateway run your Caelo checkout, so there are\n" +
             "no images to upgrade. Update the checkout (git pull), then `bun packages/provisioning/src/cli.ts migrate` and\n" +
-            `\`docker compose -f ${COMPOSE_PATH} restart caelo-admin caelo-gateway\`.`);
+            `\`docker compose -f ${COMPOSE_PATH} restart caelo-admin caelo-gateway caelo-mcp-auth-proxy\`.`);
         process.exit(2);
     }
     const { upgradeSelfHosted } = await import("./self-hosted-upgrade.js");
@@ -851,6 +898,7 @@ async function upgradeSelfHostedCommand(opts) {
             runner: bunHostRunner,
             renderCompose: (images) => renderCompose(cfg, images),
             convergeRoles: agentContext(cfg).convergeRoles,
+            applyPreMigrationRoles: agentContext(cfg).applyPreMigrationRoles,
             refreshCaddy: () => refreshCaddyfile(cfg),
             log: {
                 step: (m) => console.log(`\n==> ${m}`),
@@ -1347,13 +1395,26 @@ async function waitForDomainMappingCert(target) {
  * §11.C — interactive wizard. Loaded lazily so the bare-CLI startup
  * cost stays small (clack + kleur are pulled in only when needed).
  * Reads `--provider`, `--domain`, `--owner-email`, `--project-id`, `--region`,
- * `--non-interactive` and the run mode (`--local` / `--install-job`, default:
+ * `--scheduler-interval-minutes` (#1140), `--non-interactive` and the run mode (`--local` / `--install-job`, default:
  * the install job in Cloud Shell, local elsewhere — run-mode.ts) from argv.
  */
 async function wizardCommand() {
     const { runWizard } = await import("./wizard.js");
     const { chooseRunMode } = await import("./run-mode.js");
+    const schedulerArg = arg("scheduler-interval-minutes");
+    let schedulerIntervalMinutes;
+    try {
+        schedulerIntervalMinutes =
+            schedulerArg === undefined
+                ? undefined
+                : parseSchedulerIntervalMinutes(schedulerArg, "--scheduler-interval-minutes");
+    }
+    catch (e) {
+        console.error(e.message);
+        process.exit(2);
+    }
     await runWizard({
+        ...(schedulerIntervalMinutes !== undefined ? { schedulerIntervalMinutes } : {}),
         runMode: chooseRunMode(process.argv, process.env),
         nonInteractive: process.argv.includes("--non-interactive"),
         provider: arg("provider"),