celerp 1.2.8__tar.gz → 1.3.1__tar.gz

{celerp-1.2.8 → celerp-1.3.1}/CONTRIBUTING.md

@@ -58,9 +58,40 @@ celerp upgrade    # pip install --upgrade celerp + migrate
 | `--force` | off | Overwrite existing config |
 | `--yes` / `-y` | off | Skip the `--force` wipe confirmation (non-interactive) |
 | `--no-start` | off | Set up, then exit WITHOUT launching servers (service-managed/headless) |
+| `--embedded` | off | Force the bundled PostgreSQL even if a server is reachable (cannot combine with `--db-url`) |
+| `--no-embedded` | off | Never fall back to the bundled PostgreSQL; require an external server |
 
 To change ports after init, edit `~/.config/celerp/config.toml` directly.
 
+### External vs embedded PostgreSQL
+
+`celerp init` picks the database automatically, and **an existing server always wins**:
+
+1. `--db-url` given → that external server (no detection).
+2. else a PostgreSQL server reachable on `localhost:5432` → use it (as root, init
+   provisions the role/database via `sudo -u postgres psql`; otherwise it prints the
+   `CREATE USER`/`CREATE DATABASE` to run).
+3. else the **bundled** PostgreSQL 17 — a self-contained cluster under
+   `~/.config/celerp/pgdata`, started from binaries shipped in the
+   [`celerp-postgres`](https://github.com/celerp/celerp-postgres) wheel. No `sudo`, no
+   system service. Available on Linux x86_64/arm64 (glibc and musl/Alpine) and Windows
+   x64, any CPython; on macOS 26+ opt in with `pip install celerp-postgres`. Elsewhere
+   init asks you to install PostgreSQL.
+
+Override the detection with `--embedded` / `--no-embedded`. The chosen mode is written to
+`config.toml` as `[database] embedded = true|<absent>` and preserved across `--force`
+re-inits, so an external install never silently switches to the bundled cluster.
+
+**Moving bundled data to an external server** (e.g. outgrowing single-machine): dump from
+the bundled cluster and restore into the target, using the bundled tools so versions match.
+
+```bash
+BIN=$(celerp status >/dev/null; python -c "from celerp import embedded_pg; print(embedded_pg.bin_dir())")
+"$BIN/pg_dump" "$(python -c "from celerp import embedded_pg,pathlib; from celerp.config import config_path; print(embedded_pg.ensure_cluster(config_path().parent).replace('+asyncpg',''))")" \
+  | psql "postgresql://celerp:celerp@newhost:5432/celerp"
+celerp init --force --db-url "postgresql+asyncpg://celerp:celerp@newhost:5432/celerp"
+```
+
 ### Run as a service (systemd)
 
 `celerp init` launches the servers and blocks (good for the one-command desktop
@@ -68,16 +99,23 @@ flow). For a headless box where a process manager owns the lifecycle, set up wit
 `--no-start` and let systemd run `celerp start`:
 
 ```bash
-# First boot: provision DB + migrations + config, then exit (do not block).
+# First boot against a system PostgreSQL: provision DB + migrations + config, then
+# exit (do not block). Run as root so init can create the role/database.
 sudo celerp init --no-start \
   --db-url "postgresql+asyncpg://celerp:<password>@localhost:5432/celerp" \
   --api-port 8000 --ui-port 8080
 ```
 
+Prefer the bundled database? Drop `--db-url` (and the `sudo` — the bundled cluster needs
+neither) and run `celerp init --no-start` as the service user. The cluster then lives under
+that user's `~/.config/celerp/pgdata`, and the systemd unit needs no `postgresql.service`
+dependency.
+
 ```ini
 # /etc/systemd/system/celerp.service
 [Unit]
 Description=Celerp
+# Drop the postgresql.service dependency line when using the bundled database.
 After=network.target postgresql.service
 
 [Service]

{celerp-1.2.8 → celerp-1.3.1}/NOTICE

@@ -24,4 +24,14 @@ see legal/TRADEMARK.md.
 Third-party components included in packaged desktop builds are governed by their
 own license files; see licenses/.
 
+Bundled PostgreSQL (pip distribution): on supported platforms the pip package
+declares a dependency on `celerp-postgres` (MIT), whose wheels embed PostgreSQL
+server binaries and client tools so `celerp init` can run a self-contained
+database with no separate install. PostgreSQL is distributed under the PostgreSQL
+License (a permissive OSI-approved license); its full text and copyright notice
+ship inside the celerp-postgres wheels, which repackage binaries built by the
+theseus-rs/postgresql-binaries project. These binaries are used unmodified and
+only when no external PostgreSQL server is configured. See
+https://github.com/celerp/celerp-postgres.
+
 For commercial, OEM, or white-label inquiries: https://celerp.com

{celerp-1.2.8 → celerp-1.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 1.2.8
+Version: 1.3.1
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         
@@ -154,6 +154,7 @@ Requires-Dist: Pillow>=10.0
 Requires-Dist: pypdf>=4.0
 Requires-Dist: psycopg2-binary>=2.9
 Requires-Dist: tzdata>=2024.1
+Requires-Dist: celerp-postgres<18,>=17.10; (sys_platform == "linux" and (platform_machine == "x86_64" or platform_machine == "aarch64")) or (sys_platform == "win32" and platform_machine == "AMD64")
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
@@ -220,6 +221,10 @@ celerp init        # sets up the database and launches Celerp
 Open **http://localhost:8080**. Done.
 Your office can securely access the system at your IP address :8080.
 
+No PostgreSQL to install: `celerp init` uses your existing PostgreSQL server if one is
+running, and otherwise starts a self-contained bundled database — no `sudo`, no system
+service. Point it at a specific server with `celerp init --db-url postgresql+asyncpg://…`.
+
 Running headless or under a process manager? Use `celerp init --no-start` to set up
 without launching, then have your service run `celerp start` — see
 [Run as a service (systemd)](CONTRIBUTING.md#run-as-a-service-systemd).
@@ -288,9 +293,13 @@ git clone git@github.com:celerp/celerp.git
 cd celerp
 python3 -m venv .venv && source .venv/bin/activate
 pip install -e ".[dev]"
-sudo celerp init   # creates DB, runs migrations, starts servers
+celerp init   # creates DB, runs migrations, starts servers
 ```
 
+`celerp init` boots a bundled PostgreSQL when no server is running, so no `sudo` and no
+system Postgres are required. To develop against your own server instead, pass
+`--db-url postgresql+asyncpg://…`.
+
 Open **http://localhost:8080**. Run tests with `pytest tests/`.
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for environment variables, troubleshooting, and coding guidelines.

{celerp-1.2.8 → celerp-1.3.1}/README.md

@@ -49,6 +49,10 @@ celerp init        # sets up the database and launches Celerp
 Open **http://localhost:8080**. Done.
 Your office can securely access the system at your IP address :8080.
 
+No PostgreSQL to install: `celerp init` uses your existing PostgreSQL server if one is
+running, and otherwise starts a self-contained bundled database — no `sudo`, no system
+service. Point it at a specific server with `celerp init --db-url postgresql+asyncpg://…`.
+
 Running headless or under a process manager? Use `celerp init --no-start` to set up
 without launching, then have your service run `celerp start` — see
 [Run as a service (systemd)](CONTRIBUTING.md#run-as-a-service-systemd).
@@ -117,9 +121,13 @@ git clone git@github.com:celerp/celerp.git
 cd celerp
 python3 -m venv .venv && source .venv/bin/activate
 pip install -e ".[dev]"
-sudo celerp init   # creates DB, runs migrations, starts servers
+celerp init   # creates DB, runs migrations, starts servers
 ```
 
+`celerp init` boots a bundled PostgreSQL when no server is running, so no `sudo` and no
+system Postgres are required. To develop against your own server instead, pass
+`--db-url postgresql+asyncpg://…`.
+
 Open **http://localhost:8080**. Run tests with `pytest tests/`.
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for environment variables, troubleshooting, and coding guidelines.

{celerp-1.2.8 → celerp-1.3.1}/celerp/ai/tools.py

@@ -22,6 +22,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from celerp.models.projections import Projection
+from celerp.services.reorder import is_below_reorder
 
 
 @dataclass
@@ -61,7 +62,7 @@ async def _dashboard_kpis(session: AsyncSession, company_id: uuid.UUID, **_) ->
     return {
         "total_items": len(items),
         "inventory_value": round(sum(float(i.state.get("total_cost", 0) or 0) for i in items), 2),
-        "low_stock_items": sum(1 for i in items if float(i.state.get("quantity", 0) or 0) <= 0),
+        "low_stock_items": sum(1 for i in items if is_below_reorder(i.state)),
         "ar_outstanding": round(
             sum(
                 float(d.state.get("amount_outstanding", 0) or 0)
@@ -75,12 +76,12 @@ async def _dashboard_kpis(session: AsyncSession, company_id: uuid.UUID, **_) ->
 async def _low_stock_items(
     session: AsyncSession, company_id: uuid.UUID, limit: int = 20, **_,
 ) -> dict:
-    """List items with zero or negative quantity."""
+    """List items at or below their reorder point."""
     items = await _projections(session, company_id, "item")
     low = sorted(
         [
             {"sku": r.state.get("sku"), "name": r.state.get("name"), "quantity": r.state.get("quantity", 0)}
-            for r in items if float(r.state.get("quantity", 0) or 0) <= 0
+            for r in items if is_below_reorder(r.state)
         ],
         key=lambda x: float(x["quantity"] or 0),
     )
@@ -263,7 +264,7 @@ TOOLS: dict[str, ToolDef] = {
     t.name: t
     for t in [
         ToolDef("dashboard_kpis", "Return high-level KPIs: inventory value, AR outstanding, low stock count, active deals.", [], _dashboard_kpis),
-        ToolDef("low_stock_items", "List items with zero or negative quantity. Param: limit (default 20).", ["limit"], _low_stock_items),
+        ToolDef("low_stock_items", "List items at or below their reorder point (defaults to zero/negative quantity for items without a reorder point set). Param: limit (default 20).", ["limit"], _low_stock_items),
         ToolDef("outstanding_invoices", "List unpaid invoices. Param: limit (default 20).", ["limit"], _outstanding_invoices),
         ToolDef("top_items_by_value", "List items ranked by total inventory value. Param: limit (default 10).", ["limit"], _top_items_by_value),
         ToolDef("active_deals_summary", "Summarise the CRM pipeline - open deals by stage with count and total value.", [], _active_deals_summary),

{celerp-1.2.8 → celerp-1.3.1}/celerp/cli.py

@@ -273,6 +273,176 @@ def _test_db(db_url: str) -> str | None:
         return str(e)
 
 
+# ── Database mode resolution (external vs embedded) ────────────────────────────
+#
+# `celerp init` supports two ways to reach Postgres:
+#   external — a PostgreSQL server the user (or the droplet/apt) already runs.
+#   embedded — a self-contained cluster we boot from bundled binaries when the
+#              user has no server. See celerp.embedded_pg.
+# The rule is "an existing server always wins": embedded is only a fallback so
+# a machine with a real Postgres never ends up with two postmasters.
+
+
+def _is_root() -> bool:
+    """True only where we can `sudo -u postgres` to provision (POSIX, uid 0).
+
+    Guarded with hasattr because os.getuid() does not exist on Windows — the old
+    unguarded call raised AttributeError instead of showing guidance there.
+    """
+    return hasattr(os, "getuid") and os.getuid() == 0
+
+
+def _classify_probe(err: str | None) -> str:
+    """Map a connection attempt's outcome to server reachability.
+
+    Returns:
+      "ok"              — connected; server up and the target DB exists.
+      "needs_provision" — server is up but the role/database is missing or auth
+                          failed; external provisioning (root) can fix it.
+      "unreachable"     — nothing is listening (connection refused / timeout).
+
+    "needs_provision" still means a server EXISTS, so init stays in external
+    mode rather than booting an embedded cluster beside it.
+    """
+    if err is None:
+        return "ok"
+    low = err.lower()
+    # Server answered, but the role/db isn't set up yet, or auth was rejected.
+    if (
+        "does not exist" in low
+        or "authentication failed" in low
+        or "no password supplied" in low
+        or "role" in low and "does not exist" in low
+    ):
+        return "needs_provision"
+    # Nothing accepted the connection.
+    return "unreachable"
+
+
+def _resolve_db_mode(
+    *,
+    db_url: str | None,
+    server_reachable: bool | None,
+    provider_available: bool,
+    want_embedded: bool,
+    no_embedded: bool,
+    existing_embedded: bool | None = None,
+) -> tuple[str, str | None]:
+    """Pure decision function for `celerp init`'s database mode.
+
+    Returns (mode, error_kind) where mode is "external" | "embedded" | "error".
+    Kept side-effect-free so the whole branch table can be unit-tested without a
+    database.
+
+    Args:
+      db_url: explicit --db-url; taken at face value (external), never probed.
+      server_reachable: result of probing the default host; None when not probed.
+      provider_available: whether the embedded backend can run here.
+      want_embedded/no_embedded: the --embedded / --no-embedded overrides.
+      existing_embedded: the mode of an already-initialized instance (True/False),
+        or None for a fresh install. On `--force` this PRESERVES the instance's
+        mode so re-initializing an external install (e.g. a droplet) never flips
+        to embedded just because its server was momentarily unreachable.
+
+    Precedence: conflicting-flags → db_url → --embedded → --no-embedded →
+    existing config's mode → probe.
+    """
+    if want_embedded and no_embedded:
+        return ("error", "conflicting_flags")
+    if db_url and want_embedded:
+        # An explicit external URL and "force embedded" are contradictory.
+        return ("error", "db_url_with_embedded")
+    if db_url:
+        return ("external", None)
+    if want_embedded:
+        return ("embedded", None) if provider_available else ("error", "no_provider")
+    if no_embedded:
+        # User requires external. Reachable → use it; otherwise fail with external
+        # guidance rather than silently starting a cluster.
+        return ("external", None) if server_reachable else ("error", "no_server_external_only")
+    if existing_embedded is True:
+        return ("embedded", None) if provider_available else ("error", "no_provider")
+    if existing_embedded is False:
+        return ("external", None)
+    # Fresh install, no overrides: an existing server always wins.
+    if server_reachable:
+        return ("external", None)
+    if provider_available:
+        return ("embedded", None)
+    return ("error", "no_server_no_provider")
+
+
+def _emit_db_error(kind: str, db_url: str) -> None:
+    """Print actionable guidance for a resolve/connect failure (stderr)."""
+    if kind == "conflicting_flags":
+        click.echo("  ✗ --embedded and --no-embedded are mutually exclusive.", err=True)
+        return
+    if kind == "db_url_with_embedded":
+        click.echo(
+            "  ✗ --embedded cannot be combined with --db-url (which selects an "
+            "external server).",
+            err=True,
+        )
+        return
+    if kind == "no_provider":
+        click.echo(
+            f"  ✗ Embedded PostgreSQL is not available on this platform ({sys.platform}).",
+            err=True,
+        )
+        click.echo(
+            "\nInstall PostgreSQL and re-run, or use a supported platform "
+            "(Linux x86_64/arm64 — glibc or musl — or Windows x64).",
+            err=True,
+        )
+        if sys.platform == "darwin":
+            click.echo(
+                "On macOS 26 or newer: pip install celerp-postgres — then re-run "
+                "`celerp init` for the bundled database.",
+                err=True,
+            )
+        return
+    # no_server_external_only / no_server_no_provider: nothing was listening.
+    click.echo(f"  ✗ No PostgreSQL server found at {db_url}.", err=True)
+    if kind == "no_server_external_only":
+        click.echo(
+            "\n--no-embedded was set, so no cluster was started. Install and start "
+            "PostgreSQL, then re-run `celerp init`.",
+            err=True,
+        )
+        return
+    # no_server_no_provider — embedded unavailable AND no server.
+    click.echo(
+        "\nInstall PostgreSQL and start it, then re-run `celerp init` — or use a "
+        "supported platform (Linux x86_64/arm64 — glibc or musl — or Windows x64) "
+        "to get the bundled database automatically.",
+        err=True,
+    )
+    if sys.platform.startswith("linux"):
+        click.echo("  e.g.  sudo apt install postgresql && sudo service postgresql start", err=True)
+
+
+def ensure_database(cfg: dict) -> None:
+    """Boot the embedded cluster for a DB-touching command, if this install uses
+    one, and refresh the connection URI in `cfg` in place.
+
+    No-op for external mode (never imports the embedded provider, so external
+    installs — including every droplet — are unaffected). Idempotent: safe to
+    call from every command that reads cfg["database"]["url"].
+    """
+    db = cfg.get("database", {})
+    if not db.get("embedded"):
+        return
+    from celerp import embedded_pg
+
+    config_dir = _config_path().parent
+    # Re-derive the URI on every boot rather than trusting the stored one: the
+    # unix-socket path lives under a runtime dir that a reboot can relocate.
+    db["url"] = embedded_pg.ensure_cluster(config_dir)
+    bd = embedded_pg.bin_dir()
+    if bd:
+        cfg.setdefault("backup", {}).setdefault("pg_bin_dir", bd)
+
+
 def _run_upgrade_with_auto_stamp(alembic_cfg, engine_url: str) -> None:
     """Run alembic upgrade head, auto-stamping past any already-applied revisions.
 
@@ -464,6 +634,103 @@ def _reconcile_after_migrate(db_url: str) -> None:
         engine.dispose()
 
 
+def _wipe_attachment_dirs(purge_dirs: list) -> None:
+    """Remove attached-file directories on --force so a re-init is truly fresh."""
+    import shutil
+    for _d in purge_dirs:
+        if _d.exists():
+            shutil.rmtree(_d, ignore_errors=True)
+            click.echo(f"  ✓ Removed {_d.resolve()}")
+
+
+def _init_embedded(cfg: dict, config_dir: "Path", *, force: bool, purge_dirs: list) -> None:
+    """Provision the bundled PostgreSQL cluster and point cfg at it.
+
+    No sudo, no ownership/grant dance: the app connects as the cluster superuser
+    over a unix socket, so it owns every object it creates.
+    """
+    from celerp import embedded_pg
+
+    if force:
+        click.echo("Wiping embedded database for fresh init...")
+        embedded_pg.wipe(config_dir)
+        _wipe_attachment_dirs(purge_dirs)
+        click.echo("  ✓ Database ready (fresh)")
+
+    click.echo("Starting embedded PostgreSQL...")
+    uri = embedded_pg.ensure_cluster(config_dir)
+    cfg["database"]["url"] = uri
+    cfg["database"]["embedded"] = True
+    bd = embedded_pg.bin_dir()
+    if bd:
+        cfg.setdefault("backup", {})["pg_bin_dir"] = bd
+    click.echo(f"  ✓ Using embedded PostgreSQL at {embedded_pg.pgdata_dir(config_dir)}")
+
+
+def _init_external(cfg: dict, *, force: bool, db_url: str | None, purge_dirs: list) -> None:
+    """Connect to (and, as root, provision) an external PostgreSQL server.
+
+    This is the pre-existing path, preserved verbatim for the droplet/self-hosted
+    contract: explicit --db-url, root auto-provisioning via `sudo -u postgres`,
+    and the same connect-or-guidance flow for non-root.
+    """
+    if force:
+        click.echo("Wiping database for fresh init...")
+        db_url_for_wipe = db_url or _DEFAULT_DB_URL
+        try:
+            _provision_db(db_url_for_wipe, drop_existing=True)
+        except RuntimeError as e:
+            click.echo(f"  ✗ DB wipe failed: {e}", err=True)
+            click.echo("\nEnsure PostgreSQL is running and you have sudo access.", err=True)
+            sys.exit(1)
+        click.echo("  ✓ Database ready (fresh)")
+        _wipe_attachment_dirs(purge_dirs)
+        return
+
+    click.echo("Connecting to database...")
+    err = _test_db(cfg["database"]["url"])
+    if not err:
+        click.echo("  ✓ Database connection OK")
+        return
+    if _is_root():
+        click.echo("  · Could not connect — attempting to provision database...")
+        try:
+            _provision_db(cfg["database"]["url"])
+        except RuntimeError as e:
+            click.echo(f"  ✗ Provisioning failed: {e}", err=True)
+            click.echo("\nEnsure PostgreSQL is installed and running, then retry with sudo.", err=True)
+            sys.exit(1)
+        err = _test_db(cfg["database"]["url"])
+        if err:
+            click.echo(f"  ✗ Still could not connect after provisioning: {err}", err=True)
+            sys.exit(1)
+        click.echo("  ✓ Database connection OK")
+        return
+    # Non-root and the server rejected us. On POSIX, sudo can provision; on
+    # Windows there is no `sudo -u postgres`, so only suggest it where it works.
+    click.echo(f"  ✗ Could not connect: {err}", err=True)
+    import shutil
+    real_bin = shutil.which("celerp") or "celerp"
+    if hasattr(os, "getuid"):
+        click.echo(
+            f"\nRe-run with sudo to have Celerp create the database automatically:\n"
+            f"  sudo {real_bin} init\n"
+            "\nOr create it manually:\n"
+            "  sudo -u postgres psql -c \"CREATE USER celerp WITH PASSWORD 'celerp';\"\n"
+            "  sudo -u postgres psql -c \"CREATE DATABASE celerp OWNER celerp;\"",
+            err=True,
+        )
+    else:
+        click.echo(
+            "\nCreate the database and role on your PostgreSQL server, then re-run "
+            "`celerp init --db-url ...`:\n"
+            "  CREATE USER celerp WITH PASSWORD 'celerp';\n"
+            "  CREATE DATABASE celerp OWNER celerp;",
+            err=True,
+        )
+    sys.exit(1)
+
+
 # ── Commands ──────────────────────────────────────────────────────────────────
 
 @click.group()
@@ -484,8 +751,23 @@ def main() -> None:
          "WITHOUT launching the servers. For service-managed/headless installs "
          "where a process manager (e.g. systemd) runs `celerp start`.",
 )
-def init(db_url, api_port, ui_port, cloud_token, force, assume_yes, no_start):
-    """Initialize Celerp: write config and run database migrations."""
+@click.option(
+    "--embedded", "want_embedded", is_flag=True,
+    help="Force the bundled PostgreSQL even if a server is reachable. "
+         "Cannot be combined with --db-url.",
+)
+@click.option(
+    "--no-embedded", "no_embedded", is_flag=True,
+    help="Never fall back to the bundled PostgreSQL; require an external server.",
+)
+def init(db_url, api_port, ui_port, cloud_token, force, assume_yes, no_start, want_embedded, no_embedded):
+    """Initialize Celerp: write config and run database migrations.
+
+    With no --db-url, init uses an existing PostgreSQL server if one is running,
+    and otherwise boots a self-contained bundled cluster (no sudo, no system
+    service). An existing server always wins; pass --embedded / --no-embedded to
+    override the auto-detection.
+    """
     config_path = _config_path()
 
     if config_path.exists() and not force:
@@ -493,16 +775,49 @@ def init(db_url, api_port, ui_port, cloud_token, force, assume_yes, no_start):
         click.echo("Run `celerp migrate` to apply updates, or `celerp init --force` to reconfigure.")
         return
 
+    from celerp import embedded_pg
+
+    # ── Resolve external vs embedded ──────────────────────────────────────────
+    # On --force, config_path exists: preserve the initialized instance's mode so
+    # re-init never flips an external install (e.g. a droplet) to embedded.
+    existing_cfg = _read_config() if config_path.exists() else {}
+    existing_embedded = (
+        bool(existing_cfg.get("database", {}).get("embedded")) if existing_cfg else None
+    )
+    provider_available = embedded_pg.is_available()
+    # Probe the default host only when nothing else determines the mode — an
+    # explicit --db-url/--embedded, or a known existing mode, needs no probe.
+    server_reachable: bool | None = None
+    need_probe = not db_url and not want_embedded and (no_embedded or existing_embedded is None)
+    if need_probe:
+        server_reachable = _classify_probe(_test_db(_DEFAULT_DB_URL)) in ("ok", "needs_provision")
+    mode, error_kind = _resolve_db_mode(
+        db_url=db_url,
+        server_reachable=server_reachable,
+        provider_available=provider_available,
+        want_embedded=want_embedded,
+        no_embedded=no_embedded,
+        existing_embedded=existing_embedded,
+    )
+    if mode == "error":
+        _emit_db_error(error_kind, db_url or _DEFAULT_DB_URL)
+        sys.exit(1)
+
+    config_dir = config_path.parent
+
     if force:
-        # --force is destructive: it drops the database AND removes attached files.
-        # init can run under sudo, so warn (with full paths) and confirm before wiping.
+        # --force is destructive: it wipes the database AND attached files.
+        # init can run under sudo, so warn (with full paths) and confirm first.
         from celerp.config import settings
         _purge_dirs = [
             settings.data_dir / "static" / "attachments",
             settings.data_dir / "ai_uploads",
         ]
         click.echo("⚠  `init --force` permanently WIPES this instance:")
-        click.echo(f"     - database: {db_url or _DEFAULT_DB_URL}")
+        if mode == "embedded":
+            click.echo(f"     - database: embedded cluster at {embedded_pg.pgdata_dir(config_dir)}")
+        else:
+            click.echo(f"     - database: {db_url or _DEFAULT_DB_URL}")
         for _d in _purge_dirs:
             click.echo(f"     - files:    {_d.resolve()}")
         click.echo("   Make sure you have a backup.")
@@ -523,62 +838,10 @@ def init(db_url, api_port, ui_port, cloud_token, force, assume_yes, no_start):
         "modules": {"enabled": enabled_modules},
     }
 
-    # --force: drop + recreate the database so the setup wizard appears fresh
-    if force:
-        click.echo("Wiping database for fresh init...")
-        db_url_for_wipe = db_url or _DEFAULT_DB_URL
-        try:
-            _provision_db(db_url_for_wipe, drop_existing=True)
-        except RuntimeError as e:
-            click.echo(f"  ✗ DB wipe failed: {e}", err=True)
-            click.echo(
-                "\nEnsure PostgreSQL is running and you have sudo access.",
-                err=True,
-            )
-            sys.exit(1)
-        click.echo("  ✓ Database ready (fresh)")
-        # Wipe attached files too, so a forced re-init is a truly fresh instance and no
-        # orphaned files remain. Recreated automatically on next boot.
-        import shutil
-        for _d in _purge_dirs:
-            if _d.exists():
-                shutil.rmtree(_d, ignore_errors=True)
-                click.echo(f"  ✓ Removed {_d.resolve()}")
+    if mode == "embedded":
+        _init_embedded(cfg, config_dir, force=force, purge_dirs=_purge_dirs if force else [])
     else:
-        # Test DB connection — auto-provision if running as root
-        click.echo("Connecting to database...")
-        err = _test_db(cfg["database"]["url"])
-        if err:
-            if os.getuid() == 0:
-                click.echo("  · Could not connect — attempting to provision database...")
-                try:
-                    _provision_db(cfg["database"]["url"])
-                except RuntimeError as e:
-                    click.echo(f"  ✗ Provisioning failed: {e}", err=True)
-                    click.echo(
-                        "\nEnsure PostgreSQL is installed and running, then retry with sudo.",
-                        err=True,
-                    )
-                    sys.exit(1)
-                # Verify connection now works
-                err = _test_db(cfg["database"]["url"])
-                if err:
-                    click.echo(f"  ✗ Still could not connect after provisioning: {err}", err=True)
-                    sys.exit(1)
-            else:
-                click.echo(f"  ✗ Could not connect: {err}", err=True)
-                import shutil
-                real_bin = shutil.which("celerp") or "celerp"
-                click.echo(
-                    f"\nRe-run with sudo to have Celerp create the database automatically:\n"
-                    f"  sudo {real_bin} init\n"
-                    "\nOr create it manually:\n"
-                    "  sudo -u postgres psql -c \"CREATE USER celerp WITH PASSWORD 'celerp';\"\n"
-                    "  sudo -u postgres psql -c \"CREATE DATABASE celerp OWNER celerp;\"",
-                    err=True,
-                )
-                sys.exit(1)
-        click.echo("  ✓ Database connection OK")
+        _init_external(cfg, force=force, db_url=db_url, purge_dirs=_purge_dirs if force else [])
 
     # Fix table ownership before migrations (covers tables created by postgres superuser)
     db_url_val = cfg["database"]["url"]
@@ -720,6 +983,7 @@ def reset_password(email: str, password: str) -> None:
     if not cfg:
         click.echo("Not initialized. Run `celerp init` first.", err=True)
         sys.exit(1)
+    ensure_database(cfg)
     db_url = cfg["database"]["url"]
     sync_url = db_url.replace("postgresql+asyncpg://", "postgresql://")
     try:
@@ -748,6 +1012,7 @@ def start():
     if not cfg:
         click.echo("Not initialized. Run `celerp init` first.", err=True)
         sys.exit(1)
+    ensure_database(cfg)
     _start(cfg)
 
 
@@ -761,6 +1026,7 @@ def migrate(db_url):
         if not cfg:
             click.echo("Not initialized. Run `celerp init` first.", err=True)
             sys.exit(1)
+        ensure_database(cfg)
         url = cfg["database"]["url"]
     click.echo("Running migrations...")
     _run_migrations(url)
@@ -780,11 +1046,14 @@ def status():
         click.echo("Run `celerp init` to initialize.")
         return
 
+    is_embedded = cfg.get("database", {}).get("embedded")
+    ensure_database(cfg)
     db_url = cfg["database"]["url"]
     # Mask password in display
     import re
     display_url = re.sub(r"://([^:]+):([^@]+)@", r"://\1:***@", db_url)
-    click.echo(f"Database: {display_url}")
+    prefix = "embedded (bundled PostgreSQL) — " if is_embedded else ""
+    click.echo(f"Database: {prefix}{display_url}")
 
     err = _test_db(db_url)
     click.echo(f"  DB connection: {'✓ OK' if not err else f'✗ {err}'}")
@@ -831,6 +1100,7 @@ def demo():
     if not cfg:
         click.echo("Not initialized. Run `celerp init` first.", err=True)
         sys.exit(1)
+    ensure_database(cfg)
     env = _config_to_env(cfg)
     pkg_root = Path(__file__).parent.parent
     script = pkg_root / "scripts" / "seed_demo.py"
@@ -853,6 +1123,7 @@ def upgrade():
     if not cfg:
         click.echo("Not initialized. Run `celerp init` first.", err=True)
         sys.exit(1)
+    ensure_database(cfg)
     _run_migrations(cfg["database"]["url"])
     click.echo("✓ Upgrade complete")