feat: add cloud-api runtime DB image entrypoints

scripts/src/dev-runtime-provisioning.test.mjs

@@ -1,11 +1,17 @@
 import assert from "node:assert/strict";
+import { execFile } from "node:child_process";
+import path from "node:path";
 import test from "node:test";
+import { promisify } from "node:util";
 
 import {
   buildDevRuntimeProvisioningReport,
   parseArgs
 } from "./dev-runtime-provisioning.mjs";
 
+const execFileAsync = promisify(execFile);
+const repoRoot = path.resolve(path.dirname(new URL(import.meta.url).pathname), "../..");
+
 test("source check parses target role/database without leaking DB URL material", async () => {
   const report = await buildDevRuntimeProvisioningReport(parseArgs(["--check"]), {
     env: {
@@ -25,6 +31,31 @@ test("source check parses target role/database without leaking DB URL material",
   assertNoFixtureSecrets(report);
 });
 
+test("cloud-api image provisioning entrypoint exposes non-secret source check", async () => {
+  const { stdout } = await execFileAsync(
+    process.execPath,
+    ["cmd/hwlab-cloud-api/provision.mjs", "--check"],
+    {
+      cwd: repoRoot,
+      env: {
+        ...process.env,
+        HWLAB_CLOUD_DB_URL: fixturePostgresUrl({ password: fixtureSecret("super") }),
+        HWLAB_CLOUD_DB_SSL_MODE: "disable"
+      }
+    }
+  );
+  const report = JSON.parse(stdout);
+
+  assert.equal(report.conclusion.status, "ready");
+  assert.equal(report.actions.liveDbReadAttempted, false);
+  assert.equal(report.actions.liveDbWriteAttempted, false);
+  assert.equal(report.db.targetRoleNamePresent, true);
+  assert.equal(report.db.targetDatabaseNamePresent, true);
+  assert.equal(report.db.targetPasswordPresent, true);
+  assert.equal(report.safety.secretValuesPrinted, false);
+  assertNoFixtureSecrets(report);
+});
+
 test("source check without injected DB URL is ready and performs no live access", async () => {
   const report = await buildDevRuntimeProvisioningReport(parseArgs(["--check"]), {
     env: {},