@caelo-cms/provisioning 0.10.47 → 0.10.48

package/dist/compose.js

@@ -54,6 +54,8 @@ export function ghcrImageDigest(service, ref) {
     const digest = ref.slice(prefix.length);
     return isImageDigest(digest) ? digest : null;
 }
+/** The only interface the agent's Postgres port is published on. */
+export const AGENT_DB_BIND_ADDRESS = "127.0.0.1";
 export function generateDockerCompose(spec) {
     const adminMemory = spec.adminMemory ?? ADMIN_MEMORY_DEFAULT;
     const adminMemoryMiB = memoryQuantityMiB(adminMemory);
@@ -61,6 +63,9 @@ export function generateDockerCompose(spec) {
         throw new Error(`adminMemory "${adminMemory}" is not a memory quantity (e.g. 2Gi)`);
     }
     const env = (k, v) => v ? `      ${k}: "${escapeYaml(v)}"` : "";
+    if (spec.agent && !isAgentDbPort(spec.agent.dbPort)) {
+        throw new Error(`agent dbPort ${spec.agent.dbPort} is not a TCP port between 1024 and 65535`);
+    }
     return `# SPDX-License-Identifier: MPL-2.0
 # Generated by cms-provision — do not edit; re-run \`bunx cms-provision up\`.
 # Domain: ${spec.domain}
@@ -77,7 +82,7 @@ services:
       ADMIN_ROLE_PASSWORD: "${escapeYaml(spec.rolePasswords.admin)}"
       PUBLIC_ROLE_PASSWORD: "${escapeYaml(spec.rolePasswords.public)}"
       GATEWAY_ROLE_PASSWORD: "${escapeYaml(spec.rolePasswords.gateway)}"
-    volumes:
+${postgresAgent(spec.agent)}    volumes:
       - caelo-pg:/var/lib/postgresql/data
       - ./bootstrap.sh:/docker-entrypoint-initdb.d/00_bootstrap.sh:ro
     healthcheck:
@@ -129,6 +134,25 @@ volumes:
   caelo-caddy-config:
 `;
 }
+/** Whether `port` may carry the agent's Postgres (unprivileged TCP port). */
+export function isAgentDbPort(port) {
+    return Number.isInteger(port) && port >= 1024 && port <= 65535;
+}
+/**
+ * The agent's lines in the postgres service: its role password for
+ * bootstrap.sh, and the port on the host's loopback interface only — the
+ * agent runs on the host, and nothing else may reach the database.
+ */
+function postgresAgent(agent) {
+    if (!agent)
+        return "";
+    return [
+        `      AGENT_ROLE_PASSWORD: "${escapeYaml(agent.dbPassword)}"`,
+        "    # The host update agent (cms-provision agent): loopback only.",
+        `    ports: ["${AGENT_DB_BIND_ADDRESS}:${agent.dbPort}:5432"]`,
+        "",
+    ].join("\n");
+}
 /**
  * How a Caelo service's container starts: its image and, in dev mode, the
  * checkout. `mounts` are extra bind mounts the service needs in both modes.
@@ -182,6 +206,7 @@ ${serviceRuntime(spec.images, "admin", `sh -c "cd apps/admin && bunx svelte-kit
       PORT: "${COMPOSE_ADMIN_PORT}"
       CAELO_OUTPUT_ROOT: "${SITE_OUTPUT_ROOT}"
       MEDIA_ROOT_DIR: "${MEDIA_ROOT}"
+      CAELO_PROVIDER: "self-hosted"
       NODE_ENV: production
 ${env("ANTHROPIC_API_KEY", spec.anthropicApiKey)}
 ${env("RESEND_API_KEY", spec.resendApiKey)}`;

package/dist/compose.js.map

@@ -1 +1 @@
-{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,aAAa,EAAuB,MAAM,6BAA6B,CAAC;AAoBjG,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,wFAAwF;AACxF,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;AAExC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,MAAc;IAClE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,GAAW;IAClE,MAAM,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAyCD,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAqB,EAAU,EAAE,CACvD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,OAAO;;YAEG,IAAI,CAAC,MAAM;;;;;;;;4BAQK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;8BAG/B,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;+BACnC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gCACpC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;0BAyB5C,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;8BAC1B,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;mBAa7C,gBAAgB;;EAEjC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC;;EAEvC,cAAc,CAAC,IAAI,CAAC;;;;;;;;CAQrB,CAAC;AACF,CAAC;AAID;;;GAGG;AACH,SAAS,cAAc,CACrB,MAAqB,EACrB,OAAuB,EACvB,UAAkB,EAClB,SAA4B,EAAE;IAE9B,MAAM,OAAO,GAAG,CAAC,IAAuB,EAAE,EAAE,CAC1C,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,yEAAyE;YACzE,4EAA4E;YAC5E,2BAA2B;YAC3B,uBAAuB;YACvB,gBAAgB,UAAU,EAAE;YAC5B,GAAG,OAAO,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,CAAC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,cAAc,CAAC,OAAO,CAAC,kBAAkB,CACxG,CAAC;IACJ,CAAC;IACD,gEAAgE;IAChE,OAAO,CAAC,cAAc,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB,EAAE,cAAsB,EAAE,GAAY;IAC3E,OAAO;EACP,cAAc,CACd,IAAI,CAAC,MAAM,EACX,OAAO,EACP,4FAA4F,kBAAkB,GAAG;IACjH,gEAAgE;IAChE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,sDAAsD;IACtD,oEAAoE;IACpE;QACE,KAAK,aAAa,cAAc;QAChC,YAAY,gBAAgB,EAAE;QAC9B,KAAK,SAAS,IAAI,UAAU,EAAE;KAC/B,CACF;;;;;uBAKsB,cAAc;;6BAER,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;oCACnD,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC;2BACpE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;yBACjC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;eAChD,kBAAkB;4BACL,gBAAgB;yBACnB,UAAU;;EAEjC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC;EAC9C,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,OAAO;EACP,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,wCAAwC,CAAC;;;;;;;+BAOnD,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC;8BAC/D,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;uBACpE,oBAAoB;2BAChB,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,IAAY,EAAE,QAAgB,EAAE,QAAgB;IAC7D,OAAO,UAAU,CAAC,cAAc,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../src/compose.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,aAAa,EAAuB,MAAM,6BAA6B,CAAC;AAoBjG,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,WAAW,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,wFAAwF;AACxF,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC;AACjC,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CAAC;AAExC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,MAAc;IAClE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,GAAW;IAClE,MAAM,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAsDD,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC7D,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAqB,EAAU,EAAE,CACvD,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,MAAM,2CAA2C,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;;YAEG,IAAI,CAAC,MAAM;;;;;;;;4BAQK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;;;8BAG/B,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;+BACnC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;gCACpC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;EACpE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;0BAwBD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;8BAC1B,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;mBAa7C,gBAAgB;;EAEjC,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC;;EAEvC,cAAc,CAAC,IAAI,CAAC;;;;;;;;CAQrB,CAAC;AACF,CAAC;AAID,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAA+B;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO;QACL,+BAA+B,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG;QAC9D,mEAAmE;QACnE,gBAAgB,qBAAqB,IAAI,KAAK,CAAC,MAAM,SAAS;QAC9D,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,MAAqB,EACrB,OAAuB,EACvB,UAAkB,EAClB,SAA4B,EAAE;IAE9B,MAAM,OAAO,GAAG,CAAC,IAAuB,EAAE,EAAE,CAC1C,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO;YACL,yEAAyE;YACzE,4EAA4E;YAC5E,2BAA2B;YAC3B,uBAAuB;YACvB,gBAAgB,UAAU,EAAE;YAC5B,GAAG,OAAO,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,CAAC;SACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,cAAc,CAAC,OAAO,CAAC,kBAAkB,CACxG,CAAC;IACJ,CAAC;IACD,gEAAgE;IAChE,OAAO,CAAC,cAAc,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB,EAAE,cAAsB,EAAE,GAAY;IAC3E,OAAO;EACP,cAAc,CACd,IAAI,CAAC,MAAM,EACX,OAAO,EACP,4FAA4F,kBAAkB,GAAG;IACjH,gEAAgE;IAChE,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,sDAAsD;IACtD,oEAAoE;IACpE;QACE,KAAK,aAAa,cAAc;QAChC,YAAY,gBAAgB,EAAE;QAC9B,KAAK,SAAS,IAAI,UAAU,EAAE;KAC/B,CACF;;;;;uBAKsB,cAAc;;6BAER,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;oCACnD,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC;2BACpE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;yBACjC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;eAChD,kBAAkB;4BACL,gBAAgB;yBACnB,UAAU;;;EAGjC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,eAAe,CAAC;EAC9C,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACvC,OAAO;EACP,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,wCAAwC,CAAC;;;;;;;+BAOnD,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC;8BAC/D,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,CAAC;uBACpE,oBAAoB;2BAChB,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,IAAY,EAAE,QAAgB,EAAE,QAAgB;IAC7D,OAAO,UAAU,CAAC,cAAc,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,sDAAsD;IACtD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}

package/dist/dns/index.d.ts

@@ -8,5 +8,7 @@ export type { DnsAdapter } from "./types.js";
 export declare function pickDnsAdapter(opts: {
     domain: string;
     forceManual?: boolean;
+    /** No prompts: the manual adapter prints the records and polls (the install job). */
+    nonInteractive?: boolean;
 }): Promise<DnsAdapter>;
 //# sourceMappingURL=index.d.ts.map

package/dist/dns/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dns/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dns/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBtB"}

package/dist/dns/index.js

@@ -22,8 +22,9 @@ import { makeManualAdapter } from "./manual.js";
  * reachable, returns its adapter. Otherwise falls back to manual.
  */
 export async function pickDnsAdapter(opts) {
+    const manual = { domain: opts.domain, nonInteractive: opts.nonInteractive ?? false };
     if (opts.forceManual) {
-        return makeManualAdapter({ domain: opts.domain });
+        return makeManualAdapter(manual);
     }
     // Cloudflare — needs CLOUDFLARE_API_TOKEN (read-only zone scope is
     // enough for detection; create needs Zone:DNS:Edit).
@@ -37,6 +38,6 @@ export async function pickDnsAdapter(opts) {
     // Route53 — would need AWS_PROFILE / AWS_ACCESS_KEY_ID. Not yet
     // implemented; falls through to manual. The interface + adapter
     // skeleton land here so the future PR is one file.
-    return makeManualAdapter({ domain: opts.domain });
+    return makeManualAdapter(manual);
 }
 //# sourceMappingURL=index.js.map

package/dist/dns/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dns/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKhD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAGpC;IACC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;IACxC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,qBAAqB,CAAC;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,EAAE,CAAC,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,gEAAgE;IAChE,mDAAmD;IAEnD,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dns/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKhD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAKpC;IACC,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,KAAK,EAAE,CAAC;IACrF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,EAAE,GAAG,MAAM,oBAAoB,EAAE,CAAC;IACxC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,qBAAqB,CAAC;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,EAAE,CAAC,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,gEAAgE;IAChE,mDAAmD;IAEnD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC"}

package/dist/dns/manual.d.ts

@@ -1,5 +1,10 @@
 import type { DnsAdapter } from "./types.js";
+/**
+ * @param opts.nonInteractive print the records and poll without asking for
+ *   confirmation first (the install job has no terminal)
+ */
 export declare function makeManualAdapter(opts: {
     domain: string;
+    nonInteractive?: boolean;
 }): DnsAdapter;
 //# sourceMappingURL=manual.d.ts.map

package/dist/dns/manual.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manual.d.ts","sourceRoot":"","sources":["../../src/dns/manual.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,YAAY,CAAC;AAKxD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAyDtE"}
+{"version":3,"file":"manual.d.ts","sourceRoot":"","sources":["../../src/dns/manual.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,YAAY,CAAC;AAWxD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,UAAU,CAiEhG"}

package/dist/dns/manual.js

@@ -15,7 +15,19 @@ import { confirm, isCancel, log, note, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red } from "kleur/colors";
 const POLL_INTERVAL_MS = 5000;
 const POLL_TIMEOUT_MS = 30 * 60 * 1000; // 30 min — managed certs need ~15 min to issue after DNS
+/**
+ * Without a prompt nobody confirms the records were set, so the install job
+ * (#696) waits longer for the operator to reach their registrar; a timeout
+ * ends the run and the next one resumes at this step.
+ */
+const NON_INTERACTIVE_POLL_TIMEOUT_MS = 2 * 60 * 60 * 1000;
+/**
+ * @param opts.nonInteractive print the records and poll without asking for
+ *   confirmation first (the install job has no terminal)
+ */
 export function makeManualAdapter(opts) {
+    const timeoutMs = opts.nonInteractive ? NON_INTERACTIVE_POLL_TIMEOUT_MS : POLL_TIMEOUT_MS;
+    const timeoutLabel = `${Math.round(timeoutMs / 60_000)} min`;
     return {
         name: `Manual (paste at your registrar for ${opts.domain})`,
         async applyRecords(records) {
@@ -24,24 +36,28 @@ export function makeManualAdapter(opts) {
                 "",
                 ...records.map((r) => `  ${dim(r.type.padEnd(6))} ${r.hostname.padEnd(35)} → ${bold(r.value)}`),
                 "",
-                dim("After pasting, press Enter to verify resolution."),
+                dim(opts.nonInteractive
+                    ? "Waiting until they resolve — the install continues on its own."
+                    : "After pasting, press Enter to verify resolution."),
             ].join("\n"), "DNS records");
-            const ack = await confirm({
-                message: "Records pasted at your registrar?",
-                initialValue: true,
-            });
-            if (isCancel(ack) || !ack) {
-                log.error(red("Aborted at DNS step."));
-                throw new Error("DNS records not pasted; aborted by operator.");
+            if (!opts.nonInteractive) {
+                const ack = await confirm({
+                    message: "Records pasted at your registrar?",
+                    initialValue: true,
+                });
+                if (isCancel(ack) || !ack) {
+                    log.error(red("Aborted at DNS step."));
+                    throw new Error("DNS records not pasted; aborted by operator.");
+                }
             }
             const s = spinner();
-            s.start(`Polling DNS — up to 30 min while propagation + records settle...`);
+            s.start(`Polling DNS — up to ${timeoutLabel} while propagation + records settle...`);
             const start = Date.now();
             const remaining = new Set(records.map((r) => recordKey(r)));
             while (remaining.size > 0) {
-                if (Date.now() - start > POLL_TIMEOUT_MS) {
-                    s.stop(red("DNS verify timeout (30 min)."));
-                    throw new Error(`Records still unresolved after 30 min: ${[...remaining].join(", ")}. Re-run after fixing.`);
+                if (Date.now() - start > timeoutMs) {
+                    s.stop(red(`DNS verify timeout (${timeoutLabel}).`));
+                    throw new Error(`Records still unresolved after ${timeoutLabel}: ${[...remaining].join(", ")}. Re-run after fixing.`);
                 }
                 for (const key of [...remaining]) {
                     const record = records.find((r) => recordKey(r) === key);

package/dist/dns/manual.js.map

@@ -1 +1 @@
-{"version":3,"file":"manual.js","sourceRoot":"","sources":["../../src/dns/manual.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAG3D,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,yDAAyD;AAEjG,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,OAAO;QACL,IAAI,EAAE,uCAAuC,IAAI,CAAC,MAAM,GAAG;QAC3D,KAAK,CAAC,YAAY,CAAC,OAAoB;YACrC,IAAI,CACF;gBACE,IAAI,CAAC,4CAA4C,CAAC;gBAClD,EAAE;gBACF,GAAG,OAAO,CAAC,GAAG,CACZ,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAChF;gBACD,EAAE;gBACF,GAAG,CAAC,kDAAkD,CAAC;aACxD,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,aAAa,CACd,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;gBACxB,OAAO,EAAE,mCAAmC;gBAC5C,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC1B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAE5D,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,eAAe,EAAE,CAAC;oBACzC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;oBAC5C,MAAM,IAAI,KAAK,CACb,0CAA0C,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC5F,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;oBACzD,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBACtB,SAAS;oBACX,CAAC;oBACD,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC9B,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBACtB,GAAG,CAAC,OAAO,CACT,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAClF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC;oBAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACxD,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;YAC1C,KAAK,IAAI,CAAC;QACZ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAY;IAC7B,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAiB;IAC1C,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,oDAAoD;YACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACpD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"manual.js","sourceRoot":"","sources":["../../src/dns/manual.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAG3D,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,yDAAyD;AACjG;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAkD;IAClF,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,eAAe,CAAC;IAC1F,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7D,OAAO;QACL,IAAI,EAAE,uCAAuC,IAAI,CAAC,MAAM,GAAG;QAC3D,KAAK,CAAC,YAAY,CAAC,OAAoB;YACrC,IAAI,CACF;gBACE,IAAI,CAAC,4CAA4C,CAAC;gBAClD,EAAE;gBACF,GAAG,OAAO,CAAC,GAAG,CACZ,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAChF;gBACD,EAAE;gBACF,GAAG,CACD,IAAI,CAAC,cAAc;oBACjB,CAAC,CAAC,gEAAgE;oBAClE,CAAC,CAAC,kDAAkD,CACvD;aACF,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,aAAa,CACd,CAAC;YAEF,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;oBACxB,OAAO,EAAE,mCAAmC;oBAC5C,YAAY,EAAE,IAAI;iBACnB,CAAC,CAAC;gBACH,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC1B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAED,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,uBAAuB,YAAY,wCAAwC,CAAC,CAAC;YACrF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAE5D,OAAO,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,SAAS,EAAE,CAAC;oBACnC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,uBAAuB,YAAY,IAAI,CAAC,CAAC,CAAC;oBACrD,MAAM,IAAI,KAAK,CACb,kCAAkC,YAAY,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,CACrG,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;oBACjC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;oBACzD,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBACtB,SAAS;oBACX,CAAC;oBACD,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC9B,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBACtB,GAAG,CAAC,OAAO,CACT,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAClF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC;oBAAE,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACxD,CAAC;YACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;YAC1C,KAAK,IAAI,CAAC;QACZ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,CAAY;IAC7B,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAiB;IAC1C,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,oDAAoD;YACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACpD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/gcloud.d.ts

@@ -58,6 +58,8 @@ export declare function grantProvisionerRoles(projectId: string, saEmail: string
     run?: typeof gcloud;
     sleep?: (ms: number) => Promise<void>;
     retryDelaysMs?: readonly number[];
+    /** Roles to bind instead of the provisioner's base set (the install job's extras). */
+    roles?: readonly string[];
 }): Promise<{
     granted: number;
     failed: RoleGrantFailure[];

package/dist/gcloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud.d.ts","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAElF;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACrD,OAAO,CAAC,YAAY,CAAC,CAqBvB;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK5D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBrE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAEjG;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAqCD,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,KAAK,GAAG,cAAsB,GACvC,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW/F;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAWvB;AA4DD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA4B1D;AAED,eAAO,MAAM,iBAAiB,mBAAgB,CAAC;AAC/C,eAAO,MAAM,2BAA2B,mBAA0B,CAAC;AACnE,eAAO,MAAM,qBAAqB,mBAAoB,CAAC"}
+{"version":3,"file":"gcloud.d.ts","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAElF;AAED;;;;;GAKG;AACH,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GACrD,OAAO,CAAC,YAAY,CAAC,CAqBvB;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK5D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBrE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAEjG;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAqCD,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,KAAK,GAAG,cAAsB,GACvC,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW/F;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAWvB;AA4DD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,sFAAsF;IACtF,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtB,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA4B1D;AAED,eAAO,MAAM,iBAAiB,mBAAgB,CAAC;AAC/C,eAAO,MAAM,2BAA2B,mBAA0B,CAAC;AACnE,eAAO,MAAM,qBAAqB,mBAAoB,CAAC"}

package/dist/gcloud.js

@@ -219,7 +219,7 @@ export async function grantProvisionerRoles(projectId, saEmail, opts = {}) {
     const retryDelaysMs = opts.retryDelaysMs ?? GRANT_RETRY_DELAYS_MS;
     let granted = 0;
     const failed = [];
-    for (const role of PROVISIONER_ROLES) {
+    for (const role of opts.roles ?? PROVISIONER_ROLES) {
         const args = [
             "projects",
             "add-iam-policy-binding",

package/dist/gcloud.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC7D,OAAO,EAAE,GAAG,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAc,EACd,OAAoD,EAAE;IAEtD,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAClC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,aAAa,CAAC;YACZ,EAAE,EAAE,IAAI,KAAK,CAAC;YACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC;SACpB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAI9B,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IACxE,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,gBAAwB;IAExB,OAAO,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,aAAa,GAAsB;IACvC,wBAAwB;IACxB,yBAAyB;IACzB,oBAAoB;IACpB,8BAA8B;IAC9B,kCAAkC;IAClC,oBAAoB;IACpB,wBAAwB;IACxB,qCAAqC;IACrC,oBAAoB;IACpB,2BAA2B;IAC3B,iCAAiC;IACjC,yBAAyB;IACzB,oBAAoB;IACpB,oEAAoE;IACpE,qEAAqE;IACrE,6BAA6B;IAC7B,mEAAmE;IACnE,+BAA+B;IAC/B,uEAAuE;IACvE,mEAAmE;IACnE,+BAA+B;IAC/B,8DAA8D;IAC9D,uEAAuE;IACvE,yBAAyB;CAC1B,CAAC;AAEF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,MAAM,uBAAuB,GAAsB;IACjD,yBAAyB;IACzB,gCAAgC;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,WAAmC,KAAK;IAExC,MAAM,IAAI,GACR,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/F,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IAC3E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,OAAO;QACP,WAAW;QACX,SAAS;QACT,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;IAC5B,iBAAiB;IACjB,uCAAuC;IACvC,sCAAsC;IACtC,gCAAgC;IAChC,8BAA8B;IAC9B,6BAA6B;IAC7B,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,kEAAkE;IAClE,mEAAmE;IACnE,4BAA4B;IAC5B,qBAAqB;IACrB,iEAAiE;IACjE,4BAA4B;IAC5B,iEAAiE;IACjE,mDAAmD;IACnD,sCAAsC;IACtC,8DAA8D;IAC9D,qDAAqD;IACrD,gEAAgE;IAChE,0DAA0D;IAC1D,2DAA2D;IAC3D,0CAA0C;IAC1C,sBAAsB;IACtB,6BAA6B;IAC7B,4DAA4D;IAC5D,gEAAgE;IAChE,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GACvB,iFAAiF,CAAC;AAEpF,MAAM,qBAAqB,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAQ/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,OAII,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,qBAAqB,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG;YACX,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,UAAU;YACV,kBAAkB,OAAO,EAAE;YAC3B,QAAQ;YACR,IAAI;YACJ,kBAAkB;YAClB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACvD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,+DAA+D;AAC/D,oDAAoD;AACpD,8DAA8D;AAC9D,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,gDAAgD"}
+{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC7D,OAAO,EAAE,GAAG,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAc,EACd,OAAoD,EAAE;IAEtD,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;YAClC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,aAAa,CAAC;YACZ,EAAE,EAAE,IAAI,KAAK,CAAC;YACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC;SACpB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAI9B,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IACxE,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,gBAAwB;IAExB,OAAO,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,aAAa,GAAsB;IACvC,wBAAwB;IACxB,yBAAyB;IACzB,oBAAoB;IACpB,8BAA8B;IAC9B,kCAAkC;IAClC,oBAAoB;IACpB,wBAAwB;IACxB,qCAAqC;IACrC,oBAAoB;IACpB,2BAA2B;IAC3B,iCAAiC;IACjC,yBAAyB;IACzB,oBAAoB;IACpB,oEAAoE;IACpE,qEAAqE;IACrE,6BAA6B;IAC7B,mEAAmE;IACnE,+BAA+B;IAC/B,uEAAuE;IACvE,mEAAmE;IACnE,+BAA+B;IAC/B,8DAA8D;IAC9D,uEAAuE;IACvE,yBAAyB;CAC1B,CAAC;AAEF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,MAAM,uBAAuB,GAAsB;IACjD,yBAAyB;IACzB,gCAAgC;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,WAAmC,KAAK;IAExC,MAAM,IAAI,GACR,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/F,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IAC3E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,OAAO;QACP,WAAW;QACX,SAAS;QACT,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;IAC5B,iBAAiB;IACjB,uCAAuC;IACvC,sCAAsC;IACtC,gCAAgC;IAChC,8BAA8B;IAC9B,6BAA6B;IAC7B,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,kEAAkE;IAClE,mEAAmE;IACnE,4BAA4B;IAC5B,qBAAqB;IACrB,iEAAiE;IACjE,4BAA4B;IAC5B,iEAAiE;IACjE,mDAAmD;IACnD,sCAAsC;IACtC,8DAA8D;IAC9D,qDAAqD;IACrD,gEAAgE;IAChE,0DAA0D;IAC1D,2DAA2D;IAC3D,0CAA0C;IAC1C,sBAAsB;IACtB,6BAA6B;IAC7B,4DAA4D;IAC5D,gEAAgE;IAChE,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GACvB,iFAAiF,CAAC;AAEpF,MAAM,qBAAqB,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAQ/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,OAMI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,qBAAqB,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG;YACX,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,UAAU;YACV,kBAAkB,OAAO,EAAE;YAC3B,QAAQ;YACR,IAAI;YACJ,kBAAkB;YAClB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACvD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,+DAA+D;AAC/D,oDAAoD;AACpD,8DAA8D;AAC9D,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,gDAAgD"}

package/dist/gcp-names.d.ts

@@ -55,4 +55,19 @@ export declare function operatorAccessServiceAccountId(env: string): string;
 export declare function operatorAccessServiceAccountEmail(projectId: string, env: string): string;
 /** Cloud Scheduler job that runs the sync job hourly (self-healing). */
 export declare function operatorAccessScheduleName(env: string): string;
+/**
+ * Cloud Run job that installs Caelo releases from the admin (epic #696):
+ * the admin may only start it, without overrides (upgrader-setup.ts).
+ */
+export declare function upgraderJobName(env: string): string;
+/** Full resource name of the upgrader job, as the admin's env carries it. */
+export declare function upgraderJobResource(projectId: string, region: string, env: string): string;
+/**
+ * Account id of the upgrader job's own service account: may roll the two
+ * Cloud Run services, run the migration job and back up Cloud SQL, never
+ * change IAM, service accounts or secrets (upgrader-setup.ts).
+ */
+export declare function upgraderServiceAccountId(env: string): string;
+/** Email of the upgrader job's service account. */
+export declare function upgraderServiceAccountEmail(projectId: string, env: string): string;
 //# sourceMappingURL=gcp-names.d.ts.map

package/dist/gcp-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GACrC,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D"}
+{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GACrC,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mDAAmD;AACnD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF"}

package/dist/gcp-names.js

@@ -85,4 +85,27 @@ export function operatorAccessServiceAccountEmail(projectId, env) {
 export function operatorAccessScheduleName(env) {
     return `${gcpNamePrefix(env)}-operator-access-hourly`;
 }
+/**
+ * Cloud Run job that installs Caelo releases from the admin (epic #696):
+ * the admin may only start it, without overrides (upgrader-setup.ts).
+ */
+export function upgraderJobName(env) {
+    return `${gcpNamePrefix(env)}-upgrader`;
+}
+/** Full resource name of the upgrader job, as the admin's env carries it. */
+export function upgraderJobResource(projectId, region, env) {
+    return `projects/${projectId}/locations/${region}/jobs/${upgraderJobName(env)}`;
+}
+/**
+ * Account id of the upgrader job's own service account: may roll the two
+ * Cloud Run services, run the migration job and back up Cloud SQL, never
+ * change IAM, service accounts or secrets (upgrader-setup.ts).
+ */
+export function upgraderServiceAccountId(env) {
+    return `${gcpNamePrefix(env)}-upgrader`;
+}
+/** Email of the upgrader job's service account. */
+export function upgraderServiceAccountEmail(projectId, env) {
+    return `${upgraderServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
+}
 //# sourceMappingURL=gcp-names.js.map

package/dist/gcp-names.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAsC;IAEtC,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC"}
+{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAsC;IAEtC,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACjF,CAAC"}

package/dist/index.d.ts

@@ -14,6 +14,7 @@
  * declare the actual Docker resources.
  */
 export type { CloudAdapterInputs, CloudAdapterOutputs, DnsRecord, Environment, ProvisioningOutputsJson, SupportedProvider, } from "./adapter.js";
+export type { AgentDbConnection, AgentHeartbeat, AgentQueue, OpenAgentQueue, OpenedAgentQueue, } from "./agent/queue.js";
 export { type BootstrapToken, generateBootstrapToken, } from "./bootstrap-token.js";
 export { type CaddyDomainSpec, type CaddyfileSpec, generateCaddyfile, } from "./caddy.js";
 export { type CdnCopyAdapter, loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
@@ -22,4 +23,9 @@ export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
 export { type CloudFrontRedirectArtifact, emitRedirectsAzureFrontDoor, emitRedirectsCloudFront, emitRedirectsCloudflare, type FrontDoorRule, type RedirectRow, type RedirectStatusCode, } from "./redirects-emit.js";
 export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
 export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, type DigestMismatch, fetchVerifiedReleaseManifest, type InstallAssessment, type InstalledRelease, type InstallMode, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, type ReleaseChannel, type ReleaseImage, type ReleaseManifest, type ReleaseManifestDeps, type ReleaseManifestError, type ReleaseManifestErrorCode, type ReleaseManifestResult, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";
+export { AGENT_DB_ROLE, roleConvergenceScript } from "./self-hosted-roles.js";
+export { assessUpgradeRequest, type InstalledState, type RefusalCode, type RequestDecision, } from "./upgrader-assess.js";
+export { gcpUpgraderDeps, type UpgraderPlacement, upgraderDatabaseHost, } from "./upgrader-gcp.js";
+export { type ClaimedUpdate, runUpgraderJob, type UpdateEnd, type UpdateEndStatus, type UpdateFacts, type UpdateQueue, type UpgraderJobDeps, type UpgraderRunResult, } from "./upgrader-job.js";
+export type { JobLog } from "./upgrader-reporter.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,KAAK,0BAA0B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,KAAK,0BAA0B,EAC/B,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -7,4 +7,8 @@ export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
 export { emitRedirectsAzureFrontDoor, emitRedirectsCloudFront, emitRedirectsCloudflare, } from "./redirects-emit.js";
 export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
 export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, fetchVerifiedReleaseManifest, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";
+export { AGENT_DB_ROLE, roleConvergenceScript } from "./self-hosted-roles.js";
+export { assessUpgradeRequest, } from "./upgrader-assess.js";
+export { gcpUpgraderDeps, upgraderDatabaseHost, } from "./upgrader-gcp.js";
+export { runUpgraderJob, } from "./upgrader-job.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA0BnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAEL,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,GAIxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAEL,2BAA2B,EAC3B,uBAAuB,EACvB,uBAAuB,GAIxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EAEf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,cAAc,GAOf,MAAM,mBAAmB,CAAC"}

package/dist/infra-contract.d.ts

@@ -20,5 +20,5 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export declare const INFRA_CONTRACT_VERSION = 1;
+export declare const INFRA_CONTRACT_VERSION = 2;
 //# sourceMappingURL=infra-contract.d.ts.map

package/dist/infra-contract.js

@@ -21,5 +21,11 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 1;
+export const INFRA_CONTRACT_VERSION = 2;
+// History (why each bump happened — an install below a number needs the
+// converge that introduced it):
+//   1 — epic #696 split: converge vs app-roll.
+//   2 — the upgrader job (#696 Phase 2): its service account + scoped
+//       grants, the Cloud SQL backup role, its IAM database user, the job,
+//       the admin's run-only grant and CAELO_UPGRADER_JOB on the admin.
 //# sourceMappingURL=infra-contract.js.map

package/dist/infra-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC"}
+{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE"}

package/dist/install-job-runner.d.ts

@@ -0,0 +1,13 @@
+import { type SyncGcloud } from "./state-store.js";
+/** The `--project` value of `argv`, validated. */
+export declare function installJobProject(argv: readonly string[]): string;
+/**
+ * The failure detail recorded for the operator's terminal: the last
+ * non-empty lines of output, colour codes stripped, credentials removed.
+ * Anything the secrets guard still objects to is replaced by a pointer to
+ * the logs rather than written to the bucket.
+ */
+export declare function failureDetail(lines: readonly string[], code: number): string;
+/** Run the install job for `--project` in `argv`. */
+export declare function installJobCommand(argv: readonly string[], run?: SyncGcloud): Promise<void>;
+//# sourceMappingURL=install-job-runner.d.ts.map

package/dist/install-job-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-job-runner.d.ts","sourceRoot":"","sources":["../src/install-job-runner.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnE,kDAAkD;AAClD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAOjE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAsB5E;AAiBD,qDAAqD;AACrD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,GAAE,UAA2B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAyEf"}

package/dist/install-job-runner.js

@@ -0,0 +1,155 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * `caelo-ops install-job --project <id>` — the install job's entry point
+ * (epic #696, Phase 3; install-job.ts has the design). Runs inside the Cloud
+ * Run job, as `caelo-provisioner`, from the signed ops image:
+ *
+ *   1. attach the install from its ops bucket (the container starts empty);
+ *   2. record `running` in `install/install-job.json`;
+ *   3. run the converge half of the GCP install (wizards/gcp.ts
+ *      runGcpConverge) non-interactively, recording each phase;
+ *   4. record `succeeded` — or, from an exit hook, `failed` with the last
+ *      lines of output, whatever made the process stop.
+ *
+ * It takes the project and nothing else: every input is the install's own
+ * record in its bucket, which only the operator and the provisioner can write.
+ */
+import { CAELO_VERSION } from "@caelo-cms/shared";
+import { assertNoSecrets } from "./checkpoint-secrets.js";
+import { readInstallJobStatus, writeInstallJobStatus, } from "./install-job.js";
+import { currentMetadata, installRoot, readLocalMetadata } from "./install-state.js";
+import { attachInstall } from "./state-attach.js";
+import { hasLocalPulumiState, opsBucketName, resolveBackend } from "./state-backend.js";
+import { realSyncGcloud } from "./state-store.js";
+const PROJECT_ID = /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/;
+const ANSI = new RegExp(`${String.fromCharCode(27)}\\[[0-9;?]*[A-Za-z]`, "g");
+/** The `--project` value of `argv`, validated. */
+export function installJobProject(argv) {
+    const i = argv.indexOf("--project");
+    const value = i === -1 ? undefined : argv[i + 1];
+    if (!value || !PROJECT_ID.test(value)) {
+        throw new Error("install-job needs --project <gcp-project-id>");
+    }
+    return value;
+}
+/**
+ * The failure detail recorded for the operator's terminal: the last
+ * non-empty lines of output, colour codes stripped, credentials removed.
+ * Anything the secrets guard still objects to is replaced by a pointer to
+ * the logs rather than written to the bucket.
+ */
+export function failureDetail(lines, code) {
+    const tail = lines
+        .map((l) => l.replace(ANSI, "").trim())
+        .filter((l) => l !== "" && !/^[│┌└◇◆●■▲]+$/.test(l))
+        .slice(-6)
+        .join(" | ");
+    // Stricter than redactCredentials' `user:***@`, which the bucket's guard
+    // still (rightly) reads as a credential URL: drop the password and any
+    // token-like query value entirely.
+    const detail = `exit ${code}: ${tail}`
+        .replace(/([a-z][a-z0-9+.-]{0,31}:\/\/[^\s:@/]*):[^\s@/]+@/gi, "$1@")
+        .replace(/([?&](?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|sig|signature)=)[^&\s#]+/gi, "$1")
+        .slice(0, 1500);
+    try {
+        assertNoSecrets({ detail }, "install-job.json detail");
+        return detail;
+    }
+    catch {
+        return `exit ${code} — see the job's logs`;
+    }
+}
+/** Keep the last `max` lines written to stdout + stderr. */
+function captureOutputTail(max) {
+    const lines = [];
+    for (const stream of [process.stdout, process.stderr]) {
+        const write = stream.write.bind(stream);
+        stream.write = ((chunk, ...rest) => {
+            const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString();
+            for (const l of text.split(/\r?\n/))
+                if (l.trim() !== "")
+                    lines.push(l);
+            if (lines.length > max)
+                lines.splice(0, lines.length - max);
+            return write(chunk, ...rest);
+        });
+    }
+    return () => [...lines];
+}
+/** Run the install job for `--project` in `argv`. */
+export async function installJobCommand(argv, run = realSyncGcloud) {
+    const projectId = installJobProject(argv);
+    const attached = attachInstall(projectId, {
+        run,
+        rootFor: installRoot,
+        hasLocalState: hasLocalPulumiState,
+    });
+    if (!attached.ok)
+        throw new Error(attached.error);
+    const local = readLocalMetadata(attached.installId);
+    if (!local)
+        throw new Error(`attach wrote no install.json for ${attached.installId}`);
+    const meta = currentMetadata(local);
+    if (meta.provider !== "gcp" && meta.provider !== "gcp-firebase") {
+        throw new Error(`install-job runs gcp / gcp-firebase installs; this one is ${meta.provider}.`);
+    }
+    if (!meta.region)
+        throw new Error(`install.json of ${meta.installId} records no region.`);
+    const bucket = opsBucketName(projectId);
+    // Cloud Run sets it; the launcher recorded the same name when it started us.
+    const execution = process.env.CLOUD_RUN_EXECUTION ?? "local-run";
+    const previous = readInstallJobStatus(bucket, run);
+    const now = new Date().toISOString();
+    let status = {
+        statusVersion: 1,
+        installId: meta.installId,
+        execution,
+        state: "running",
+        phase: "Starting",
+        caeloVersion: CAELO_VERSION,
+        startedAt: previous?.execution === execution ? previous.startedAt : now,
+        updatedAt: now,
+    };
+    const record = (patch) => {
+        status = { ...status, ...patch, updatedAt: new Date().toISOString() };
+        if (patch.detail === undefined)
+            delete status.detail;
+        try {
+            writeInstallJobStatus(bucket, status, run);
+        }
+        catch (e) {
+            // The install goes on; the terminal falls back to the execution state.
+            console.error(`could not record progress: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    };
+    record({});
+    const outputTail = captureOutputTail(40);
+    // The wizard's steps end the process with process.exit on failure; the
+    // hook runs synchronously (the bucket write is a spawnSync) either way.
+    process.on("exit", (code) => {
+        if (status.state !== "running")
+            return;
+        record({ state: "failed", detail: failureDetail(outputTail(), code) });
+    });
+    const backend = resolveBackend(meta, {
+        installRoot: installRoot(meta.installId),
+        readPassphrase: () => null,
+    });
+    if (backend.kind !== "gcs") {
+        throw new Error(`${meta.installId}'s state is not in its ops bucket; run the installer with --local.`);
+    }
+    const { runGcpConverge } = await import("./wizards/gcp.js");
+    await runGcpConverge({
+        installId: meta.installId,
+        projectId,
+        region: meta.region,
+        provider: meta.provider,
+        impersonateServiceAccount: null,
+        backend,
+        nonInteractive: true,
+        setupLink: "secret",
+        onPhase: (phase, detail) => record({ phase, detail }),
+    });
+    record({ state: "succeeded", phase: "Done" });
+}
+//# sourceMappingURL=install-job-runner.js.map