@caelo-cms/provisioning 0.10.47 → 0.10.49

package/dist/install-job-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-job-runner.js","sourceRoot":"","sources":["../src/install-job-runner.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAEL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAmB,MAAM,kBAAkB,CAAC;AAEnE,MAAM,UAAU,GAAG,gCAAgC,CAAC;AACpD,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;AAE9E,kDAAkD;AAClD,MAAM,UAAU,iBAAiB,CAAC,IAAuB;IACvD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAwB,EAAE,IAAY;IAClE,MAAM,IAAI,GAAG,KAAK;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACnD,KAAK,CAAC,CAAC,CAAC,CAAC;SACT,IAAI,CAAC,KAAK,CAAC,CAAC;IACf,yEAAyE;IACzE,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,MAAM,GAAG,QAAQ,IAAI,KAAK,IAAI,EAAE;SACnC,OAAO,CAAC,oDAAoD,EAAE,KAAK,CAAC;SACpE,OAAO,CACN,gGAAgG,EAChG,IAAI,CACL;SACA,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,eAAe,CAAC,EAAE,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,IAAI,uBAAuB,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAoD,CAAC;QAC3F,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE;YACrD,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7F,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAwB,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,qDAAqD;AACrD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,MAAkB,cAAc;IAEhC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE;QACxC,GAAG;QACH,OAAO,EAAE,WAAW;QACpB,aAAa,EAAE,mBAAmB;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,6DAA6D,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,SAAS,qBAAqB,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,6EAA6E;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,WAAW,CAAC;IACjE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,MAAM,GAAqB;QAC7B,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;QACT,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,UAAU;QACjB,YAAY,EAAE,aAAa;QAC3B,SAAS,EAAE,QAAQ,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;QACvE,SAAS,EAAE,GAAG;KACf,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAgC,EAAQ,EAAE;QACxD,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QACrD,IAAI,CAAC;YACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,uEAAuE;YACvE,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,CAAC;IAEX,MAAM,UAAU,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACzC,uEAAuE;IACvE,wEAAwE;IACxE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACvC,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE;QACnC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;QACxC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;KAC3B,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,SAAS,oEAAoE,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,cAAc,CAAC;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS;QACT,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,yBAAyB,EAAE,IAAI;QAC/B,OAAO;QACP,cAAc,EAAE,IAAI;QACpB,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;KACtD,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/install-job.d.ts

@@ -0,0 +1,210 @@
+/**
+ * The install job (epic #696, Phase 3): the long half of a GCP install runs
+ * as a Cloud Run job in the install's own project instead of in the
+ * operator's terminal, so closing the Cloud Shell tab (or its 40-minute idle
+ * timeout) never breaks an install.
+ *
+ * Split of work:
+ *   - The operator's terminal (Cloud Shell, or a laptop with
+ *     `--install-job`) does everything that needs the operator's own Google
+ *     identity: project, billing, APIs, the keyless provisioner SA, the ops
+ *     bucket + KMS key, the cost table and its y/N. Then it starts the job
+ *     and tails it.
+ *   - The job — `caelo-ops install-job --project <id>` from the signed ops
+ *     image, pinned by the digest the signed release manifest names, running
+ *     AS `caelo-provisioner` (its runtime service account: no key, no
+ *     impersonation) — runs `pulumi up`, the DNS + certificate waits,
+ *     migrations, the operator-access job and the Owner setup link.
+ *
+ * Progress lives in the install's ops bucket next to install.json:
+ * `install/install-job.json` ({@link InstallJobStatus}) says which execution
+ * runs the install and how far it got; progress.json keeps the per-step
+ * checkpoints, so a restarted execution resumes where the last one stopped.
+ * Re-running the launcher reads the status and attaches to a running
+ * execution, shows a finished one, or starts a new one ({@link decideInstallJob}).
+ *
+ * The Owner setup link is a secret (#656): it never reaches the bucket or
+ * the job's logs. The job stores it in Secret Manager
+ * ({@link INSTALL_SETUP_LINK_SECRET}); the operator's terminal reads it there.
+ */
+import { z } from "zod";
+import type { GcloudRunner } from "./gcloud-retry.js";
+import type { SyncGcloud } from "./state-store.js";
+/** Name of the Cloud Run job that runs the install. */
+export declare const INSTALL_JOB_NAME = "caelo-install";
+/** Secret Manager secret the job stores the Owner setup link in. */
+export declare const INSTALL_SETUP_LINK_SECRET = "caelo-install-setup-link";
+/**
+ * Secret Manager secret holding the operator's `CLOUDFLARE_API_TOKEN` for
+ * the job's automatic DNS (dns/cloudflare.ts). Written by the launcher only
+ * when the operator's shell has the token; the job reads it as an env var
+ * mounted from the secret, so it never appears in the job definition.
+ */
+export declare const INSTALL_CLOUDFLARE_TOKEN_SECRET = "caelo-install-cloudflare-token";
+/**
+ * Repository of the `caelo-ops` image on the public Artifact Registry
+ * mirror. Cloud Run pulls from Artifact Registry, not from GHCR; the mirror
+ * carries the same digests and signatures (release-images.yml, `oras copy -r`).
+ */
+export declare const OPS_IMAGE_REPOSITORY = "europe-west1-docker.pkg.dev/caelo-website/caelo-cms-images/ops";
+/**
+ * Roles the provisioner needs on top of {@link PROVISIONER_ROLE_LIST} when it
+ * runs the install job instead of the operator: the operator-access sync job
+ * creates a project custom role and a Cloud Scheduler job (operator-access.ts),
+ * and the job's own output has to reach Cloud Logging so the terminal can
+ * tail it. Granted only to installs that use the job. Not an escalation: the
+ * provisioner already holds `resourcemanager.projectIamAdmin`.
+ */
+export declare const INSTALL_JOB_ROLES: readonly string[];
+/** The ops image pinned by digest. */
+export declare function opsImageRef(digest: string): string;
+/** What `install/install-job.json` records. */
+export declare const InstallJobStatusSchema: z.ZodObject<{
+    statusVersion: z.ZodLiteral<1>;
+    installId: z.ZodString;
+    execution: z.ZodString;
+    state: z.ZodEnum<{
+        failed: "failed";
+        succeeded: "succeeded";
+        running: "running";
+    }>;
+    phase: z.ZodString;
+    detail: z.ZodOptional<z.ZodString>;
+    caeloVersion: z.ZodString;
+    startedAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type InstallJobStatus = z.infer<typeof InstallJobStatusSchema>;
+/** `gs://<bucket>/install/install-job.json`. */
+export declare function installJobStatusUrl(bucket: string): string;
+/**
+ * The install job's status as the ops bucket holds it now (never cached:
+ * another process — the job — writes it), or null before the first start.
+ * Throws when the bucket can't be read or the document is malformed.
+ */
+export declare function readInstallJobStatus(bucket: string, run: SyncGcloud): InstallJobStatus | null;
+/** Replace the status document. Refuses secret material (#656). */
+export declare function writeInstallJobStatus(bucket: string, status: InstallJobStatus, run: SyncGcloud): void;
+/**
+ * Write `status` only if the document doesn't name its execution yet and
+ * nobody wrote it since this call read it (`--if-generation-match`). The
+ * launcher records a just-started execution this way: the execution itself
+ * may already have written a newer phase — or its failure — which must win.
+ *
+ * @returns whether this call's write landed
+ */
+export declare function claimInstallJobStatus(bucket: string, status: InstallJobStatus, run: SyncGcloud): boolean;
+/** `gs://<bucket>/install/install-job.lock` — held while a launcher decides and starts. */
+export declare function installJobLockUrl(bucket: string): string;
+/**
+ * Take the launch lock (created only if absent). A lock left by a crashed
+ * launcher is reported with the command to remove it, never broken
+ * automatically — like the install's state lock (state-store.ts).
+ *
+ * @returns the release function
+ */
+export declare function acquireLaunchLock(bucket: string, run: SyncGcloud): () => void;
+/** Where a Cloud Run execution stands. */
+export type ExecutionState = "running" | "succeeded" | "failed" | "missing";
+/** Read one execution of the install job. */
+export declare function describeExecution(run: GcloudRunner, target: {
+    projectId: string;
+    region: string;
+    execution: string;
+}): Promise<ExecutionState>;
+/** What the launcher does with an install that may already have a job. */
+export type InstallJobDecision = {
+    readonly kind: "start";
+    readonly previous: InstallJobStatus | null;
+    readonly why: string;
+} | {
+    readonly kind: "attach";
+    readonly status: InstallJobStatus;
+} | {
+    readonly kind: "done";
+    readonly status: InstallJobStatus;
+};
+/**
+ * Decide from the bucket's status and the execution's live state. Only a
+ * status the job itself finished as `succeeded` counts as done; a running
+ * status whose execution has ended (crash, out of memory, cancelled, task
+ * timeout) is started again — the steps are checkpointed, so a new
+ * execution resumes where the last one stopped.
+ */
+export declare function decideInstallJob(status: InstallJobStatus | null, live: ExecutionState | null): InstallJobDecision;
+/** Everything the job definition depends on. */
+export interface InstallJobSpec {
+    readonly projectId: string;
+    readonly region: string;
+    /** `caelo-provisioner@<project>` — the job's runtime identity. */
+    readonly serviceAccount: string;
+    /** {@link opsImageRef} of the release's signed ops image. */
+    readonly image: string;
+    /**
+     * Mount {@link INSTALL_CLOUDFLARE_TOKEN_SECRET} as `CLOUDFLARE_API_TOKEN`
+     * (the launcher stored the operator's token there); without it the job's
+     * DNS step prints the records and polls.
+     */
+    readonly cloudflareToken: boolean;
+}
+/**
+ * The `gcloud run jobs deploy` argv: creates the job or replaces its
+ * definition (image, args, identity) in place. The only argument the job
+ * gets is the project; everything else it reads from the ops bucket.
+ */
+export declare function installJobDeployArgs(spec: InstallJobSpec): string[];
+/** Create or update the job, then start one execution of it. */
+export declare function startInstallJob(run: GcloudRunner, spec: InstallJobSpec): Promise<{
+    ok: true;
+    execution: string;
+} | {
+    ok: false;
+    error: string;
+}>;
+/**
+ * The execution's log lines not printed yet, oldest first, looking back
+ * {@link LOG_LOOKBACK_MS} before `since` (the newest timestamp seen so far,
+ * or null for all). `seen` holds the insert ids already printed — the
+ * overlap and entries sharing a timestamp would otherwise repeat.
+ */
+export declare function readExecutionLogs(run: GcloudRunner, target: {
+    projectId: string;
+    execution: string;
+}, since: string | null, seen: Set<string>): Promise<{
+    lines: string[];
+    cursor: string | null;
+}>;
+/**
+ * Store `value` as the newest version of the install secret `secretId`
+ * (created with the install's secret replication if missing) and disable
+ * the versions before it, so exactly one value is readable. The value goes
+ * to gcloud on stdin, never on a command line.
+ */
+export declare function storeInstallSecretValue(run: GcloudRunner, target: {
+    projectId: string;
+    region: string;
+}, secretId: string, value: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;
+/** Store the Owner setup link in {@link INSTALL_SETUP_LINK_SECRET}. */
+export declare function storeSetupLink(run: GcloudRunner, target: {
+    projectId: string;
+    region: string;
+}, link: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;
+/**
+ * The Owner setup link the job stored, or null when there is none (the
+ * secret or an enabled version is missing).
+ *
+ * @throws when it can't be read for any other reason (no permission), with
+ *   what the operator's account needs
+ */
+export declare function readSetupLink(run: GcloudRunner, projectId: string): Promise<string | null>;
+//# sourceMappingURL=install-job.d.ts.map

package/dist/install-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-job.d.ts","sourceRoot":"","sources":["../src/install-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,mCAAmC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,mEACiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAI9C,CAAC;AAQF,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAcjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,gDAAgD;AAChD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAoB7F;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,IAAI,CAWN;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,OAAO,CAyBT;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,IAAI,CAgB7E;AAED,0CAA0C;AAC1C,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AAW5E,6CAA6C;AAC7C,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,cAAc,CAAC,CAuBzB;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAC/B,IAAI,EAAE,cAAc,GAAG,IAAI,GAC1B,kBAAkB,CAgBpB;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAwBnE;AAED,gEAAgE;AAChE,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BzE;AA2BD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAChD,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAyCrD;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoCtD;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAchG"}

package/dist/install-job.js

@@ -0,0 +1,449 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The install job (epic #696, Phase 3): the long half of a GCP install runs
+ * as a Cloud Run job in the install's own project instead of in the
+ * operator's terminal, so closing the Cloud Shell tab (or its 40-minute idle
+ * timeout) never breaks an install.
+ *
+ * Split of work:
+ *   - The operator's terminal (Cloud Shell, or a laptop with
+ *     `--install-job`) does everything that needs the operator's own Google
+ *     identity: project, billing, APIs, the keyless provisioner SA, the ops
+ *     bucket + KMS key, the cost table and its y/N. Then it starts the job
+ *     and tails it.
+ *   - The job — `caelo-ops install-job --project <id>` from the signed ops
+ *     image, pinned by the digest the signed release manifest names, running
+ *     AS `caelo-provisioner` (its runtime service account: no key, no
+ *     impersonation) — runs `pulumi up`, the DNS + certificate waits,
+ *     migrations, the operator-access job and the Owner setup link.
+ *
+ * Progress lives in the install's ops bucket next to install.json:
+ * `install/install-job.json` ({@link InstallJobStatus}) says which execution
+ * runs the install and how far it got; progress.json keeps the per-step
+ * checkpoints, so a restarted execution resumes where the last one stopped.
+ * Re-running the launcher reads the status and attaches to a running
+ * execution, shows a finished one, or starts a new one ({@link decideInstallJob}).
+ *
+ * The Owner setup link is a secret (#656): it never reaches the bucket or
+ * the job's logs. The job stores it in Secret Manager
+ * ({@link INSTALL_SETUP_LINK_SECRET}); the operator's terminal reads it there.
+ */
+import { z } from "zod";
+import { assertNoSecrets } from "./checkpoint-secrets.js";
+import { GCP_STACK_ENV } from "./gcp-names.js";
+import { createInstallSecret } from "./runtime-secrets.js";
+import { OPS_INSTALL_PREFIX } from "./state-backend.js";
+import { IMAGE_DIGEST } from "./upgrade/release-images.js";
+/** Name of the Cloud Run job that runs the install. */
+export const INSTALL_JOB_NAME = "caelo-install";
+/** Secret Manager secret the job stores the Owner setup link in. */
+export const INSTALL_SETUP_LINK_SECRET = "caelo-install-setup-link";
+/**
+ * Secret Manager secret holding the operator's `CLOUDFLARE_API_TOKEN` for
+ * the job's automatic DNS (dns/cloudflare.ts). Written by the launcher only
+ * when the operator's shell has the token; the job reads it as an env var
+ * mounted from the secret, so it never appears in the job definition.
+ */
+export const INSTALL_CLOUDFLARE_TOKEN_SECRET = "caelo-install-cloudflare-token";
+/**
+ * Repository of the `caelo-ops` image on the public Artifact Registry
+ * mirror. Cloud Run pulls from Artifact Registry, not from GHCR; the mirror
+ * carries the same digests and signatures (release-images.yml, `oras copy -r`).
+ */
+export const OPS_IMAGE_REPOSITORY = "europe-west1-docker.pkg.dev/caelo-website/caelo-cms-images/ops";
+/**
+ * Roles the provisioner needs on top of {@link PROVISIONER_ROLE_LIST} when it
+ * runs the install job instead of the operator: the operator-access sync job
+ * creates a project custom role and a Cloud Scheduler job (operator-access.ts),
+ * and the job's own output has to reach Cloud Logging so the terminal can
+ * tail it. Granted only to installs that use the job. Not an escalation: the
+ * provisioner already holds `resourcemanager.projectIamAdmin`.
+ */
+export const INSTALL_JOB_ROLES = [
+    "roles/iam.roleAdmin",
+    "roles/cloudscheduler.admin",
+    "roles/logging.logWriter",
+];
+/** Resources the job runs with: Pulumi + the Node language host want memory. */
+const JOB_CPU = "2";
+const JOB_MEMORY = "4Gi";
+/** DNS (operator at the registrar) + certificate waits can each take an hour. */
+const JOB_TASK_TIMEOUT = "6h";
+/** The ops image pinned by digest. */
+export function opsImageRef(digest) {
+    if (!IMAGE_DIGEST.test(digest))
+        throw new Error(`not an image digest: ${digest}`);
+    return `${OPS_IMAGE_REPOSITORY}@${digest}`;
+}
+/** What `install/install-job.json` records. */
+export const InstallJobStatusSchema = z.object({
+    statusVersion: z.literal(1),
+    installId: z.string().min(1),
+    /** The Cloud Run execution running (or last running) the install. */
+    execution: z.string().min(1),
+    state: z.enum(["running", "succeeded", "failed"]),
+    /** Human-readable step the job is on, e.g. "Waiting for DNS". */
+    phase: z.string(),
+    /** Extra context for the phase (the DNS records to set, a failure reason). */
+    detail: z.string().optional(),
+    /** Caelo release the job's image belongs to. */
+    caeloVersion: z.string(),
+    startedAt: z.string(),
+    updatedAt: z.string(),
+});
+/** `gs://<bucket>/install/install-job.json`. */
+export function installJobStatusUrl(bucket) {
+    return `gs://${bucket}/${OPS_INSTALL_PREFIX}/install-job.json`;
+}
+const NOT_FOUND = /matched no objects|No URLs matched|NotFound|NOT_FOUND|404|does not exist/i;
+/**
+ * The install job's status as the ops bucket holds it now (never cached:
+ * another process — the job — writes it), or null before the first start.
+ * Throws when the bucket can't be read or the document is malformed.
+ */
+export function readInstallJobStatus(bucket, run) {
+    const url = installJobStatusUrl(bucket);
+    const r = run(["storage", "cat", url]);
+    if (!r.ok) {
+        if (NOT_FOUND.test(r.stderr))
+            return null;
+        throw new Error(`Could not read ${url}: ${r.stderr.trim() || `gcloud exited ${r.exitCode}`}`);
+    }
+    let json;
+    try {
+        json = JSON.parse(r.stdout);
+    }
+    catch {
+        throw new Error(`${url} is not valid JSON; remove it and re-run to start the install again.`);
+    }
+    const parsed = InstallJobStatusSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new Error(`${url} is not an install-job status this CLI understands (${parsed.error.message}); remove it and re-run.`);
+    }
+    return parsed.data;
+}
+/** Replace the status document. Refuses secret material (#656). */
+export function writeInstallJobStatus(bucket, status, run) {
+    const parsed = InstallJobStatusSchema.parse(status);
+    assertNoSecrets(parsed, "install-job.json");
+    const url = installJobStatusUrl(bucket);
+    const r = run(["storage", "cp", "-", url, "--content-type=application/json"], `${JSON.stringify(parsed, null, 2)}\n`);
+    if (!r.ok) {
+        throw new Error(`Could not write ${url}: ${r.stderr.trim() || `gcloud exited ${r.exitCode}`}`);
+    }
+}
+/**
+ * Write `status` only if the document doesn't name its execution yet and
+ * nobody wrote it since this call read it (`--if-generation-match`). The
+ * launcher records a just-started execution this way: the execution itself
+ * may already have written a newer phase — or its failure — which must win.
+ *
+ * @returns whether this call's write landed
+ */
+export function claimInstallJobStatus(bucket, status, run) {
+    const url = installJobStatusUrl(bucket);
+    const described = run(["storage", "objects", "describe", url, "--format=value(generation)"]);
+    let generation;
+    if (described.ok)
+        generation = described.stdout.trim();
+    else if (NOT_FOUND.test(described.stderr))
+        generation = "0";
+    else
+        throw new Error(`Could not read ${url}: ${described.stderr.trim()}`);
+    if (!/^\d+$/.test(generation))
+        throw new Error(`${url}: unexpected generation "${generation}"`);
+    if (readInstallJobStatus(bucket, run)?.execution === status.execution)
+        return false;
+    const parsed = InstallJobStatusSchema.parse(status);
+    assertNoSecrets(parsed, "install-job.json");
+    const r = run([
+        "storage",
+        "cp",
+        "-",
+        url,
+        "--content-type=application/json",
+        `--if-generation-match=${generation}`,
+    ], `${JSON.stringify(parsed, null, 2)}\n`);
+    if (r.ok)
+        return true;
+    if (/PreconditionFailed|412|pre-conditions/i.test(r.stderr))
+        return false;
+    throw new Error(`Could not write ${url}: ${r.stderr.trim() || `gcloud exited ${r.exitCode}`}`);
+}
+/** `gs://<bucket>/install/install-job.lock` — held while a launcher decides and starts. */
+export function installJobLockUrl(bucket) {
+    return `gs://${bucket}/${OPS_INSTALL_PREFIX}/install-job.lock`;
+}
+/**
+ * Take the launch lock (created only if absent). A lock left by a crashed
+ * launcher is reported with the command to remove it, never broken
+ * automatically — like the install's state lock (state-store.ts).
+ *
+ * @returns the release function
+ */
+export function acquireLaunchLock(bucket, run) {
+    const url = installJobLockUrl(bucket);
+    const body = JSON.stringify({ purpose: "start the install job", at: new Date().toISOString() });
+    const r = run(["storage", "cp", "-", url, "--if-generation-match=0"], body);
+    if (!r.ok) {
+        if (/PreconditionFailed|412|pre-conditions/i.test(r.stderr)) {
+            throw new Error(`Another terminal is starting this install's job right now. Re-run in a minute to follow it; if no other run is starting it, remove the stale lock: gcloud storage rm ${url}`);
+        }
+        throw new Error(`Could not take the launch lock ${url}: ${r.stderr.trim()}`);
+    }
+    return () => {
+        const rm = run(["storage", "rm", url]);
+        if (!rm.ok)
+            throw new Error(`Could not release ${url}; remove it: gcloud storage rm ${url}`);
+    };
+}
+/** Read one execution of the install job. */
+export async function describeExecution(run, target) {
+    const r = await run([
+        "run",
+        "jobs",
+        "executions",
+        "describe",
+        target.execution,
+        `--region=${target.region}`,
+        `--project=${target.projectId}`,
+        "--format=json",
+    ]);
+    if (!r.ok) {
+        if (NOT_FOUND.test(r.stderr))
+            return "missing";
+        throw new Error(`Could not read execution ${target.execution}: ${r.stderr.trim() || `gcloud exited ${r.exitCode}`}`);
+    }
+    const d = JSON.parse(r.stdout || "{}");
+    const s = d.status ?? {};
+    if (!s.completionTime)
+        return "running";
+    return (s.succeededCount ?? 0) >= 1 && !s.failedCount && !s.cancelledCount
+        ? "succeeded"
+        : "failed";
+}
+/**
+ * Decide from the bucket's status and the execution's live state. Only a
+ * status the job itself finished as `succeeded` counts as done; a running
+ * status whose execution has ended (crash, out of memory, cancelled, task
+ * timeout) is started again — the steps are checkpointed, so a new
+ * execution resumes where the last one stopped.
+ */
+export function decideInstallJob(status, live) {
+    if (!status)
+        return { kind: "start", previous: null, why: "no install job has run yet" };
+    if (status.state === "succeeded")
+        return { kind: "done", status };
+    if (status.state === "running" && live === "running")
+        return { kind: "attach", status };
+    if (status.state === "failed") {
+        return {
+            kind: "start",
+            previous: status,
+            why: `the last run stopped at "${status.phase}"${status.detail ? `: ${status.detail}` : ""}`,
+        };
+    }
+    return {
+        kind: "start",
+        previous: status,
+        why: `execution ${status.execution} ended (${live ?? "unknown"}) while at "${status.phase}"`,
+    };
+}
+/**
+ * The `gcloud run jobs deploy` argv: creates the job or replaces its
+ * definition (image, args, identity) in place. The only argument the job
+ * gets is the project; everything else it reads from the ops bucket.
+ */
+export function installJobDeployArgs(spec) {
+    return [
+        "run",
+        "jobs",
+        "deploy",
+        INSTALL_JOB_NAME,
+        `--image=${spec.image}`,
+        `--region=${spec.region}`,
+        `--project=${spec.projectId}`,
+        `--service-account=${spec.serviceAccount}`,
+        `--args=install-job,--project,${spec.projectId}`,
+        "--tasks=1",
+        "--max-retries=0",
+        `--task-timeout=${JOB_TASK_TIMEOUT}`,
+        `--cpu=${JOB_CPU}`,
+        `--memory=${JOB_MEMORY}`,
+        // Plain log lines: no colour codes, no spinner frames.
+        "--set-env-vars=NO_COLOR=1,CI=true",
+        spec.cloudflareToken
+            ? `--set-secrets=CLOUDFLARE_API_TOKEN=${INSTALL_CLOUDFLARE_TOKEN_SECRET}:latest`
+            : "--clear-secrets",
+        "--labels=caelo-role=install",
+        "--quiet",
+    ];
+}
+/** Create or update the job, then start one execution of it. */
+export async function startInstallJob(run, spec) {
+    const deploy = await run(installJobDeployArgs(spec));
+    if (!deploy.ok) {
+        return { ok: false, error: `create the install job: ${deploy.stderr.trim()}` };
+    }
+    const exec = await run([
+        "run",
+        "jobs",
+        "execute",
+        INSTALL_JOB_NAME,
+        `--region=${spec.region}`,
+        `--project=${spec.projectId}`,
+        "--async",
+        "--format=value(metadata.name)",
+    ]);
+    if (!exec.ok)
+        return { ok: false, error: `start the install job: ${exec.stderr.trim()}` };
+    // gcloud prints the resource with --format on stdout; older releases only
+    // announce "Execution [name] has successfully started" on stderr.
+    const execution = exec.stdout.trim().split(/\s+/)[0] || /Execution \[([^\]]+)\]/.exec(exec.stderr)?.[1] || "";
+    if (!/^[a-z0-9-]+$/.test(execution)) {
+        return {
+            ok: false,
+            error: `the install job started but gcloud did not name the execution (${exec.stderr.trim()})`,
+        };
+    }
+    return { ok: true, execution };
+}
+/** `since` minus the lookback window, as an RFC 3339 timestamp. */
+function lookback(since) {
+    const t = Date.parse(since);
+    if (Number.isNaN(t))
+        throw new Error(`not a log timestamp: ${since}`);
+    return new Date(t - LOG_LOOKBACK_MS).toISOString();
+}
+/**
+ * How far before the newest line seen each poll looks again. Cloud Logging
+ * can make an entry queryable after a later-timestamped one; the overlap
+ * (deduplicated by insert id) lets such a late entry still reach the
+ * terminal.
+ */
+const LOG_LOOKBACK_MS = 2 * 60 * 1000;
+/** Entries per `gcloud logging read` page, and pages per poll. */
+const LOG_PAGE_SIZE = 1000;
+const LOG_MAX_PAGES = 20;
+/**
+ * The execution's log lines not printed yet, oldest first, looking back
+ * {@link LOG_LOOKBACK_MS} before `since` (the newest timestamp seen so far,
+ * or null for all). `seen` holds the insert ids already printed — the
+ * overlap and entries sharing a timestamp would otherwise repeat.
+ */
+export async function readExecutionLogs(run, target, since, seen) {
+    const lines = [];
+    let cursor = since;
+    // A page that comes back full may hide newer entries behind it (a chatty
+    // two-minute window): read on from its last timestamp, page by page.
+    let from = since ? lookback(since) : null;
+    for (let page = 0; page < LOG_MAX_PAGES; page++) {
+        const filter = [
+            'resource.type="cloud_run_job"',
+            `resource.labels.job_name="${INSTALL_JOB_NAME}"`,
+            `labels."run.googleapis.com/execution_name"="${target.execution}"`,
+            ...(from ? [`timestamp>="${from}"`] : []),
+        ].join(" AND ");
+        const r = await run([
+            "logging",
+            "read",
+            filter,
+            `--project=${target.projectId}`,
+            "--order=asc",
+            `--limit=${LOG_PAGE_SIZE}`,
+            "--freshness=1d",
+            "--format=json",
+        ]);
+        if (!r.ok)
+            break;
+        const entries = JSON.parse(r.stdout || "[]");
+        for (const e of entries) {
+            const id = e.insertId ?? `${e.timestamp}:${e.textPayload}`;
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            if (e.timestamp && (cursor === null || Date.parse(e.timestamp) > Date.parse(cursor))) {
+                cursor = e.timestamp;
+            }
+            if (e.textPayload !== undefined)
+                lines.push(e.textPayload.replace(/\n$/, ""));
+        }
+        const last = entries.at(-1)?.timestamp ?? null;
+        // Not full: nothing newer is hidden. Full but one timestamp throughout:
+        // the next page would be the same one.
+        if (entries.length < LOG_PAGE_SIZE || last === null || last === from)
+            break;
+        from = last;
+    }
+    return { lines, cursor };
+}
+/**
+ * Store `value` as the newest version of the install secret `secretId`
+ * (created with the install's secret replication if missing) and disable
+ * the versions before it, so exactly one value is readable. The value goes
+ * to gcloud on stdin, never on a command line.
+ */
+export async function storeInstallSecretValue(run, target, secretId, value) {
+    const project = `--project=${target.projectId}`;
+    const exists = await run(["secrets", "describe", secretId, project, "--format=value(name)"]);
+    if (!exists.ok) {
+        const created = await createInstallSecret({ ...target, env: GCP_STACK_ENV, secretId }, { run });
+        if (!created.ok)
+            return created;
+    }
+    const add = await run(["secrets", "versions", "add", secretId, project, "--data-file=-", "--format=value(name)"], { stdin: value });
+    if (!add.ok)
+        return { ok: false, error: `store ${secretId}: ${add.stderr.trim()}` };
+    const newest = add.stdout.trim().split("/").pop() ?? "";
+    const enabled = await run([
+        "secrets",
+        "versions",
+        "list",
+        secretId,
+        project,
+        "--filter=state:enabled",
+        "--format=value(name)",
+    ]);
+    for (const name of enabled.ok ? enabled.stdout.split("\n") : []) {
+        const version = name.trim().split("/").pop() ?? "";
+        if (version === "" || version === newest)
+            continue;
+        await run([
+            "secrets",
+            "versions",
+            "disable",
+            version,
+            `--secret=${secretId}`,
+            project,
+            "--quiet",
+        ]);
+    }
+    return { ok: true };
+}
+/** Store the Owner setup link in {@link INSTALL_SETUP_LINK_SECRET}. */
+export function storeSetupLink(run, target, link) {
+    return storeInstallSecretValue(run, target, INSTALL_SETUP_LINK_SECRET, link);
+}
+/**
+ * The Owner setup link the job stored, or null when there is none (the
+ * secret or an enabled version is missing).
+ *
+ * @throws when it can't be read for any other reason (no permission), with
+ *   what the operator's account needs
+ */
+export async function readSetupLink(run, projectId) {
+    const r = await run([
+        "secrets",
+        "versions",
+        "access",
+        "latest",
+        `--secret=${INSTALL_SETUP_LINK_SECRET}`,
+        `--project=${projectId}`,
+    ]);
+    if (r.ok)
+        return r.stdout.trim() === "" ? null : r.stdout.trim();
+    if (/NOT_FOUND|not found|DISABLED|DESTROYED|FAILED_PRECONDITION/i.test(r.stderr))
+        return null;
+    throw new Error(`Could not read the Owner setup link (secret ${INSTALL_SETUP_LINK_SECRET} in ${projectId}): ${r.stderr.trim()}. Your gcloud account needs secretmanager.versions.access on the project (e.g. roles/secretmanager.secretAccessor or project Owner).`);
+}
+//# sourceMappingURL=install-job.js.map