@caelo-cms/provisioning 0.10.53 → 0.10.57

package/dist/upgrade/app-roll.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-roll.d.ts","sourceRoot":"","sources":["../../src/upgrade/app-roll.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EASjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAE3C,gFAAgF;AAChF,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAAyB,CAAC;AAEpE,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,EAChD,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,UAAU,CAAC,CAsErB;AAwBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAY5F;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAa7E;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,eAAe,CAAC,IAAI,OAAO,CACzB;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;KAAE,CAC3F,CAAC;IACF,gFAAgF;IAChF,UAAU,CAAC,CACT,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,yEAAyE;IACzE,aAAa,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,CAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;CAC7C;AAED,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7F,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACrD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEN,+DAA+D;AAC/D,wBAAsB,cAAc,CAClC,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CA2JxB"}
+{"version":3,"file":"app-roll.d.ts","sourceRoot":"","sources":["../../src/upgrade/app-roll.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAEL,KAAK,cAAc,EAGpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EAYjB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAE3C,gFAAgF;AAChF,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAAyB,CAAC;AAEpE,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,EAChD,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,UAAU,CAAC,CA4FrB;AAED,wGAAwG;AACxG,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;CACpF;AA2BD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,GAAG,WAAW,CAanF;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAW7E;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,eAAe,CAAC,IAAI,OAAO,CACvB,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CACvE,cAAc,EACd,UAAU,CACX,CAAC,GACF;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;KAAE,CACzB,CAAC;IACF,gFAAgF;IAChF,UAAU,CAAC,CACT,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,yEAAyE;IACzE,aAAa,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,CAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;CAC7C;AAED,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7F,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACrD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEN,+DAA+D;AAC/D,wBAAsB,cAAc,CAClC,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CA2MxB"}

package/dist/upgrade/app-roll.js

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: MPL-2.0
 import { gatewayServiceAccountEmail, runServiceAccountEmail } from "../gcp-names.js";
-import { adminMediaVolume } from "../stack-contract.js";
-import { liveContainerEnv, liveContainerMemory, liveVolumes, planAdminMemory, planContractEnv, planMediaVolume, rollService, serviceRollArgs, } from "../stack-converge.js";
+import { adminMediaVolume, GATEWAY_TIMEOUT_SECONDS, SERVICE_SECRET_FILES, } from "../stack-contract.js";
+import { liveContainerEnv, liveContainerMemory, liveTimeoutSeconds, liveVolumes, planAdminMemory, planContractEnv, planMediaVolume, planRequestTimeout, planSecretFiles, rollService, serviceRollArgs, } from "../stack-converge.js";
+import { describeAuditJobImage, setAuditJobImage } from "./audit-job-roll.js";
 import { restoreCommand } from "./backup.js";
 import { describeServiceJson, findCurrentRevision, findServiceUrl, pinTraffic, resolveGcpResourceName, } from "./gcp-lookup.js";
 /** The roll order: the gateway follows the admin, never the other way round. */
@@ -40,9 +41,10 @@ export async function planAppRoll(install, images, run) {
             liveEnv: liveContainerEnv(json),
             liveMemory: liveContainerMemory(json),
             liveVolumes: liveVolumes(json),
+            liveTimeout: liveTimeoutSeconds(json),
         });
     }
-    const env = planEnv(install, services, []);
+    const env = planEnv(install, services, {});
     if (!env.ok)
         return { ok: false, error: `the install's env contract can't be applied: ${env.error}` };
     // Without the media volume every upload is lost on the next revision or
@@ -51,6 +53,17 @@ export async function planAppRoll(install, images, run) {
     const media = planMediaVolume(admin.liveVolumes, adminMediaVolume(install.projectId, install.env));
     if (!media.ok)
         return { ok: false, error: `the admin's media volume can't be set up: ${media.error}` };
+    // #806 — each service's secret files (the gateway's remote-MCP OAuth
+    // client). A file the roll cannot mount fails the plan: the new gateway
+    // reads its path from the env contract.
+    const secretFiles = {};
+    for (const s of services) {
+        const files = planSecretFiles(s.liveVolumes, SERVICE_SECRET_FILES[s.slug], install.env);
+        if (!files.ok) {
+            return { ok: false, error: `the ${s.slug}'s secret files can't be mounted: ${files.error}` };
+        }
+        secretFiles[s.slug] = files;
+    }
     const warnings = [];
     const rolls = services.map((s) => {
         // #553 — the admin runs the Lighthouse quality audit; raise it to the
@@ -58,18 +71,27 @@ export async function planAppRoll(install, images, run) {
         const memory = s.slug === "admin" ? planAdminMemory(s.liveMemory) : null;
         if (memory && !memory.ok)
             warnings.push(`admin memory left as is: ${memory.error}`);
+        // #806 — the gateway streams remote-MCP chat turns (stack-contract.ts
+        // GATEWAY_TIMEOUT_SECONDS). The admin's timeout is the stacks' alone.
+        const timeout = s.slug === "gateway" ? planRequestTimeout(s.liveTimeout, GATEWAY_TIMEOUT_SECONDS) : null;
+        const memoryFlags = memory?.ok ? memory.flags : [];
+        const timeoutFlags = timeout?.ok ? timeout.flags : [];
         return {
             ...s,
             envFlags: env.services[s.slug].flags,
             envChanges: env.services[s.slug].changes,
-            resourceFlags: memory?.ok ? memory.flags : [],
-            volumeFlags: s.slug === "admin" ? media.flags : [],
-            volumeChanges: s.slug === "admin" ? media.changes : [],
+            resourceFlags: [...memoryFlags, ...timeoutFlags],
+            resourceChanges: [
+                ...memoryFlags.map((f) => `${s.liveMemory ?? "(default)"} → ${f}`),
+                ...(timeout?.ok ? timeout.changes : []),
+            ],
+            volumeFlags: [...(s.slug === "admin" ? media.flags : []), ...secretFiles[s.slug].flags],
+            volumeChanges: [...(s.slug === "admin" ? media.changes : []), ...secretFiles[s.slug].changes],
         };
     });
     return { ok: true, plan: { install, services: rolls, warnings } };
 }
-function planEnv(install, services, leaveUntouched) {
+function planEnv(install, services, adjust) {
     const deployed = Object.fromEntries(services.map((s) => [s.slug, { serviceName: s.serviceName, liveEnv: s.liveEnv }]));
     return planContractEnv({
         provider: install.provider,
@@ -78,16 +100,21 @@ function planEnv(install, services, leaveUntouched) {
         domain: install.domain,
         region: install.region,
         stagingHost: install.stagingHost,
-    }, deployed, { leaveUntouched });
+    }, deployed, {
+        leaveUntouched: adjust.leaveUntouched ?? [],
+        ...(adjust.extraEnv ? { extraEnv: adjust.extraEnv } : {}),
+    });
 }
 /**
- * The plan with `names` left exactly as the services have them — for env
- * vars that point at something a converge step could not set up.
+ * The plan with the converge's adjustments: vars left exactly as the
+ * services have them (they point at something a converge step could not set
+ * up) and vars outside the contract the rolls set too.
  */
-export function leavingEnvUntouched(plan, names) {
-    if (names.length === 0)
+export function adjustingEnv(plan, adjust) {
+    const extra = Object.values(adjust.extraEnv ?? {}).some((v) => (v?.length ?? 0) > 0);
+    if ((adjust.leaveUntouched?.length ?? 0) === 0 && !extra)
         return plan;
-    const env = planEnv(plan.install, plan.services, names);
+    const env = planEnv(plan.install, plan.services, adjust);
     if (!env.ok)
         return plan;
     return {
@@ -105,10 +132,9 @@ export function reportPlan(plan, reporter) {
         reporter.warn(w);
     for (const s of plan.services) {
         for (const c of s.volumeChanges)
-            reporter.info(`${s.slug} media: ${c}`);
-        for (const f of s.resourceFlags) {
-            reporter.info(`${s.slug} resources: ${s.liveMemory ?? "(default)"} → ${f}`);
-        }
+            reporter.info(`${s.slug} volumes: ${c}`);
+        for (const c of s.resourceChanges)
+            reporter.info(`${s.slug} resources: ${c}`);
         for (const c of s.envChanges) {
             reporter.info(`${s.slug} env ${c.name}: ${c.from === undefined ? "(unset)" : c.from} → ${c.to === undefined ? "(removed)" : c.to}`);
         }
@@ -119,10 +145,13 @@ export async function executeAppRoll(input, hooks, deps) {
     const { reporter: r, run } = deps;
     const { install } = input.plan;
     let plan = input.plan;
+    /** Set by {@link rollBack}: null until one ran with services to restore. */
+    let rollbackOk = null;
     const fail = (phase, migrated) => ({
         ok: false,
         phase,
         migrated,
+        rolledBack: rollbackOk === true,
     });
     // A probe that cannot reach the install now would only fail after the
     // migrations, and roll a healthy release back.
@@ -157,20 +186,35 @@ export async function executeAppRoll(input, hooks, deps) {
         const converged = await hooks.afterMigrations();
         if (!converged.ok)
             return fail("converge", true);
-        plan = leavingEnvUntouched(plan, converged.leaveUntouched);
+        plan = adjustingEnv(plan, {
+            leaveUntouched: converged.leaveUntouched,
+            ...(converged.extraEnv ? { extraEnv: converged.extraEnv } : {}),
+        });
     }
     const rolled = [];
+    /** The audit job's image before this roll moved it (#875); null = not moved. */
+    let auditJobPriorImage = null;
     const rollBack = async (alsoCurrent) => {
+        if (auditJobPriorImage) {
+            const back = await setAuditJobImage(run, install, auditJobPriorImage);
+            if (back.ok)
+                r.info(`  audit job image restored to ${auditJobPriorImage.slice(-19)}`);
+            else
+                r.error(`  audit job rollback FAILED (${back.error}) — set its image to ${auditJobPriorImage} by hand`);
+        }
         const services = alsoCurrent ? [...rolled, alsoCurrent] : rolled;
         if (services.length === 0)
             return;
         r.warn(`Rolling back ${services.length} service(s) to the revisions that served before...`);
+        rollbackOk = true;
         for (const p of [...services].reverse()) {
             const ok = await pinTraffic(run, install.projectId, install.region, p.serviceName, p.priorRevision);
             if (ok)
                 r.info(`  ${p.slug} traffic restored to ${p.priorRevision}`);
-            else
+            else {
+                rollbackOk = false;
                 r.error(`  ${p.slug} rollback FAILED — pin ${p.priorRevision} by hand`);
+            }
             await hooks.afterRollback?.(p.slug);
         }
     };
@@ -232,6 +276,31 @@ export async function executeAppRoll(input, hooks, deps) {
         s.done(`${p.slug} rolled to ${p.digest.slice(0, 19)}...`);
         rolled.push(p);
     }
+    // #875 — the audit job runs the admin's image; it follows the admin. A
+    // failure here does not undo the release: audits then fail loudly with
+    // the version mismatch and the fix, until the next upgrade moves it.
+    const sAudit = r.step("Moving the quality-audit job onto the admin's image...");
+    const described = await describeAuditJobImage(run, install);
+    const auditPrior = described.ok ? described.image : null;
+    if (!described.ok) {
+        sAudit.warned(`Could not read the quality-audit job (${described.error}); Stage audits fail until the next upgrade moves it.`);
+    }
+    else if (!auditPrior) {
+        sAudit.warned("The install has no quality-audit job yet; Stage audits fail until `cms-provision upgrade` sets it up.");
+    }
+    else if (auditPrior === admin.imageRef) {
+        sAudit.done("Quality-audit job already on the admin's image");
+    }
+    else {
+        const moved = await setAuditJobImage(run, install, admin.imageRef);
+        if (moved.ok) {
+            auditJobPriorImage = auditPrior;
+            sAudit.done(`Quality-audit job on ${admin.digest.slice(0, 19)}...`);
+        }
+        else {
+            sAudit.warned(`Quality-audit job not moved (${moved.error}); Stage audits fail until the next upgrade moves it.`);
+        }
+    }
     if (deps.health) {
         const s = r.step("Deep health check (database, migrations, version)...");
         // A probe that throws is a failed check: roll back, never leave the

package/dist/upgrade/app-roll.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-roll.js","sourceRoot":"","sources":["../../src/upgrade/app-roll.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA2BnC,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAKL,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAkB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAMzB,gFAAgF;AAChF,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AA0DpE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAuB,EACvB,MAAgD,EAChD,GAAiB;IAEjB,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,GAAG,EACH,aAAa,EACb,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,CACf,CAAC;QACF,IAAI,CAAC,WAAW;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,MAAM,qBAAqB,EAAE,CAAC;QACjF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAC7C,GAAG,EACH,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,iCAAiC,IAAI,8BAA8B;aAC3E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,sBAAsB,IAAI,6CAA6C;aAC/E,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,WAAW;YACX,GAAG,MAAM,CAAC,IAAI,CAAC;YACf,aAAa;YACb,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC/B,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC;YACrC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,EAAE;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3F,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAgB,CAAC;IACtE,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CACjD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAY,EAAE;QACzC,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACpF,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK;YACpC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;YACxC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAClD,aAAa,EAAE,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;SACvD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,OAAO,CACd,OAAuB,EACvB,QAAgC,EAChC,cAAiC;IAEjC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC7C,CAAC;IACvC,OAAO,eAAe,CACpB;QACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,EACD,QAAQ,EACR,EAAE,cAAc,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB,EAAE,KAAwB;IAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC;YACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK;YACpC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;SACzC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,IAAiB,EAAE,QAAyB;IACrE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,UAAU,IAAI,WAAW,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACrH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AA6DD,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAmB,EACnB,KAAmB,EACnB,IAAiB;IAEjB,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,KAAmB,EAAE,QAAiB,EAAiB,EAAE,CAAC,CAAC;QACvE,EAAE,EAAE,KAAK;QACT,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,sEAAsE;IACtE,+CAA+C;IAC/C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;YAC/D,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,yCAAyC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC,CAAC,IAAI,CACJ,mJAAmJ,CACpJ,CAAC;YACF,OAAO,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IAC9F,CAAC;IAED,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAa,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,SAAS,sBAAsB,CAAC,CAAC;QAChF,CAAC,CAAC,IAAI,CACJ,2KAA2K,OAAO,CAAC,SAAS,gBAAgB,WAAW,CAAC,KAAK,EAAE,6CAA6C,CAAC,EAAE,CAChR,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAEhC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAsB,EAAiB,EAAE;QAC/D,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClC,CAAC,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,MAAM,oDAAoD,CAAC,CAAC;QAC5F,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,MAAM,UAAU,CACzB,GAAG,EACH,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,aAAa,CAChB,CAAC;YACF,IAAI,EAAE;gBAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;;gBAChE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC,aAAa,UAAU,CAAC,CAAC;YAC7E,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,eAAe,CAAC;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,cAAc,EACZ,CAAC,CAAC,IAAI,KAAK,OAAO;gBAChB,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC;gBACxD,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC;YAChE,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,EACF,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACtD,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzC,oEAAoE;YACpE,6DAA6D;YAC7D,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,uBAAuB;QACvB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;YACrB,KAAK;YACL,UAAU;YACV,gBAAgB;YAChB,CAAC,CAAC,WAAW;YACb,UAAU;YACV,OAAO,CAAC,MAAM;YACd,WAAW;YACX,OAAO,CAAC,SAAS;YACjB,aAAa;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,kCAAkC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACnF,CAAC,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;YAC3E,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACzE,oEAAoE;QACpE,oCAAoC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;YAC3F,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,6BAA6B,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACpD,MAAM,QAAQ,EAAE,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,+DAA+D,CAAC,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAiB;QAC5B,KAAK,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAc,CAAC,MAAM;QACzE,OAAO,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAc,CAAC,MAAM;KAC9E,CAAC;IACF,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAmB,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,8IAA8I,KAAK,CAAC,MAAM,CAAC,QAAQ,4CAA4C,GAAG,EAAE,CAAC;IAC9N,CAAC;IACD,OAAO,uBAAuB,KAAK,CAAC,MAAM,CAAC,QAAQ,qBAAqB,IAAI,4CAA4C,GAAG,EAAE,CAAC;AAChI,CAAC"}
+{"version":3,"file":"app-roll.js","sourceRoot":"","sources":["../../src/upgrade/app-roll.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA2BnC,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EACL,gBAAgB,EAEhB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAkB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAMzB,gFAAgF;AAChF,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAoEpE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAuB,EACvB,MAAgD,EAChD,GAAiB;IAEjB,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,GAAG,EACH,aAAa,EACb,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,CACf,CAAC;QACF,IAAI,CAAC,WAAW;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,MAAM,qBAAqB,EAAE,CAAC;QACjF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAC7C,GAAG,EACH,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,iCAAiC,IAAI,8BAA8B;aAC3E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,sBAAsB,IAAI,6CAA6C;aAC/E,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,WAAW;YACX,GAAG,MAAM,CAAC,IAAI,CAAC;YACf,aAAa;YACb,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC/B,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC;YACrC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC;YAC9B,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,EAAE;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3F,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAgB,CAAC;IACtE,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CACjD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAC1F,qEAAqE;IACrE,wEAAwE;IACxE,wCAAwC;IACxC,MAAM,WAAW,GAAG,EAA8D,CAAC;IACnF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,qCAAqC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/F,CAAC;QACD,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAY,EAAE;QACzC,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACpF,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,OAAO,GACX,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,MAAM,WAAW,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK;YACpC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;YACxC,aAAa,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,YAAY,CAAC;YAChD,eAAe,EAAE;gBACf,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,WAAW,MAAM,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC;YACD,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;YACvF,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;SAC9F,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;AACpE,CAAC;AAaD,SAAS,OAAO,CACd,OAAuB,EACvB,QAAgC,EAChC,MAAsB;IAEtB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC7C,CAAC;IACvC,OAAO,eAAe,CACpB;QACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,EACD,QAAQ,EACR;QACE,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;QAC3C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAiB,EAAE,MAAsB;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC;YACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK;YACpC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;SACzC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,IAAiB,EAAE,QAAyB;IACrE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACrH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAwED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAmB,EACnB,KAAmB,EACnB,IAAiB;IAEjB,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACtB,4EAA4E;IAC5E,IAAI,UAAU,GAAmB,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,KAAmB,EAAE,QAAiB,EAAiB,EAAE,CAAC,CAAC;QACvE,EAAE,EAAE,KAAK;QACT,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,UAAU,KAAK,IAAI;KAChC,CAAC,CAAC;IAEH,sEAAsE;IACtE,+CAA+C;IAC/C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;YAC/D,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,yCAAyC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC,CAAC,IAAI,CACJ,mJAAmJ,CACpJ,CAAC;YACF,OAAO,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IAC9F,CAAC;IAED,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAa,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,SAAS,sBAAsB,CAAC,CAAC;QAChF,CAAC,CAAC,IAAI,CACJ,2KAA2K,OAAO,CAAC,SAAS,gBAAgB,WAAW,CAAC,KAAK,EAAE,6CAA6C,CAAC,EAAE,CAChR,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAEhC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE;YACxB,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,gFAAgF;IAChF,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAsB,EAAiB,EAAE;QAC/D,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;YACtE,IAAI,IAAI,CAAC,EAAE;gBAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;;gBAEpF,CAAC,CAAC,KAAK,CACL,gCAAgC,IAAI,CAAC,KAAK,wBAAwB,kBAAkB,UAAU,CAC/F,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClC,CAAC,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,MAAM,oDAAoD,CAAC,CAAC;QAC5F,UAAU,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,MAAM,UAAU,CACzB,GAAG,EACH,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,aAAa,CAChB,CAAC;YACF,IAAI,EAAE;gBAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;iBAChE,CAAC;gBACJ,UAAU,GAAG,KAAK,CAAC;gBACnB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC,aAAa,UAAU,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,eAAe,CAAC;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,cAAc,EACZ,CAAC,CAAC,IAAI,KAAK,OAAO;gBAChB,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC;gBACxD,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC;YAChE,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,EACF,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACtD,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzC,oEAAoE;YACpE,6DAA6D;YAC7D,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,uBAAuB;QACvB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;YACrB,KAAK;YACL,UAAU;YACV,gBAAgB;YAChB,CAAC,CAAC,WAAW;YACb,UAAU;YACV,OAAO,CAAC,MAAM;YACd,WAAW;YACX,OAAO,CAAC,SAAS;YACjB,aAAa;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,kCAAkC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACnF,CAAC,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;YAC3E,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,CAAC,MAAM,CACX,yCAAyC,SAAS,CAAC,KAAK,uDAAuD,CAChH,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,CAAC,MAAM,CACX,uGAAuG,CACxG,CAAC;IACJ,CAAC;SAAM,IAAI,UAAU,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,kBAAkB,GAAG,UAAU,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CACX,gCAAgC,KAAK,CAAC,KAAK,uDAAuD,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACzE,oEAAoE;QACpE,oCAAoC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;YAC3F,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,6BAA6B,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACpD,MAAM,QAAQ,EAAE,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,+DAA+D,CAAC,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAiB;QAC5B,KAAK,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAc,CAAC,MAAM;QACzE,OAAO,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAc,CAAC,MAAM;KAC9E,CAAC;IACF,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAmB,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,8IAA8I,KAAK,CAAC,MAAM,CAAC,QAAQ,4CAA4C,GAAG,EAAE,CAAC;IAC9N,CAAC;IACD,OAAO,uBAAuB,KAAK,CAAC,MAAM,CAAC,QAAQ,qBAAqB,IAAI,4CAA4C,GAAG,EAAE,CAAC;AAChI,CAAC"}

package/dist/upgrade/audit-job-roll.d.ts

@@ -0,0 +1,38 @@
+/**
+ * #875 — the quality-audit job runs the admin image (admin-core
+ * quality/audit-task.ts) and refuses a batch from an admin on another
+ * version. So every app-roll moves the job onto the admin's new image right
+ * after the services rolled, and a rollback moves it back.
+ *
+ * `run jobs update --image` changes nothing else of the job (identity, env,
+ * parallelism), so this stays inside the app-roll's rights: the upgrader's
+ * `roles/run.developer` plus actAs on the job's service account
+ * (upgrader-setup.ts).
+ */
+import type { GcloudRunner } from "../gcloud-retry.js";
+/**
+ * The job's image now; `image: null` only when the install has no audit job
+ * yet. Any other gcloud failure (permissions, API, network) is an error, not
+ * "no job", so the app-roll reports it instead of a misleading hint.
+ */
+export declare function describeAuditJobImage(run: GcloudRunner, install: {
+    readonly projectId: string;
+    readonly region: string;
+    readonly env: string;
+}): Promise<{
+    readonly ok: true;
+    readonly image: string | null;
+} | {
+    readonly ok: false;
+    readonly error: string;
+}>;
+/** Point the audit job at `imageRef`. */
+export declare function setAuditJobImage(run: GcloudRunner, install: {
+    readonly projectId: string;
+    readonly region: string;
+    readonly env: string;
+}, imageRef: string): Promise<{
+    readonly ok: boolean;
+    readonly error?: string;
+}>;
+//# sourceMappingURL=audit-job-roll.d.ts.map

package/dist/upgrade/audit-job-roll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-job-roll.d.ts","sourceRoot":"","sources":["../../src/upgrade/audit-job-roll.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrF,OAAO,CACN;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CACjD,CAoBA;AAED,yCAAyC;AACzC,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACtF,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAY5D"}

package/dist/upgrade/audit-job-roll.js

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: MPL-2.0
+import { auditJobName } from "../gcp-names.js";
+/**
+ * The job's image now; `image: null` only when the install has no audit job
+ * yet. Any other gcloud failure (permissions, API, network) is an error, not
+ * "no job", so the app-roll reports it instead of a misleading hint.
+ */
+export async function describeAuditJobImage(run, install) {
+    const r = await run([
+        "run",
+        "jobs",
+        "describe",
+        auditJobName(install.env),
+        `--region=${install.region}`,
+        `--project=${install.projectId}`,
+        "--format=value(spec.template.spec.template.spec.containers[0].image)",
+    ]);
+    if (!r.ok) {
+        return /NOT_FOUND|not found|could not be found/i.test(r.stderr)
+            ? { ok: true, image: null }
+            : { ok: false, error: r.stderr.trim() };
+    }
+    const image = r.stdout.trim();
+    if (image.length === 0) {
+        return { ok: false, error: "the job's description names no container image" };
+    }
+    return { ok: true, image };
+}
+/** Point the audit job at `imageRef`. */
+export async function setAuditJobImage(run, install, imageRef) {
+    const r = await run([
+        "run",
+        "jobs",
+        "update",
+        auditJobName(install.env),
+        `--image=${imageRef}`,
+        `--region=${install.region}`,
+        `--project=${install.projectId}`,
+        "--quiet",
+    ]);
+    return r.ok ? { ok: true } : { ok: false, error: r.stderr.trim() };
+}
+//# sourceMappingURL=audit-job-roll.js.map

package/dist/upgrade/audit-job-roll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-job-roll.js","sourceRoot":"","sources":["../../src/upgrade/audit-job-roll.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAiB,EACjB,OAAsF;IAKtF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,MAAM;QACN,UAAU;QACV,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;QACzB,YAAY,OAAO,CAAC,MAAM,EAAE;QAC5B,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,sEAAsE;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO,yCAAyC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7D,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;YAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAiB,EACjB,OAAsF,EACtF,QAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;QACzB,WAAW,QAAQ,EAAE;QACrB,YAAY,OAAO,CAAC,MAAM,EAAE;QAC5B,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC"}

package/dist/upgrade/converge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge.d.ts","sourceRoot":"","sources":["../../src/upgrade/converge.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAI3D,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,uBAAuB,CAAC;AAc/B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAsB,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,sBAAsB,CAAC,EACtD,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,2EAA2E;IAC3E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC;CACrB;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,GACjB,eAAe,CAqWjB"}
+{"version":3,"file":"converge.d.ts","sourceRoot":"","sources":["../../src/upgrade/converge.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAK3D,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,uBAAuB,CAAC;AAmB/B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAsB,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,sBAAsB,CAAC,EACtD,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,2EAA2E;IAC3E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC;CACrB;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,GACjB,eAAe,CA4fjB"}

package/dist/upgrade/converge.js

@@ -6,30 +6,37 @@
  * CLI-generated runtime secrets, the stack's IAM/CDN/firewall invariants,
  * MCP access through IAP, public_role's Cloud SQL role memberships (#633),
  * the gateway's and public_role's database logins, the operator-access sync
- * job, and dropping bindings nothing reads any more.
+ * job, the quality-audit job (#875), the remote-MCP load-balancer rules and
+ * identity env (#806), and dropping bindings nothing reads any more.
  *
- * It needs the rights of whoever provisioned the install, so only
- * `cms-provision upgrade` (the operator's own identity) runs it — never the
- * in-cloud upgrader job, which only app-rolls and refuses while
- * {@link needsConverge} says the install is behind.
+ * It needs the rights of whoever provisioned the install: `cms-provision
+ * upgrade` runs it as the operator's own identity, and the converge job
+ * (#819, converge-job.ts) runs the same upgrade as the install's
+ * `caelo-provisioner` account. Never the in-cloud upgrader job, which only
+ * app-rolls and refuses while {@link needsConverge} says the install is
+ * behind.
  *
  * The keyless-provisioner step (#696, provisioner-identity.ts) is converge
  * too; it needs the operator's local install dir, so the CLI injects it as
- * {@link ConvergeDeps.provisionerIdentity}.
+ * {@link ConvergeDeps.provisionerIdentity} (the converge job, which IS the
+ * provisioner, has nothing to move and passes none).
  *
  * Some steps must sit between app-roll steps (a role migration 0248 creates
  * gets its password after migrations, before the gateway rolls onto it), so
  * a converge is a {@link ConvergeSession}: a part before the app-roll, the
  * {@link AppRollHooks} the app-roll calls in between, and a part after it.
  */
+import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
+import { ensureConvergeJob } from "../converge-job-setup.js";
 import { findSqlInstance, planPublicRoleSwitch } from "../gateway-credentials.js";
 import { upgraderServiceAccountEmail } from "../gcp-names.js";
 import { ensureMcpIapAccess } from "../mcp-iap.js";
 import { ensureOperatorAccessSync, resolveOperatorAccessTarget } from "../operator-access.js";
 import { revokePublicRoleMemberships } from "../public-role-isolation.js";
+import { ensureRemoteMcpEdge, resolveRemoteMcpIdentity } from "../remote-mcp.js";
 import { ensureGatewayServiceAccount, ensureGeneratedSecrets, plainGeneratedSecretSeed, readSecretReplication, } from "../runtime-secrets.js";
 import { selfCommand } from "../self-command.js";
-import { MCP_ENV_VAR, OPERATOR_ACCESS_JOB_ENV_VAR, UPGRADER_JOB_ENV_VAR, } from "../stack-contract.js";
+import { AUDIT_JOB_ENV_VAR, AUDIT_RESULTS_BUCKET_ENV_VAR, CONVERGE_JOB_ENV_VAR, MCP_ENV_VAR, OPERATOR_ACCESS_JOB_ENV_VAR, remoteMcpIdentityEnv, UPGRADER_JOB_ENV_VAR, } from "../stack-contract.js";
 import { ensureStackInvariants, liveEnvHasInlinePassword, removeRetiredIamBindings, } from "../stack-converge.js";
 import { ensureUpgraderJob, resolveUpgraderTarget } from "../upgrader-setup.js";
 import { ensureUrlMapRedirectsAccess } from "../url-map-redirects-access.js";
@@ -190,6 +197,83 @@ export function startConverge(plan, ownerEmail, deps) {
         r.warn("The upgrade continues; Confirm-publish fails with a permission error until this succeeds. Re-run upgrade with an account that may manage IAM roles.");
         incomplete = true;
     }
+    async function auditJob() {
+        // #875 — the job the quality audit fans its Lighthouse runs out to.
+        // Deployed with the admin's CURRENT image (the admin still runs it until
+        // the app-roll moves both together, and the job refuses a batch from
+        // another version). A failure only costs Stage audits, so it warns and
+        // the admin keeps its current env.
+        const s = r.step("Ensuring the quality-audit job (parallel Lighthouse runs)...");
+        const image = await resolveAdminImage({ projectId: install.projectId, region: install.region, env: install.env }, { run });
+        const aj = image.ok
+            ? await ensureAuditJob({
+                provider: install.provider,
+                projectId: install.projectId,
+                region: install.region,
+                env: install.env,
+                adminImageRef: image.imageRef,
+            }, runDeps)
+            : { ok: false, done: [], error: image.error };
+        for (const step of aj.done)
+            r.info(`  ${step}`);
+        if (aj.ok) {
+            s.done("Quality-audit job ready (Stage audits run in parallel)");
+            return;
+        }
+        s.warned(`Quality-audit job not set up: ${aj.error}`);
+        r.warn("The upgrade continues; Stage audits fail with the missing job until this succeeds. Re-run upgrade once the cause is fixed.");
+        incomplete = true;
+        leaveUntouched.push(AUDIT_JOB_ENV_VAR, AUDIT_RESULTS_BUCKET_ENV_VAR);
+    }
+    async function remoteMcpEdge() {
+        // #806 — on `gcp` the load balancer routes the remote-MCP discovery
+        // paths to the gateway and Cloud Armor lets agent traffic through on
+        // /api/mcp/* (remote-mcp-edge.ts). Only remote MCP depends on it, so a
+        // failure warns.
+        if (install.provider !== "gcp")
+            return;
+        const s = r.step("Ensuring the load balancer's remote-MCP routes and Cloud Armor rule...");
+        const edge = await ensureRemoteMcpEdge({
+            provider: install.provider,
+            projectId: install.projectId,
+            env: install.env,
+            domain: install.domain,
+        }, { ...runDeps, ...(deps.http ? { http: deps.http } : {}) });
+        if (edge.ok) {
+            for (const line of edge.done)
+                r.info(`  ${line}`);
+            s.done("Remote-MCP load-balancer rules ready");
+            return;
+        }
+        s.warned(`Remote-MCP load-balancer rules not set up: ${edge.error}`);
+        r.warn("The upgrade continues; remote MCP (Settings → MCP → Remote) cannot be reached through the site's domain until this succeeds. Re-run upgrade once the cause is fixed.");
+        incomplete = true;
+    }
+    async function remoteMcpIdentity() {
+        // #806 — CAELO_ADMIN_URL / CAELO_MCP_PUBLIC_URL / CAELO_IAP_AUDIENCE
+        // name identities the env contract cannot (stack-contract.ts
+        // RemoteMcpIdentity). Resolved here, read-only, and set by the rolls
+        // (AppRollHooks.afterMigrations `extraEnv`), so they ride the new
+        // revisions. A failure leaves the vars as the services have them and
+        // warns: only remote MCP depends on them.
+        const s = r.step("Resolving the remote-MCP URLs and IAP audience...");
+        const resolved = await resolveRemoteMcpIdentity({
+            provider: install.provider,
+            projectId: install.projectId,
+            region: install.region,
+            env: install.env,
+            domain: install.domain,
+            services,
+        }, runDeps);
+        if (resolved.ok) {
+            s.done(`Remote MCP can be set up under Settings → MCP (${resolved.identity.mcpPublicUrl})`);
+            return remoteMcpIdentityEnv(resolved.identity);
+        }
+        s.warned(`Remote-MCP env not resolved: ${resolved.error}`);
+        r.warn("The upgrade continues; Settings → MCP reports remote MCP as not prepared on this install until this succeeds. Re-run upgrade once the cause is fixed.");
+        incomplete = true;
+        return null;
+    }
     /** The admin's IAP resource: the service on gcp-firebase, the LB backend on gcp. */
     async function adminIapResource() {
         if (install.provider === "gcp-firebase") {
@@ -268,6 +352,47 @@ export function startConverge(plan, ownerEmail, deps) {
         incomplete = true;
         leaveUntouched.push(UPGRADER_JOB_ENV_VAR);
     }
+    async function convergeJob() {
+        // #819 — the job "Install update" starts for the next release that
+        // changes the cloud setup, on this release's ops image. After
+        // migrations: its database login gets the role migration 0267 creates.
+        // A failure only costs in-Caelo converges (the terminal path stays), so
+        // it warns.
+        const s = r.step("Ensuring the converge job (cloud-setup updates from Settings → Updates)...");
+        const resolved = deps.opsImageRef
+            ? await resolveUpgraderTarget({
+                projectId: install.projectId,
+                region: install.region,
+                env: install.env,
+                opsImageRef: deps.opsImageRef,
+            }, { run })
+            : { ok: false, error: "the release's caelo-ops image could not be resolved" };
+        const cj = resolved.ok
+            ? await ensureConvergeJob(resolved.target, runDeps)
+            : { ok: false, done: [], error: resolved.error };
+        for (const step of cj.done)
+            r.info(`  ${step}`);
+        if (cj.ok) {
+            s.done("Converge job ready (updates that change the cloud setup install from the admin)");
+            return;
+        }
+        if (cj.reason === "no-provisioner") {
+            // #883 review — optional for contract 9: an install without a
+            // provisioner (installed before it existed) has nothing the job could
+            // run as, and creating one is a privileged identity no update should
+            // mint. It stays fully converged; its admin keeps no
+            // CAELO_CONVERGE_JOB and so routes cloud-setup releases to the
+            // terminal, saying so on Settings → Updates.
+            s.done("No converge job: this install has no caelo-provisioner to run it as");
+            r.info("Updates that change the cloud setup keep installing from Cloud Shell or the computer you installed from; Settings → Updates says so when one comes.");
+            leaveUntouched.push(CONVERGE_JOB_ENV_VAR);
+            return;
+        }
+        s.warned(`Converge job not set up: ${cj.error}`);
+        r.warn("The upgrade continues; releases that change the cloud setup keep installing from a terminal until this succeeds.");
+        incomplete = true;
+        leaveUntouched.push(CONVERGE_JOB_ENV_VAR);
+    }
     async function operatorAccess() {
         // The job that keeps IAP in step with the user list (operator-access.ts).
         // After migrations: its database user gets the role migration 0239
@@ -316,6 +441,8 @@ export function startConverge(plan, ownerEmail, deps) {
                 return false;
             await mcpAccess();
             await urlMapRedirectsAccess();
+            await auditJob();
+            await remoteMcpEdge();
             return true;
         },
         hooks: {
@@ -323,8 +450,14 @@ export function startConverge(plan, ownerEmail, deps) {
                 if (!(await databaseLogins()))
                     return { ok: false };
                 await upgraderJob();
+                await convergeJob();
                 await operatorAccess();
-                return { ok: true, leaveUntouched: [...leaveUntouched] };
+                const extraEnv = await remoteMcpIdentity();
+                return {
+                    ok: true,
+                    leaveUntouched: [...leaveUntouched],
+                    ...(extraEnv ? { extraEnv } : {}),
+                };
             },
             async beforeRoll(slug) {
                 if (slug !== "gateway" || !publicRole)