@caelo-cms/provisioning 0.10.53 → 0.10.57

package/dist/upgrader-assess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrader-assess.d.ts","sourceRoot":"","sources":["../src/upgrader-assess.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAG/B,gFAAgF;AAChF,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,WAAW,GACX,qBAAqB,GACrB,yBAAyB,GACzB,WAAW,GACX,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,QAAQ,CAAC;AAEb,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;CACrC,CAAC;AAEN,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,CAAC;AAsBzD,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;QACxC,uEAAuE;QACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACzC,GAAG,eAAe,CAkHlB"}
+{"version":3,"file":"upgrader-assess.d.ts","sourceRoot":"","sources":["../src/upgrader-assess.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EAExB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAG/B,gFAAgF;AAChF,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,kBAAkB,GAClB,WAAW,GACX,qBAAqB,GACrB,yBAAyB,GACzB,WAAW,GACX,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,QAAQ,CAAC;AAEb,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,+EAA+E;IAC/E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,GAAG,QAAQ,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;CACrC,CAAC;AAEN,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,QAAQ,CAAC;AAsBzD,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;QACxC,uEAAuE;QACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;CAC1C,GAAG,eAAe,CAoJlB"}

package/dist/upgrader-assess.js

@@ -26,6 +26,8 @@
  * | target not newer than installed (downgrade/same)    | refused           |
  * | installed below the release's minFromVersion        | refused           |
  * | release raises the infrastructure contract          | needs_cloud_shell |
+ * |   … on the converge route (#819, the converge job)  | proceed           |
+ * |   … converge route, automatic, autoConverge off     | refused           |
  * | contract (destructive) migrations, automatic run    | refused           |
  * | contract migrations, Owner's click                  | proceed + warning |
  * | automatic run the update policy does not allow      | refused           |
@@ -37,6 +39,13 @@
  * that rolls the images. So for them `installed.infraContractVersion` is
  * null and the infra-contract row never applies; every "needs_cloud_shell"
  * stop names the upgrade command on the server instead of Cloud Shell.
+ *
+ * The converge job (#819, converge-job.ts) asks with `route: "converge"`:
+ * it runs as the install's provisioner, so an infrastructure change is what
+ * it is for — every other row still applies. An automatic run on the
+ * converge route needs the Owner's `autoConverge` (#864) on top of
+ * everything an automatic install needs; the scheduler queues one only
+ * then, and the job re-checks it here against the policy it claimed.
  */
 import { autoInstallRefusal, updateKind, } from "@caelo-cms/shared";
 import { infraStepsText } from "./infra-contract.js";
@@ -64,7 +73,13 @@ export function assessUpgradeRequest(input) {
         const e = input.manifest.error;
         switch (e.code) {
             case "registry":
-                return stop("failed", "registry", `Could not reach the Caelo release registry to verify v${target} (${e.message}). Nothing was changed; try again later.`);
+                // Only an outage is worth retrying: a manifest the registry says
+                // does not exist (404 / other 4xx) never appears, so retrying would
+                // loop on "try again later" forever.
+                if (e.transient) {
+                    return stop("failed", "registry", `Could not reach the Caelo release registry to verify v${target} (${e.message}). Nothing was changed; try again later.`);
+                }
+                return stop("refused", "manifest-missing", `v${target} has no signed release manifest in the Caelo release registry, so it cannot be verified and will not be installed. Nothing was changed; retrying will not help. (${e.message})`);
             case "schema":
                 return stop("needs_cloud_shell", "manifest-unreadable", `This upgrader is too old to read the release information of v${target}. Install it once ${by}; afterwards the admin can install updates again. (${e.message})`);
             default:
@@ -75,7 +90,13 @@ export function assessUpgradeRequest(input) {
     if (installed.version === null) {
         return stop("needs_cloud_shell", "install-version-unknown", `This install has not recorded which Caelo release it runs yet. Upgrade it once ${by}; that records it, and the admin can install updates from then on.`, manifest);
     }
-    if (compareSemver(target, installed.version) <= 0) {
+    const order = compareSemver(target, installed.version);
+    if (order === 0) {
+        // Reached after a run that rolled but could not record it (#860): the
+        // next run re-records the serving release, which then is the target.
+        return stop("refused", "not-newer", `v${target} already serves on this install, so there is nothing to install. Nothing was changed.`, manifest);
+    }
+    if (order < 0) {
         return stop("refused", "not-newer", `v${target} is not newer than the installed v${installed.version}; Caelo never installs an older release over a newer one.`, manifest);
     }
     if (compareSemver(installed.version, manifest.minFromVersion) < 0) {
@@ -83,13 +104,22 @@ export function assessUpgradeRequest(input) {
     }
     // Self-hosted: the target's own CLI renders the host setup in this run.
     const infraContractVersion = installed.infraContractVersion ?? manifest.infraContractVersion;
-    if (installed.infraContractVersion !== null &&
-        needsConverge({ infraContractVersion }, manifest.infraContractVersion)) {
-        return stop("needs_cloud_shell", "infra-contract", `v${target} changes this install's cloud setup (infrastructure contract ${infraContractVersion} → ${manifest.infraContractVersion}: ${infraStepsText(infraContractVersion, manifest.infraContractVersion)}). The admin may not change cloud permissions, so this release is installed once with your own Google account in Cloud Shell.`, manifest);
+    const converge = input.route === "converge";
+    const infraChange = installed.infraContractVersion !== null &&
+        needsConverge({ infraContractVersion }, manifest.infraContractVersion);
+    if (infraChange && !converge) {
+        return stop("needs_cloud_shell", "infra-contract", `v${target} changes this install's cloud setup (infrastructure contract ${infraContractVersion} → ${manifest.infraContractVersion}: ${infraStepsText(infraContractVersion, manifest.infraContractVersion)}). The upgrader may not change cloud permissions, so Caelo installs this release with its converge job: start it again from Settings → Updates. On an install without the converge job, install it once with your own Google account in Cloud Shell.`, manifest);
+    }
+    if (converge && request.trigger === "auto" && !input.policy.autoConverge) {
+        return stop("refused", "policy", `Not installed automatically: v${target} changes this install's cloud setup, and the update policy does not install those automatically. Install it from Settings → Updates.`, manifest);
     }
+    // On the converge route the contract bump is the job's work, not a
+    // reason for a manual install: only the migrations decide below.
     const assessment = assessAutoInstall(manifest, {
         version: installed.version,
-        infraContractVersion,
+        infraContractVersion: converge
+            ? Math.max(infraContractVersion, manifest.infraContractVersion)
+            : infraContractVersion,
     });
     const destructive = assessment.mode === "manual";
     const warnings = [];

package/dist/upgrader-assess.js.map

@@ -1 +1 @@
-{"version":3,"file":"upgrader-assess.js","sourceRoot":"","sources":["../src/upgrader-assess.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAEL,kBAAkB,EAGlB,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA6CtD,wFAAwF;AACxF,SAAS,SAAS,CAAC,IAAuB;IACxC,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,sEAAsE;QACxE,CAAC,CAAC,kBAAkB,CAAC;AACzB,CAAC;AAED,MAAM,IAAI,GAAG,CACX,MAAkD,EAClD,IAAiB,EACjB,MAAc,EACd,QAA0B,EACT,EAAE,CAAC,CAAC;IACrB,IAAI,EAAE,MAAM;IACZ,MAAM;IACN,KAAK,EAAE,CAAC,IAAI,CAAC;IACb,MAAM;IACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,KAapC;IACC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC/B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,UAAU;gBACb,OAAO,IAAI,CACT,QAAQ,EACR,UAAU,EACV,yDAAyD,MAAM,KAAK,CAAC,CAAC,OAAO,0CAA0C,CACxH,CAAC;YACJ,KAAK,QAAQ;gBACX,OAAO,IAAI,CACT,mBAAmB,EACnB,qBAAqB,EACrB,gEAAgE,MAAM,qBAAqB,EAAE,sDAAsD,CAAC,CAAC,OAAO,GAAG,CAChK,CAAC;YACJ;gBACE,OAAO,IAAI,CACT,SAAS,EACT,WAAW,EACX,+BAA+B,MAAM,8FAA8F,CAAC,CAAC,OAAO,GAAG,CAChJ,CAAC;QACN,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACzC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,mBAAmB,EACnB,yBAAyB,EACzB,kFAAkF,EAAE,oEAAoE,EACxJ,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,IAAI,CACT,SAAS,EACT,WAAW,EACX,IAAI,MAAM,qCAAqC,SAAS,CAAC,OAAO,2DAA2D,EAC3H,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CACT,SAAS,EACT,kBAAkB,EAClB,IAAI,MAAM,gCAAgC,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,cAAc,QAAQ,CAAC,cAAc,SAAS,EACjK,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,MAAM,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,IAAI,QAAQ,CAAC,oBAAoB,CAAC;IAC7F,IACE,SAAS,CAAC,oBAAoB,KAAK,IAAI;QACvC,aAAa,CAAC,EAAE,oBAAoB,EAAE,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EACtE,CAAC;QACD,OAAO,IAAI,CACT,mBAAmB,EACnB,gBAAgB,EAChB,IAAI,MAAM,gEAAgE,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,+HAA+H,EACxU,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,oBAAoB;KACrB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CACT,SAAS,EACT,qBAAqB,EACrB,IAAI,MAAM,+DAA+D,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E,EAClL,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,2EAA2E,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAC9K,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GACX,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,kBAAkB,CAChB,KAAK,CAAC,MAAM,EACZ;gBACE,IAAI;gBACJ,QAAQ,EAAE,UAAU,CAAC,IAAI,KAAK,UAAU;gBACxC,kBAAkB,EAAE,WAAW;gBAC/B,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,SAAS;aAChD,EACD,KAAK,CAAC,GAAG,CACV,CAAC;QACR,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,gCAAgC,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzF,CAAC;QACD,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO,IAAI,CACT,SAAS,EACT,QAAQ,EACR,iCAAiC,MAAM,6IAA6I,EACpL,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC"}
+{"version":3,"file":"upgrader-assess.js","sourceRoot":"","sources":["../src/upgrader-assess.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAEL,kBAAkB,EAGlB,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA8CtD,wFAAwF;AACxF,SAAS,SAAS,CAAC,IAAuB;IACxC,OAAO,IAAI,KAAK,QAAQ;QACtB,CAAC,CAAC,sEAAsE;QACxE,CAAC,CAAC,kBAAkB,CAAC;AACzB,CAAC;AAED,MAAM,IAAI,GAAG,CACX,MAAkD,EAClD,IAAiB,EACjB,MAAc,EACd,QAA0B,EACT,EAAE,CAAC,CAAC;IACrB,IAAI,EAAE,MAAM;IACZ,MAAM;IACN,KAAK,EAAE,CAAC,IAAI,CAAC;IACb,MAAM;IACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,KAkBpC;IACC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC/B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,UAAU;gBACb,iEAAiE;gBACjE,oEAAoE;gBACpE,qCAAqC;gBACrC,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;oBAChB,OAAO,IAAI,CACT,QAAQ,EACR,UAAU,EACV,yDAAyD,MAAM,KAAK,CAAC,CAAC,OAAO,0CAA0C,CACxH,CAAC;gBACJ,CAAC;gBACD,OAAO,IAAI,CACT,SAAS,EACT,kBAAkB,EAClB,IAAI,MAAM,oKAAoK,CAAC,CAAC,OAAO,GAAG,CAC3L,CAAC;YACJ,KAAK,QAAQ;gBACX,OAAO,IAAI,CACT,mBAAmB,EACnB,qBAAqB,EACrB,gEAAgE,MAAM,qBAAqB,EAAE,sDAAsD,CAAC,CAAC,OAAO,GAAG,CAChK,CAAC;YACJ;gBACE,OAAO,IAAI,CACT,SAAS,EACT,WAAW,EACX,+BAA+B,MAAM,8FAA8F,CAAC,CAAC,OAAO,GAAG,CAChJ,CAAC;QACN,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACzC,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CACT,mBAAmB,EACnB,yBAAyB,EACzB,kFAAkF,EAAE,oEAAoE,EACxJ,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAChB,sEAAsE;QACtE,qEAAqE;QACrE,OAAO,IAAI,CACT,SAAS,EACT,WAAW,EACX,IAAI,MAAM,uFAAuF,EACjG,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,OAAO,IAAI,CACT,SAAS,EACT,WAAW,EACX,IAAI,MAAM,qCAAqC,SAAS,CAAC,OAAO,2DAA2D,EAC3H,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CACT,SAAS,EACT,kBAAkB,EAClB,IAAI,MAAM,gCAAgC,QAAQ,CAAC,cAAc,iCAAiC,SAAS,CAAC,OAAO,cAAc,QAAQ,CAAC,cAAc,SAAS,EACjK,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,MAAM,oBAAoB,GAAG,SAAS,CAAC,oBAAoB,IAAI,QAAQ,CAAC,oBAAoB,CAAC;IAC7F,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC;IAC5C,MAAM,WAAW,GACf,SAAS,CAAC,oBAAoB,KAAK,IAAI;QACvC,aAAa,CAAC,EAAE,oBAAoB,EAAE,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IACzE,IAAI,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CACT,mBAAmB,EACnB,gBAAgB,EAChB,IAAI,MAAM,gEAAgE,oBAAoB,MAAM,QAAQ,CAAC,oBAAoB,KAAK,cAAc,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC,sPAAsP,EAC/b,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzE,OAAO,IAAI,CACT,SAAS,EACT,QAAQ,EACR,iCAAiC,MAAM,sIAAsI,EAC7K,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,oBAAoB,EAAE,QAAQ;YAC5B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;YAC/D,CAAC,CAAC,oBAAoB;KACzB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,IAAI,CACT,SAAS,EACT,qBAAqB,EACrB,IAAI,MAAM,+DAA+D,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E,EAClL,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,2EAA2E,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE,CAC9K,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,OAAO,GACX,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,kBAAkB,CAChB,KAAK,CAAC,MAAM,EACZ;gBACE,IAAI;gBACJ,QAAQ,EAAE,UAAU,CAAC,IAAI,KAAK,UAAU;gBACxC,kBAAkB,EAAE,WAAW;gBAC/B,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,SAAS;aAChD,EACD,KAAK,CAAC,GAAG,CACV,CAAC;QACR,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,gCAAgC,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;QACzF,CAAC;QACD,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO,IAAI,CACT,SAAS,EACT,QAAQ,EACR,iCAAiC,MAAM,6IAA6I,EACpL,QAAQ,CACT,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC"}

package/dist/upgrader-gcp.d.ts

@@ -1,4 +1,6 @@
 import { type GcloudRunner } from "./gcloud-retry.js";
+import type { HttpFetch } from "./runtime-secrets.js";
+import type { AppRollPlan } from "./upgrade/app-roll.js";
 import type { UpdateQueue, UpgraderJobDeps } from "./upgrader-job.js";
 import type { JobLog } from "./upgrader-reporter.js";
 /** Where the job runs, from the metadata server. */
@@ -12,6 +14,19 @@ export interface UpgraderPlacement {
  * too (as its own IAM database user). Read from the deployed admin service.
  */
 export declare function upgraderDatabaseHost(placement: Pick<UpgraderPlacement, "projectId" | "region">, run?: GcloudRunner): Promise<string>;
+/**
+ * The IAP-backed deep health probe for `plan`'s install (the upgrader job;
+ * the converge job, #819, too).
+ */
+export declare function healthProbeFor(run: GcloudRunner, http: HttpFetch, plan: AppRollPlan): Promise<{
+    ok: false;
+    error: string;
+    probe?: undefined;
+} | {
+    ok: true;
+    probe: import("./upgrade/health.js").HealthProbe;
+    error?: undefined;
+}>;
 /** Every dependency of {@link runUpgraderJob} except the database and the log. */
 export declare function gcpUpgraderDeps(placement: UpgraderPlacement, queue: UpdateQueue, log: JobLog): UpgraderJobDeps;
 //# sourceMappingURL=upgrader-gcp.d.ts.map

package/dist/upgrader-gcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrader-gcp.d.ts","sourceRoot":"","sources":["../src/upgrader-gcp.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,KAAK,YAAY,EAAa,MAAM,mBAAmB,CAAC;AAWjE,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,QAAQ,CAAC,EAC1D,GAAG,GAAE,YAAqB,GACzB,OAAO,CAAC,MAAM,CAAC,CAQjB;AA4BD,kFAAkF;AAClF,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,MAAM,GACV,eAAe,CAkCjB"}
+{"version":3,"file":"upgrader-gcp.d.ts","sourceRoot":"","sources":["../src/upgrader-gcp.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,KAAK,YAAY,EAAa,MAAM,mBAAmB,CAAC;AAKjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIzD,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAGrD,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,GAAG,QAAQ,CAAC,EAC1D,GAAG,GAAE,YAAqB,GACzB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW;;;;;;;;GAuBzF;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,MAAM,GACV,eAAe,CAoEjB"}

package/dist/upgrader-gcp.js

@@ -2,8 +2,8 @@
 /**
  * The real side effects of the upgrader job on Google Cloud (epic #696):
  * gcloud as the job's own service account, the install's ops bucket for
- * install.json, the fixed release registry, the migration job and the IAP
- * health probe. upgrader-job.ts takes them as {@link UpgraderJobDeps}; the
+ * install.json, the fixed release registry, the migration job, the IAP
+ * health probe and the IAM self-check (#818). upgrader-job.ts takes them as {@link UpgraderJobDeps}; the
  * database queue and the job log come from `@caelo-cms/platform-updater`,
  * which owns the Query API connection.
  *
@@ -20,9 +20,11 @@ import { GCP_STACK_ENV } from "./gcp-names.js";
 import { readAdminConfig, runMigrationsViaCloudRunJob } from "./migration-runner.js";
 import { fetchVerifiedReleaseManifest } from "./release-manifest.js";
 import { opsBucketName } from "./state-backend.js";
-import { acquireBucketStateLock, GcsStateStore } from "./state-store.js";
+import { acquireBucketStateLock, GcsStateStore, realSyncGcloud } from "./state-store.js";
 import { findServiceUrl } from "./upgrade/gcp-lookup.js";
 import { createIapHealthProbe } from "./upgrade/health.js";
+import { restIamTester } from "./upgrader-iam-preflight.js";
+import { UPGRADER_TASK_TIMEOUT_MINUTES } from "./upgrader-setup.js";
 /**
  * The Cloud SQL private IP the admin connects to — the job connects there
  * too (as its own IAM database user). Read from the deployed admin service.
@@ -34,8 +36,11 @@ export async function upgraderDatabaseHost(placement, run = gcloud) {
     }
     return cfg.databaseHost;
 }
-/** The IAP-backed deep health probe for `plan`'s install. */
-async function healthProbeFor(run, http, plan) {
+/**
+ * The IAP-backed deep health probe for `plan`'s install (the upgrader job;
+ * the converge job, #819, too).
+ */
+export async function healthProbeFor(run, http, plan) {
     const { install } = plan;
     const urls = {};
     for (const s of plan.services) {
@@ -70,11 +75,41 @@ export function gcpUpgraderDeps(placement, queue, log) {
         region: placement.region,
         env: GCP_STACK_ENV,
         execution: placement.execution,
+        // #818 — the IAM self-check asks as the job's own account (gcloud's
+        // token from the metadata server), so it sees exactly the job's grants.
+        iam: restIamTester({
+            http,
+            token: async () => {
+                const t = await run(["auth", "print-access-token"]);
+                if (!t.ok)
+                    throw new Error(`gcloud auth print-access-token: ${t.stderr.trim()}`);
+                return t.stdout.trim();
+            },
+        }),
         // The default deps: the fixed registry and signer, never overridden.
         fetchManifest: (version) => fetchVerifiedReleaseManifest(version),
-        lockState: () => acquireBucketStateLock(opsBucketName(placement.projectId), "caelo upgrader job"),
+        // #815 — the lock names this execution, so a later run can break it
+        // once Cloud Run says this one has ended (killed at its task timeout,
+        // OOM). Outside Cloud Run there is no execution to vouch for it.
+        lockState: (onBreak) => acquireBucketStateLock(opsBucketName(placement.projectId), "caelo upgrader job", realSyncGcloud, {
+            onBreak,
+            ...(placement.execution
+                ? {
+                    holder: {
+                        execution: {
+                            projectId: placement.projectId,
+                            region: placement.region,
+                            name: placement.execution,
+                        },
+                        maxRuntimeMs: UPGRADER_TASK_TIMEOUT_MINUTES * 60_000,
+                    },
+                }
+                : {}),
+        }),
+        // Uncached on purpose: the job re-reads install.json once it holds the
+        // lock to see whether another writer changed it meanwhile (#815).
         readInstall: () => {
-            const text = store.read("install.json");
+            const text = store.peek("install.json");
             return text === null ? null : JSON.parse(text);
         },
         writeInstall: (meta) => store.write("install.json", meta),

package/dist/upgrader-gcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"upgrader-gcp.js","sourceRoot":"","sources":["../src/upgrader-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAqB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAW3D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAA0D,EAC1D,MAAoB,MAAM;IAE1B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,uDAAuD,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,YAAY,CAAC;AAC1B,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,cAAc,CAAC,GAAiB,EAAE,IAAe,EAAE,IAAiB;IACjF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,MAAM,IAAI,GAAiD,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QACxF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACrB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,KAAK,EAAE,oBAAoB,CACzB;YACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,IAAI,CAAC,KAAe;YACrC,iBAAiB,EAAE,IAAI,CAAC,OAAiB;SAC1C,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAChC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAC7B,SAA4B,EAC5B,KAAkB,EAClB,GAAW;IAEX,MAAM,GAAG,GAAiB,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,KAA6B,CAAC;IAC3C,uEAAuE;IACvE,MAAM,KAAK,GAAG,IAAI,aAAa,CAC7B,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,EAClC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAC/C,CAAC;IACF,OAAO;QACL,KAAK;QACL,GAAG;QACH,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,EAAE,aAAa;QAClB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,qEAAqE;QACrE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC;QACjE,SAAS,EAAE,GAAG,EAAE,CACd,sBAAsB,CAAC,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;QAClF,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QACtE,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC;QACzD,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpB,2BAA2B,CACzB,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,EACrF,EAAE,GAAG,EAAE,CACR;QACH,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;QACtD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"upgrader-gcp.js","sourceRoot":"","sources":["../src/upgrader-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAqB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AASpE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAA0D,EAC1D,MAAoB,MAAM;IAE1B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,uDAAuD,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,YAAY,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAiB,EAAE,IAAe,EAAE,IAAiB;IACxF,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,MAAM,IAAI,GAAiD,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QACxF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;IACrB,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAa;QACjB,KAAK,EAAE,oBAAoB,CACzB;YACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,IAAI,CAAC,KAAe;YACrC,iBAAiB,EAAE,IAAI,CAAC,OAAiB;SAC1C,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAChC;KACF,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAC7B,SAA4B,EAC5B,KAAkB,EAClB,GAAW;IAEX,MAAM,GAAG,GAAiB,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,KAA6B,CAAC;IAC3C,uEAAuE;IACvE,MAAM,KAAK,GAAG,IAAI,aAAa,CAC7B,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,EAClC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAC/C,CAAC;IACF,OAAO;QACL,KAAK;QACL,GAAG;QACH,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,EAAE,aAAa;QAClB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,oEAAoE;QACpE,wEAAwE;QACxE,GAAG,EAAE,aAAa,CAAC;YACjB,IAAI;YACJ,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;gBACpD,IAAI,CAAC,CAAC,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACjF,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,CAAC;SACF,CAAC;QACF,qEAAqE;QACrE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC;QACjE,oEAAoE;QACpE,sEAAsE;QACtE,iEAAiE;QACjE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,sBAAsB,CACpB,aAAa,CAAC,SAAS,CAAC,SAAS,CAAC,EAClC,oBAAoB,EACpB,cAAc,EACd;YACE,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,SAAS;gBACrB,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,SAAS,EAAE;4BACT,SAAS,EAAE,SAAS,CAAC,SAAS;4BAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;4BACxB,IAAI,EAAE,SAAS,CAAC,SAAS;yBAC1B;wBACD,YAAY,EAAE,6BAA6B,GAAG,MAAM;qBACrD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CACF;QACH,uEAAuE;QACvE,kEAAkE;QAClE,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QACtE,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC;QACzD,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpB,2BAA2B,CACzB,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,EACrF,EAAE,GAAG,EAAE,CACR;QACH,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;QACtD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/upgrader-iam-preflight.d.ts

@@ -0,0 +1,123 @@
+import type { HttpFetch } from "./runtime-secrets.js";
+/** A resource IAM can be asked about. */
+export type IamResource = {
+    readonly kind: "project";
+    readonly projectId: string;
+} | {
+    readonly kind: "service-account";
+    readonly projectId: string;
+    readonly email: string;
+} | {
+    readonly kind: "run-job";
+    readonly projectId: string;
+    readonly region: string;
+    readonly name: string;
+} | {
+    readonly kind: "bucket";
+    readonly bucket: string;
+}
+/** Objects under `prefix/` in `bucket`, behind a name-conditioned grant (probed). */
+ | {
+    readonly kind: "bucket-objects";
+    readonly bucket: string;
+    readonly prefix: string;
+} | {
+    readonly kind: "artifact-repository";
+    readonly projectId: string;
+    readonly location: string;
+    readonly repository: string;
+};
+/** One thing the run will do, the permissions it takes, and where. */
+export interface AccessCheck {
+    /** What the upgrader could not do without them, in plain words. */
+    readonly need: string;
+    readonly resource: IamResource;
+    readonly permissions: readonly string[];
+}
+/** A check with the permissions it lacks. */
+export interface MissingAccess {
+    readonly check: AccessCheck;
+    readonly missing: readonly string[];
+    /**
+     * Permissions that could not be judged because another one is missing
+     * first (storage.objects.get needs storage.objects.list to be testable).
+     */
+    readonly unchecked?: readonly string[];
+}
+/** The permissions IAM confirmed on one resource, or why it could not be asked. */
+export type GrantedResult = {
+    readonly ok: true;
+    readonly granted: readonly string[];
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/** Asks IAM which of `permissions` the job's identity holds on `resource`. */
+export interface IamTester {
+    granted(resource: IamResource, permissions: readonly string[]): Promise<GrantedResult>;
+}
+/** How the self-check came out. */
+export type PreflightOutcome = {
+    readonly kind: "ok";
+} | {
+    readonly kind: "missing";
+    readonly missing: readonly MissingAccess[];
+}
+/** IAM could not be asked about at least one resource; nothing was judged missing. */
+ | {
+    readonly kind: "error";
+    readonly errors: readonly string[];
+};
+/** The object the `install/` probes name. It is never written: every probe fails its precondition. */
+export declare const PREFLIGHT_PROBE_OBJECT = ".caelo-iam-preflight";
+/**
+ * Every permission an upgrader run needs after its decision, grouped by
+ * what it is for (upgrade/app-roll.ts, migration-runner.ts, backup.ts,
+ * health.ts, state-store.ts, the self-update in upgrader-job.ts). Keep in
+ * step with the grants in upgrader-setup.ts: a permission listed here that
+ * setup does not grant stops every update.
+ */
+export declare function upgraderAccessChecks(target: {
+    readonly projectId: string;
+    readonly region: string;
+    readonly env: string;
+}): AccessCheck[];
+/** Ask IAM about every check (one call per resource); never throws. */
+export declare function runIamPreflight(checks: readonly AccessCheck[], tester: IamTester): Promise<PreflightOutcome>;
+/**
+ * The request's end reason for missing permissions: every one of them, each
+ * with what it is for, then the one next step.
+ */
+export declare function preflightMissingReason(missing: readonly MissingAccess[]): string;
+/** The request's end reason when IAM could not be asked. */
+export declare function preflightErrorReason(errors: readonly string[]): string;
+/** A resource's full name, as IAM and the messages name it. */
+export declare function resourceName(r: IamResource): string;
+/**
+ * The real {@link IamTester}: Google's REST APIs with the job's own access
+ * token. `token` is asked once per call (gcloud caches it).
+ *
+ * @example
+ * const tester = restIamTester({ http: fetch, token: async () => "<access token>" });
+ * await tester.granted({ kind: "project", projectId: "acme" }, ["run.services.get"]);
+ */
+export declare function restIamTester(deps: {
+    readonly http: HttpFetch;
+    readonly token: () => Promise<string>;
+}): IamTester;
+/** The testIamPermissions request for a resource that has one. */
+export declare function testIamCall(resource: Exclude<IamResource, {
+    kind: "bucket-objects";
+}>, permissions: readonly string[]): {
+    url: string;
+    method: "GET" | "POST";
+    body?: string;
+};
+/** The precondition-guarded request that tests one object permission (see the file comment). */
+export declare function objectProbeCall(resource: Extract<IamResource, {
+    kind: "bucket-objects";
+}>, permission: string): {
+    url: string;
+    method: "GET" | "POST" | "DELETE";
+} | null;
+//# sourceMappingURL=upgrader-iam-preflight.d.ts.map

package/dist/upgrader-iam-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrader-iam-preflight.d.ts","sourceRoot":"","sources":["../src/upgrader-iam-preflight.ts"],"names":[],"mappings":"AA4DA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD,yCAAyC;AACzC,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxF;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACtD,qFAAqF;GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrF;IACE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEN,sEAAsE;AACtE,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACxF;AAED,mCAAmC;AACnC,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE;AAC1E,sFAAsF;GACpF;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEnE,sGAAsG;AACtG,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAE7D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,WAAW,EAAE,CAsGhB;AAED,uEAAuE;AACvE,wBAAsB,eAAe,CACnC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA2D3B;AAKD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAchF;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEtE;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAenD;AAID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACvC,GAAG,SAAS,CA+BZ;AAED,kEAAkE;AAClE,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC,EAC1D,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAmCxD;AAcD,gGAAgG;AAChG,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC,EAC1D,UAAU,EAAE,MAAM,GACjB;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAA;CAAE,GAAG,IAAI,CAsB3D"}