@caelo-cms/provisioning 0.10.53 → 0.10.57

package/dist/converge-job.js

@@ -0,0 +1,325 @@
+// SPDX-License-Identifier: MPL-2.0
+import { decideInstallJob } from "./install-job.js";
+import { compareSemver, } from "./release-manifest.js";
+import { StateLockHeldError } from "./state-store.js";
+import { assessUpgradeRequest } from "./upgrader-assess.js";
+import { recordUpdateEnd, } from "./upgrader-job.js";
+import { eventReporter } from "./upgrader-reporter.js";
+/** Run the converge job once. Never throws; see the file comment. */
+export async function runConvergeJob(deps) {
+    const { queue, log } = deps;
+    let claim;
+    try {
+        claim = await queue.claimConverge(deps.execution);
+    }
+    catch (e) {
+        log({ severity: "ERROR", message: `could not read update requests: ${errorText(e)}` });
+        return { exitCode: 1, requestId: null, status: null };
+    }
+    if (!claim) {
+        log({ severity: "INFO", message: "no converge request to run; nothing to do" });
+        return { exitCode: 0, requestId: null, status: null };
+    }
+    const request = claim.request;
+    const r = eventReporter((phase, level, message) => queue.event(request.id, phase, level, message), log, request.id);
+    /** This run leaves the request to another (live) run: no end, no events. */
+    const leave = (message) => {
+        log({ severity: "INFO", message, requestId: request.id });
+        return { exitCode: 0, requestId: request.id, status: null };
+    };
+    let releaseLock = null;
+    const unlock = () => {
+        if (!releaseLock)
+            return;
+        try {
+            releaseLock();
+        }
+        catch (e) {
+            r.warn(errorText(e));
+        }
+        releaseLock = null;
+    };
+    const finish = async (end) => {
+        r.phase("finish");
+        if (end.status === "succeeded")
+            r.success(`Caelo ${request.targetVersion} is installed.`);
+        else
+            r.error(end.reason ?? end.status);
+        await r.flush();
+        unlock();
+        const recorded = await recordUpdateEnd(queue, request.id, end, log);
+        const failed = end.status === "failed" || end.status === "rolled_back" || !recorded;
+        return { exitCode: failed ? 1 : 0, requestId: request.id, status: end.status };
+    };
+    const stopWith = (status, codes, reason) => finish({
+        status,
+        reason,
+        codes,
+        pauseAutoUpdates: request.trigger === "auto" && (status === "failed" || status === "rolled_back"),
+    });
+    try {
+        // A request another execution started: adopt it only once that one
+        // has ended — two converges at once must never happen.
+        if (claim.resume && claim.execution !== deps.execution) {
+            if (!deps.execution) {
+                return leave("a converge request is running; only a Cloud Run execution may adopt it");
+            }
+            if (claim.execution) {
+                const live = await deps.executionState(claim.execution);
+                if (live === "running") {
+                    return leave(`execution ${claim.execution} is still installing; this run does nothing`);
+                }
+            }
+            if (!(await queue.handover(request.id, claim.execution, deps.execution))) {
+                return leave("another run adopted the request first; this run does nothing");
+            }
+            r.phase("start");
+            r.info(`Continuing the update to ${request.targetVersion} (run ${deps.execution}; the previous run${claim.execution ? ` ${claim.execution}` : ""} stopped before it finished).`);
+        }
+        else if (!claim.resume) {
+            r.phase("start");
+            r.info(`Converge job started${deps.execution ? ` (run ${deps.execution})` : ""}: installing Caelo ${request.targetVersion}, including the changes it makes to this install's cloud setup.`);
+        }
+        else {
+            r.phase("start");
+            r.info(`Caelo ${deps.ownVersion}'s own installer took over (run ${deps.execution}).`);
+        }
+        // What the install runs — from its own state, never from the admin.
+        r.phase("verify");
+        const meta = deps.readInstall();
+        if (!meta || meta.projectId !== deps.projectId) {
+            return stopWith("needs_cloud_shell", ["install-state"], "The install's records (install.json) are not in its own cloud project, so the converge job cannot tell what it runs. Run the upgrade once from a terminal (Settings → Updates shows how); it moves them there.");
+        }
+        if (meta.provider !== "gcp" && meta.provider !== "gcp-firebase") {
+            return stopWith("refused", ["provider"], `The converge job only updates Google Cloud installs; this one is ${meta.provider}.`);
+        }
+        const checkpoint = deps.readCheckpoint();
+        const mine = checkpoint !== null && checkpoint.targetVersion === request.targetVersion;
+        // An interrupted run may already have recorded the new release in
+        // install.json; it is judged from the release it started from.
+        const fromVersion = mine && checkpoint.state !== "succeeded"
+            ? checkpoint.fromVersion
+            : (meta.releaseVersion ?? null);
+        if (mine && checkpoint.state === "succeeded" && meta.releaseVersion === request.targetVersion) {
+            r.info(`An earlier run already finished installing ${request.targetVersion}.`);
+            return finish({ status: "succeeded", reason: null, codes: [], pauseAutoUpdates: false });
+        }
+        const manifestResult = await deps.fetchManifest(request.targetVersion);
+        const decision = assessUpgradeRequest({
+            request,
+            manifest: manifestResult,
+            installed: { version: fromVersion, infraContractVersion: meta.infraContractVersion ?? 0 },
+            policy: request.policy,
+            now: deps.now(),
+            route: "converge",
+        });
+        if (decision.manifest) {
+            r.success(`Release information of ${decision.manifest.version} verified: signed by Caelo's release workflow.`);
+            await queue.record(request.id, {
+                manifestSecurity: decision.manifest.security,
+                contractMigrations: decision.manifest.migrations.contract,
+                infraContractRequired: decision.manifest.infraContractVersion,
+                infraContractInstalled: meta.infraContractVersion ?? 0,
+                adminDigest: decision.manifest.digests.admin,
+                gatewayDigest: decision.manifest.digests.gateway,
+                opsDigest: decision.manifest.digests.ops,
+            });
+        }
+        r.phase("assess");
+        if (decision.kind === "stop") {
+            return stopWith(decision.status, decision.codes, decision.reason);
+        }
+        for (const w of decision.warnings)
+            r.warn(w);
+        const m = decision.manifest;
+        if (compareSemver(deps.ownVersion, m.version) !== 0) {
+            return await handOver(m);
+        }
+        return await convergeHere(m, fromVersion ?? meta.releaseVersion, checkpoint, meta);
+    }
+    catch (e) {
+        return stopWith("failed", ["internal"], `The converge job stopped unexpectedly: ${errorText(e)}. If the site misbehaves, check Settings → Updates and the job's log.`);
+    }
+    /** Stage 1: hand the request to the target release's own signed installer. */
+    async function handOver(m) {
+        r.info(`This installer belongs to Caelo ${deps.ownVersion}; handing over to the installer of ${m.version} itself, so the cloud setup is changed by the release that needs it.`);
+        if (!(await deps.verifyImage("ops", m.digests.ops))) {
+            return stopWith("refused", ["signature"], `The installer image of ${m.version} is not signed by Caelo's release workflow, so nothing was changed.`);
+        }
+        // Under the lock (the terminal `upgrade` redeploys this job too), and
+        // released before the new run starts: it takes the lock itself.
+        const locked = lockOrBlock(false);
+        if (locked)
+            return stopWith(locked.status, locked.codes, locked.reason);
+        const pointed = await deps.pointJobAt(m.digests.ops);
+        unlock();
+        if (!pointed.ok) {
+            return stopWith("failed", ["handover"], `Nothing was changed: the installer of ${m.version} could not be prepared (${pointed.error}). Try again in a moment.`);
+        }
+        // Release the request BEFORE the new run exists: it adopts a request
+        // that names no run at once, while a run still named (this one, alive
+        // for a moment longer) would make it step back.
+        if (!(await queue.handover(request.id, deps.execution, null))) {
+            return leave("the request moved on before the hand-over; this run does nothing");
+        }
+        const started = await deps.startJob();
+        if (!started.ok) {
+            return stopWith("failed", ["handover"], `Nothing was changed: the installer of ${m.version} could not be started (${started.error}). Try again in a moment.`);
+        }
+        r.info(`The installer of ${m.version} runs now (run ${started.execution}).`);
+        await r.flush();
+        log({
+            severity: "INFO",
+            message: `handed over to ${started.execution}`,
+            requestId: request.id,
+        });
+        return { exitCode: 0, requestId: request.id, status: null };
+    }
+    /** Stage 2: this image is the release's own installer; converge + roll. */
+    async function convergeHere(m, fromVersion, checkpoint, judged) {
+        const installId = judged.installId;
+        const own = await deps.ownImageDigest();
+        if (own !== m.digests.ops) {
+            return stopWith("refused", ["ops-image"], `Nothing was changed: this run's installer image (${own ?? "unknown"}) is not the one Caelo's release workflow signed for ${m.version} (${m.digests.ops}). Start the update again from Settings → Updates.`);
+        }
+        // The checkpoint's run, if it is not this one, must have ended.
+        const live = checkpoint && checkpoint.execution !== deps.execution
+            ? await deps.executionState(checkpoint.execution)
+            : null;
+        const decided = decideInstallJob(checkpoint, live);
+        if (decided.kind === "attach") {
+            return leave(`execution ${decided.status.execution} is still converging; this run does nothing`);
+        }
+        const resumeFrom = checkpoint && checkpoint.targetVersion === m.version && checkpoint.state !== "succeeded"
+            ? checkpoint
+            : null;
+        const changed = resumeFrom?.backup !== undefined;
+        const locked = lockOrBlock(changed);
+        if (locked)
+            return stopWith(locked.status, locked.codes, locked.reason);
+        // #815 — everything above was judged against install.json read without
+        // the lock; another install operation (the upgrader job, a terminal
+        // upgrade) may have changed it since. Never converge on a stale view.
+        const stale = recordsChangedSince(judged, changed);
+        if (stale)
+            return stopWith(stale.status, stale.codes, stale.reason);
+        const startedAt = deps.now().toISOString();
+        let current = {
+            statusVersion: 1,
+            installId,
+            execution: deps.execution ?? "local-run",
+            state: "running",
+            phase: "converge",
+            caeloVersion: deps.ownVersion,
+            startedAt: resumeFrom?.startedAt ?? startedAt,
+            updatedAt: startedAt,
+            targetVersion: m.version,
+            fromVersion,
+            requestId: request.id,
+            ...(resumeFrom?.backup ? { backup: resumeFrom.backup } : {}),
+            ...(resumeFrom?.priorRevisions ? { priorRevisions: resumeFrom.priorRevisions } : {}),
+        };
+        const save = (patch) => {
+            current = { ...current, ...patch, updatedAt: deps.now().toISOString() };
+            deps.writeCheckpoint(current);
+        };
+        // Written before any change: a run killed from here on is resumable.
+        save({});
+        r.phase("converge");
+        const outcome = await deps.upgrade({
+            manifest: m,
+            reporter: r,
+            resume: resumeFrom
+                ? {
+                    ...(resumeFrom.backup ? { backup: resumeFrom.backup } : {}),
+                    ...(resumeFrom.priorRevisions ? { priorRevisions: resumeFrom.priorRevisions } : {}),
+                }
+                : undefined,
+            onCheckpoint: (c) => {
+                if (c.backup) {
+                    save({ backup: c.backup });
+                    queue.record(request.id, { backupId: c.backup.backupId }).catch((e) => log({
+                        severity: "WARNING",
+                        message: `could not record the backup id on the request: ${errorText(e)}`,
+                        requestId: request.id,
+                    }));
+                }
+                if (c.priorRevisions)
+                    save({ priorRevisions: { ...c.priorRevisions } });
+            },
+        });
+        if (outcome.ok) {
+            save({ state: "succeeded", phase: "Done" });
+            if (!outcome.converged) {
+                r.warn("The new release serves, but some cloud-setup steps did not finish (see above); the next update repeats them.");
+            }
+            return finish({ status: "succeeded", reason: null, codes: [], pauseAutoUpdates: false });
+        }
+        save({ state: "failed", phase: outcome.rolledBack ? "rolled back" : "stopped" });
+        if (outcome.unrecorded) {
+            return stopWith("failed", ["record"], `Caelo ${m.version} serves and passed its checks, but the install's records (install.json) could not be updated, so they still name the previous release. Start the update again from Settings → Updates; it records them.`);
+        }
+        if (outcome.rolledBack) {
+            return stopWith("rolled_back", ["health"], `Caelo ${m.version} did not pass its checks, so the previous release serves again. The timeline above says which step failed.`);
+        }
+        return stopWith("failed", ["converge"], `The update to ${m.version} stopped before it finished (see the timeline above); the previous release keeps serving. Fix what it names and start the update again; it continues where it stopped.`);
+    }
+    /**
+     * Whether install.json, re-read under the lock, is still what the run was
+     * judged on; how the request ends otherwise.
+     */
+    function recordsChangedSince(judged, changed) {
+        const before = changed
+            ? "This update already started changing the site; "
+            : "Nothing was changed: ";
+        let now;
+        try {
+            now = deps.readInstall();
+        }
+        catch (e) {
+            return {
+                status: "failed",
+                codes: ["install-state-read"],
+                reason: `${before}the install's records (install.json) could not be read again once the lock was held (${errorText(e)}). Start the update again; it continues where it stopped.`,
+            };
+        }
+        if (JSON.stringify(now) === JSON.stringify(judged))
+            return null;
+        return {
+            status: "failed",
+            codes: ["install-state-changed"],
+            reason: `${before}another install operation changed the install's records (install.json) while this update was being checked. Start the update again from Settings → Updates; it continues where it stopped.`,
+        };
+    }
+    /**
+     * Take the state lock, or say how the request ends instead. `changed`:
+     * an earlier run of this update already changed something.
+     */
+    function lockOrBlock(changed) {
+        const before = changed
+            ? "This update already started changing the site; "
+            : "Nothing was changed: ";
+        try {
+            releaseLock = deps.lockState((message) => r.info(message));
+            return null;
+        }
+        catch (e) {
+            if (e instanceof StateLockHeldError) {
+                return {
+                    status: "failed",
+                    codes: ["state-locked"],
+                    reason: `${before}another install operation is running on this site (${errorText(e)}). Start the update again when it has finished; it continues where it stopped.`,
+                };
+            }
+            return {
+                status: "needs_cloud_shell",
+                codes: ["state-access"],
+                reason: `${before}the converge job could not take the install's state lock (${errorText(e)}). Run the upgrade once from a terminal (Settings → Updates shows how); it repairs the job's access.`,
+            };
+        }
+    }
+}
+function errorText(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+//# sourceMappingURL=converge-job.js.map

package/dist/converge-job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge-job.js","sourceRoot":"","sources":["../src/converge-job.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA+CnC,OAAO,EAAE,gBAAgB,EAAuB,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EACL,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAEL,eAAe,GAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAsB,aAAa,EAAe,MAAM,wBAAwB,CAAC;AA0FxF,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,CAAC,GAAG,aAAa,CACrB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EACzE,GAAG,EACH,OAAO,CAAC,EAAE,CACX,CAAC;IACF,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,OAAe,EAAqB,EAAE;QACnD,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC;IACF,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAc,EAA8B,EAAE;QAClE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,CAAC,CAAC,OAAO,CAAC,SAAS,OAAO,CAAC,aAAa,gBAAgB,CAAC,CAAC;;YACrF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACjF,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAuB,EAAE,KAAwB,EAAE,MAAc,EAAE,EAAE,CACrF,MAAM,CAAC;QACL,MAAM;QACN,MAAM;QACN,KAAK;QACL,gBAAgB,EACd,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;KAClF,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,mEAAmE;QACnE,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CAAC,aAAa,KAAK,CAAC,SAAS,6CAA6C,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACzE,OAAO,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC/E,CAAC;YACD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,4BAA4B,OAAO,CAAC,aAAa,SAAS,IAAI,CAAC,SAAS,qBAAqB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,+BAA+B,CACzK,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,uBAAuB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,OAAO,CAAC,aAAa,iEAAiE,CACpL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,mCAAmC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACxF,CAAC;QAED,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/C,OAAO,QAAQ,CACb,mBAAmB,EACnB,CAAC,eAAe,CAAC,EACjB,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChE,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,UAAU,CAAC,EACZ,oEAAoE,IAAI,CAAC,QAAQ,GAAG,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC;QACvF,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,WAAW,GACf,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtC,CAAC,CAAC,UAAU,CAAC,WAAW;YACxB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9F,CAAC,CAAC,IAAI,CAAC,8CAA8C,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,OAAO;YACP,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC,EAAE;YACzF,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,OAAO,CACP,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,OAAO,gDAAgD,CACpG,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC7B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;gBAC5C,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ;gBACzD,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,CAAC,oBAAoB;gBAC7D,sBAAsB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC;gBACtD,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;gBAC5C,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;gBAChD,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG;aACzC,CAAC,CAAC;QACL,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAE5B,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,YAAY,CAAC,CAAC,EAAE,WAAW,IAAK,IAAI,CAAC,cAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,0CAA0C,SAAS,CAAC,CAAC,CAAC,uEAAuE,CAC9H,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,UAAU,QAAQ,CAAC,CAAkB;QACxC,CAAC,CAAC,IAAI,CACJ,mCAAmC,IAAI,CAAC,UAAU,sCAAsC,CAAC,CAAC,OAAO,sEAAsE,CACxK,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,0BAA0B,CAAC,CAAC,OAAO,qEAAqE,CACzG,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,2BAA2B,OAAO,CAAC,KAAK,2BAA2B,CACtH,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,0BAA0B,OAAO,CAAC,KAAK,2BAA2B,CACrH,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,kBAAkB,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC;YACF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAAS,EAAE;YAC9C,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,YAAY,CACzB,CAAkB,EAClB,WAAmB,EACnB,UAAqC,EACrC,MAAuB;QAEvB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC1B,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,oDAAoD,GAAG,IAAI,SAAS,wDAAwD,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,oDAAoD,CAC5M,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,MAAM,IAAI,GACR,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YACnD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CACV,aAAa,OAAO,CAAC,MAAM,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,aAAa,KAAK,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtF,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,OAAO,GAAG,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,OAAO,GAAuB;YAChC,aAAa,EAAE,CAAC;YAChB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW;YACxC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,UAAU;YACjB,YAAY,EAAE,IAAI,CAAC,UAAU;YAC7B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,CAAC,CAAC,OAAO;YACxB,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,KAAkC,EAAE,EAAE;YAClD,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACxE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,qEAAqE;QACrE,IAAI,CAAC,EAAE,CAAC,CAAC;QAET,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,UAAU;gBAChB,CAAC,CAAC;oBACE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF;gBACH,CAAC,CAAC,SAAS;YACb,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBAClB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAC7E,GAAG,CAAC;wBACF,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,kDAAkD,SAAS,CAAC,CAAC,CAAC,EAAE;wBACzE,SAAS,EAAE,OAAO,CAAC,EAAE;qBACtB,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,CAAC,cAAc;oBAAE,IAAI,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,CAAC,CAAC,IAAI,CACJ,8GAA8G,CAC/G,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,yMAAyM,CAC5N,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,aAAa,EACb,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,4GAA4G,CAC/H,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,iBAAiB,CAAC,CAAC,OAAO,wKAAwK,CACnM,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAC1B,MAAuB,EACvB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC,oBAAoB,CAAC;gBAC7B,MAAM,EAAE,GAAG,MAAM,wFAAwF,SAAS,CAAC,CAAC,CAAC,2DAA2D;aACjL,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,uBAAuB,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,4LAA4L;SAC9M,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,WAAW,CAClB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;gBACpC,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,CAAC,cAAc,CAAC;oBACvB,MAAM,EAAE,GAAG,MAAM,sDAAsD,SAAS,CAAC,CAAC,CAAC,gFAAgF;iBACpK,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,CAAC,cAAc,CAAC;gBACvB,MAAM,EAAE,GAAG,MAAM,6DAA6D,SAAS,CAAC,CAAC,CAAC,sGAAsG;aACjM,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/gcp-names.d.ts

@@ -39,7 +39,7 @@ export declare function gatewayServiceAccountEmail(projectId: string, env: strin
  */
 export declare function staticPublisherServiceAccountId(env: string): string;
 /** Globally unique GCS bucket name the stacks give each bucket. */
-export declare function gcpBucketName(projectId: string, env: string, bucket: "media" | "static" | "staging"): string;
+export declare function gcpBucketName(projectId: string, env: string, bucket: "media" | "static" | "staging" | "audit-results"): string;
 /** Secret Manager secret id for one of the stack's runtime secrets. */
 export declare function gcpSecretId(env: string, name: string): string;
 /** Cloud Run job that keeps Google IAP operator access in sync (operator-access.ts). */
@@ -62,6 +62,30 @@ export declare function operatorAccessScheduleName(env: string): string;
 export declare function upgraderJobName(env: string): string;
 /** Full resource name of the upgrader job, as the admin's env carries it. */
 export declare function upgraderJobResource(projectId: string, region: string, env: string): string;
+/**
+ * Cloud Run job that installs releases which change the cloud setup (#819):
+ * a one-shot job from the signed caelo-ops image that runs as the install's
+ * `caelo-provisioner` account. The admin may only start it, without
+ * overrides (converge-job-setup.ts).
+ */
+export declare function convergeJobName(env: string): string;
+/** Full resource name of the converge job, as the admin's env carries it. */
+export declare function convergeJobResource(projectId: string, region: string, env: string): string;
+/**
+ * #875 — Cloud Run job that runs the quality audit's Lighthouse runs in
+ * parallel, one task per run (audit-job-setup.ts).
+ */
+export declare function auditJobName(env: string): string;
+/** Full resource name of the audit job, as the admin's env carries it. */
+export declare function auditJobResource(projectId: string, region: string, env: string): string;
+/**
+ * Account id of the audit job's own service account: reads the staged
+ * build, creates audit results, writes logs — nothing else
+ * (audit-job-setup.ts).
+ */
+export declare function auditServiceAccountId(env: string): string;
+/** Email of the audit job's service account. */
+export declare function auditServiceAccountEmail(projectId: string, env: string): string;
 /**
  * Account id of the upgrader job's own service account: may roll the two
  * Cloud Run services, run the migration job and back up Cloud SQL, never

package/dist/gcp-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GACrC,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mDAAmD;AACnD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAO1D,CAAC"}
+{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,GACvD,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,gDAAgD;AAChD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mDAAmD;AACnD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAO1D,CAAC"}

package/dist/gcp-names.js

@@ -96,6 +96,42 @@ export function upgraderJobName(env) {
 export function upgraderJobResource(projectId, region, env) {
     return `projects/${projectId}/locations/${region}/jobs/${upgraderJobName(env)}`;
 }
+/**
+ * Cloud Run job that installs releases which change the cloud setup (#819):
+ * a one-shot job from the signed caelo-ops image that runs as the install's
+ * `caelo-provisioner` account. The admin may only start it, without
+ * overrides (converge-job-setup.ts).
+ */
+export function convergeJobName(env) {
+    return `${gcpNamePrefix(env)}-converge`;
+}
+/** Full resource name of the converge job, as the admin's env carries it. */
+export function convergeJobResource(projectId, region, env) {
+    return `projects/${projectId}/locations/${region}/jobs/${convergeJobName(env)}`;
+}
+/**
+ * #875 — Cloud Run job that runs the quality audit's Lighthouse runs in
+ * parallel, one task per run (audit-job-setup.ts).
+ */
+export function auditJobName(env) {
+    return `${gcpNamePrefix(env)}-audit`;
+}
+/** Full resource name of the audit job, as the admin's env carries it. */
+export function auditJobResource(projectId, region, env) {
+    return `projects/${projectId}/locations/${region}/jobs/${auditJobName(env)}`;
+}
+/**
+ * Account id of the audit job's own service account: reads the staged
+ * build, creates audit results, writes logs — nothing else
+ * (audit-job-setup.ts).
+ */
+export function auditServiceAccountId(env) {
+    return `${gcpNamePrefix(env)}-audit`;
+}
+/** Email of the audit job's service account. */
+export function auditServiceAccountEmail(projectId, env) {
+    return `${auditServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
+}
 /**
  * Account id of the upgrader job's own service account: may roll the two
  * Cloud Run services, run the migration job and back up Cloud SQL, never

package/dist/gcp-names.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAsC;IAEtC,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,SAAS,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,kBAAkB,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,4BAA4B;IAC5B,6BAA6B;IAC7B,8BAA8B;CAC/B,CAAC"}
+{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAwD;IAExD,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC7E,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,GAAW;IACrE,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,SAAS,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,kBAAkB,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,4BAA4B;IAC5B,6BAA6B;IAC7B,8BAA8B;CAC/B,CAAC"}

package/dist/index.d.ts

@@ -19,6 +19,8 @@ export { type BootstrapToken, generateBootstrapToken, } from "./bootstrap-token.
 export { type CaddyDomainSpec, type CaddyfileSpec, generateCaddyfile, } from "./caddy.js";
 export { type CdnCopyAdapter, loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { type ComposeSpec, generateDockerCompose, type RolePasswords } from "./compose.js";
+export { type ConvergeClaim, type ConvergeJobDeps, type ConvergeQueue, type ConvergeUpgradeOutcome, runConvergeJob, } from "./converge-job.js";
+export { convergeExecutionNameError, gcpConvergeDeps } from "./converge-job-gcp.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
 export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
 export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, type DigestMismatch, fetchVerifiedReleaseManifest, type InstallAssessment, type InstalledRelease, type InstallMode, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, type ReleaseChannel, type ReleaseImage, type ReleaseManifest, type ReleaseManifestDeps, type ReleaseManifestError, type ReleaseManifestErrorCode, type ReleaseManifestResult, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EACf,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -3,6 +3,8 @@ export { generateBootstrapToken, } from "./bootstrap-token.js";
 export { generateCaddyfile, } from "./caddy.js";
 export { loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { generateDockerCompose } from "./compose.js";
+export { runConvergeJob, } from "./converge-job.js";
+export { convergeExecutionNameError, gcpConvergeDeps } from "./converge-job-gcp.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
 export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";
 export { assessAutoInstall, channelForVersion, compareImageDigests, compareSemver, fetchVerifiedReleaseManifest, RELEASE_CHANNELS, RELEASE_IMAGES, RELEASE_MANIFEST_ARTIFACT_TYPE, RELEASE_MANIFEST_MEDIA_TYPE, RELEASE_MANIFEST_REGISTRY, RELEASE_MANIFEST_REPOSITORY, RELEASE_OIDC_ISSUER, ReleaseManifestSchema, releaseManifestSignerIdentity, SIGSTORE_BUNDLE_MEDIA_TYPE, } from "./release-manifest.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EAEf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,cAAc,GAOf,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAKL,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,eAAe,EAEf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,cAAc,GAOf,MAAM,mBAAmB,CAAC"}

package/dist/infra-contract.d.ts

@@ -20,7 +20,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export declare const INFRA_CONTRACT_VERSION = 7;
+export declare const INFRA_CONTRACT_VERSION = 10;
 /**
  * What each contract version adds, in operator terms — the upgrader's
  * refusal names the steps an install is missing. Keep one entry per version

package/dist/infra-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AA8BxC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQjE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}
+{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAsDzC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWjE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/infra-contract.js

@@ -21,7 +21,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 7;
+export const INFRA_CONTRACT_VERSION = 10;
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
 //   1 — epic #696 split: converge vs app-roll.
@@ -49,6 +49,30 @@ export const INFRA_CONTRACT_VERSION = 7;
 //       runs from (the installed one), which does not set it — so the new
 //       gateway would not start. The operator-identity upgrade runs the new
 //       release's contract and sets it.
+//   8 — #875: the quality-audit job, its service account, the audit results
+//       bucket and their grants, plus CAELO_AUDIT_JOB /
+//       CAELO_AUDIT_RESULTS_BUCKET on the admin. The new admin fans every
+//       Stage audit out to that job, and the app-roll moves the job's image,
+//       so it must exist before an in-cloud upgrader rolls onto it.
+//   9 — #819: the converge job (`caelo-<env>-converge`, converge-job-setup.ts)
+//       that installs contract-bumping releases from Settings → Updates as
+//       the install's caelo-provisioner, its Cloud SQL IAM database login
+//       (platform_updater), the admin's start-only grant on it and
+//       CAELO_CONVERGE_JOB on the admin. Installed by the last converge an
+//       Owner runs by hand; every later one runs from Caelo. The same bump
+//       replaces the upgrader's project-wide roles/run.developer (which
+//       holds run.jobs.runWithOverrides on the provisioner's jobs) with the
+//       custom role caeloUpgraderRun (#883 review). An install without a
+//       caelo-provisioner reaches 9 without the job: there is nothing it
+//       could run as, so its admin keeps routing cloud-setup releases to
+//       the terminal (upgrade/converge.ts, update-route.ts).
+//  10 — #806: remote MCP. Two CLI-generated secrets (the Google OAuth client
+//       placeholder, the broker's seal key) the gateway's new revision
+//       references — a secret volume and a secret env var Cloud Run refuses
+//       to deploy without — plus the gateway SA's accessor and the admin
+//       SA's version-adder bindings on them, the operator-access role's
+//       IAP-settings permissions, and on `gcp` the URL-map routes and the
+//       Cloud Armor rule. The in-cloud upgrader can create none of these.
 /**
  * What each contract version adds, in operator terms — the upgrader's
  * refusal names the steps an install is missing. Keep one entry per version
@@ -62,6 +86,9 @@ export const INFRA_CONTRACT_STEPS = {
     5: "the gateway's cms_admin login removed from its env and IAM (#635)",
     6: "the upgrader's permission to list its ops bucket (#799)",
     7: "the gateway's trusted proxy hop count, CAELO_TRUSTED_PROXY_HOPS (#845)",
+    8: "the quality-audit job, its service account, results bucket and grants (#875)",
+    9: "the converge job that installs cloud-setup changes from Settings → Updates, and a narrower Cloud Run role for the upgrader (#819)",
+    10: "remote MCP: the OAuth client and seal-key secrets, their IAM, the gateway's secret file and timeout, IAP programmatic-client sync and the load-balancer rules (#806)",
 };
 /**
  * The steps an install at contract `installed` lacks for `target`, oldest

package/dist/infra-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAC9D,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,6DAA6D;AAC7D,gEAAgE;AAChE,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,4BAA4B;AAC5B,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wCAAwC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;IAC5E,CAAC,EAAE,mEAAmE;IACtE,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,wEAAwE;CAC5E,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAC9D,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,6DAA6D;AAC7D,gEAAgE;AAChE,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,4BAA4B;AAC5B,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wCAAwC;AACxC,4EAA4E;AAC5E,wDAAwD;AACxD,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,6DAA6D;AAC7D,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;IAC5E,CAAC,EAAE,mEAAmE;IACtE,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,wEAAwE;IAC3E,CAAC,EAAE,8EAA8E;IACjF,CAAC,EAAE,mIAAmI;IACtI,EAAE,EAAE,sKAAsK;CAC3K,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/install-job.d.ts

@@ -65,8 +65,8 @@ export declare const InstallJobStatusSchema: z.ZodObject<{
     execution: z.ZodString;
     state: z.ZodEnum<{
         failed: "failed";
-        succeeded: "succeeded";
         running: "running";
+        succeeded: "succeeded";
     }>;
     phase: z.ZodString;
     detail: z.ZodOptional<z.ZodString>;
@@ -78,10 +78,18 @@ export type InstallJobStatus = z.infer<typeof InstallJobStatusSchema>;
 /** `gs://<bucket>/install/install-job.json`. */
 export declare function installJobStatusUrl(bucket: string): string;
 /**
- * The install job's status as the ops bucket holds it now (never cached:
- * another process — the job — writes it), or null before the first start.
+ * A job status document (`install-job.json`, and the converge job's
+ * `converge-job.json`, #819) as the ops bucket holds it now — never cached:
+ * another process (the job) writes it — or null before the first start.
  * Throws when the bucket can't be read or the document is malformed.
  */
+export declare function readJobStatusDoc<T>(url: string, schema: z.ZodType<T>, run: SyncGcloud): T | null;
+/** Replace a job status document. Refuses secret material (#656). */
+export declare function writeJobStatusDoc<T>(url: string, schema: z.ZodType<T>, status: T, run: SyncGcloud): void;
+/**
+ * The install job's status as the ops bucket holds it now, or null before
+ * the first start ({@link readJobStatusDoc}).
+ */
 export declare function readInstallJobStatus(bucket: string, run: SyncGcloud): InstallJobStatus | null;
 /** Replace the status document. Refuses secret material (#656). */
 export declare function writeInstallJobStatus(bucket: string, status: InstallJobStatus, run: SyncGcloud): void;