@caelo-cms/provisioning 0.10.55 → 0.10.58

package/dist/converge-checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge-checkpoint.js","sourceRoot":"","sources":["../src/converge-checkpoint.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG/F,MAAM,OAAO,GAAG,4CAA4C,CAAC;AAE7D,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC,MAAM,CAAC;IACpE,0CAA0C;IAC1C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;IACxC,4FAA4F;IAC5F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;IACtC,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC;SACD,QAAQ,EAAE;IACb,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9F,CAAC,CAAC;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAKhD,kDAAkD;AAClD,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,QAAQ,MAAM,IAAI,qBAAqB,oBAAoB,CAAC;AACrE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,GAAe;IACpE,OAAO,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,UAA8B,EAC9B,GAAe;IAEf,iBAAiB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,wBAAwB,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;AAC9F,CAAC"}

package/dist/converge-job-gcp.d.ts

@@ -0,0 +1,46 @@
+import type { ConvergeJobDeps, ConvergeQueue } from "./converge-job.js";
+import { type InstallMetadata } from "./install-state.js";
+import { type UpgraderPlacement } from "./upgrader-gcp.js";
+import type { JobLog } from "./upgrader-reporter.js";
+/**
+ * The image digest an execution of the converge job runs, from its Cloud
+ * Run description (the execution's task template names the image it was
+ * started with). Null when it cannot be read or names no digest.
+ */
+export declare function executionImageDigest(describeJson: string): string | null;
+/**
+ * Why install.json's Owner email does not match the IAP members the
+ * deployed operator-access job admits (operator-access.ts deploys them as
+ * `installIapAllowlist(ownerEmail)`), or null when it does. Read from
+ * `gcloud run jobs describe --format=json` (v1 or v2 shape).
+ */
+export declare function deployedOwnerMismatch(describeJson: string, ownerEmail: string): string | null;
+/**
+ * Why install.json's site does not match what the admin serves today, or
+ * null when it does (#883 review, round 2). install.json is writable by the
+ * upgrader's account, and the converge hands its domain, staging host and
+ * region to code running as the provisioner: a tampered record would have
+ * the provisioner point the site, its certificate and its IAP gate at
+ * another domain. So the job converges only onto the site the deployed
+ * admin already serves (`CAELO_SITE_URL`, `CAELO_STAGING_HOST`, from
+ * `gcloud run services describe --format=json`) in the region this job
+ * runs in. A change of domain is a terminal upgrade by the Owner.
+ *
+ * @param adminJson the admin service's description (v1 or v2 shape)
+ * @param region the region this job runs in (the metadata server's)
+ */
+export declare function deployedSiteMismatch(adminJson: string, meta: Pick<InstallMetadata, "domain" | "stagingDomain" | "region">, region: string): string | null;
+/**
+ * Why `CLOUD_RUN_EXECUTION` cannot name a run of the converge job, or null
+ * when it can. The name keys the state lock's holder and the hand-over
+ * between the job's two stages, so a value that names another job's run
+ * (or is not a Cloud Run name at all) stops the job before it acts
+ * (#883 review). Cloud Run sets it and rejects user values for it; this is
+ * the second line.
+ */
+export declare function convergeExecutionNameError(execution: string | null): string | null;
+/** The new execution's name from `gcloud run jobs execute --async`. */
+export declare function startedExecutionName(stdout: string, stderr: string): string | null;
+/** Every dependency of {@link runConvergeJob} except the database and the log. */
+export declare function gcpConvergeDeps(placement: UpgraderPlacement, queue: ConvergeQueue, log: JobLog): ConvergeJobDeps;
+//# sourceMappingURL=converge-job-gcp.d.ts.map

package/dist/converge-job-gcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge-job-gcp.d.ts","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAA0B,MAAM,mBAAmB,CAAC;AAYhG,OAAO,EACL,KAAK,eAAe,EAKrB,MAAM,oBAAoB,CAAC;AAY5B,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAQD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkC7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,eAAe,GAAG,QAAQ,CAAC,EAClE,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAiCf;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAOlF;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlF;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,MAAM,GACV,eAAe,CAwOjB"}

package/dist/converge-job-gcp.js

@@ -0,0 +1,368 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The real side effects of the converge job on Google Cloud (#819):
+ * gcloud as the job's own identity (the install's caelo-provisioner), the
+ * install's ops bucket for install.json, the state lock and the checkpoint,
+ * the fixed release registry, cosign, and — for stage 2 — the terminal's
+ * upgrade itself (upgrade/upgrade.ts) wired the way lifecycle.ts wires it,
+ * minus the operator-identity step: this run IS the provisioner.
+ * converge-job.ts takes them as {@link ConvergeJobDeps}; the database queue
+ * and the job log come from `@caelo-cms/platform-updater`.
+ *
+ * Nothing here reads the process env or argv (CLOUD_RUN_EXECUTION, read by
+ * the entry point, only names this run): what the job may install and from
+ * where is compiled in (release-manifest.ts's registry + signer), and where
+ * it runs comes from the metadata server.
+ */
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { CAELO_VERSION } from "@caelo-cms/shared";
+import { readConvergeCheckpoint, writeConvergeCheckpoint } from "./converge-checkpoint.js";
+import { CONVERGE_TASK_TIMEOUT_MINUTES } from "./converge-job-setup.js";
+import { gcloud } from "./gcloud.js";
+import { realSleep } from "./gcloud-retry.js";
+import { convergeJobName, GCP_STACK_ENV, gcpNamePrefix, operatorAccessJobName, } from "./gcp-names.js";
+import { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
+import { describeExecution } from "./install-job.js";
+import { installRoot, installStagingHost, readMetadata, recordInfraContractVersion, } from "./install-state.js";
+import { runMigrationsViaCloudRunJob } from "./migration-runner.js";
+import { installIapAllowlist } from "./operator-access.js";
+import { fetchVerifiedReleaseManifest } from "./release-manifest.js";
+import { publicSiteUrl, STAGING_HOST_ENV } from "./stack-contract.js";
+import { attachInstall } from "./state-attach.js";
+import { hasLocalPulumiState, opsBucketName } from "./state-backend.js";
+import { acquireBucketStateLock, GcsStateStore, realSyncGcloud } from "./state-store.js";
+import { resolveGcpResourceName } from "./upgrade/gcp-lookup.js";
+import { releaseImageRef, verifyCosignAll } from "./upgrade/release-images.js";
+import { upgradeGcpInstallOutcome } from "./upgrade/upgrade.js";
+import { healthProbeFor } from "./upgrader-gcp.js";
+const DIGEST = /@(sha256:[0-9a-f]{64})/;
+/**
+ * The image digest an execution of the converge job runs, from its Cloud
+ * Run description (the execution's task template names the image it was
+ * started with). Null when it cannot be read or names no digest.
+ */
+export function executionImageDigest(describeJson) {
+    let parsed;
+    try {
+        parsed = JSON.parse(describeJson);
+    }
+    catch {
+        return null;
+    }
+    // gcloud prints the v1 resource (spec.template.spec.containers); the v2
+    // shape (template.containers) is accepted too. The first container is it.
+    const p = parsed;
+    const image = p.spec?.template?.spec?.containers?.[0]?.image ?? p.template?.containers?.[0]?.image ?? "";
+    return DIGEST.exec(image)?.[1] ?? null;
+}
+/** The operator-access job's env var listing the install's fixed IAP members. */
+const STATIC_MEMBERS_ENV = "CAELO_OPERATOR_ACCESS_STATIC_MEMBERS";
+/** The admin env var naming the public site (stack-contract.ts adminEnvContract). */
+const SITE_URL_ENV = "CAELO_SITE_URL";
+/**
+ * Why install.json's Owner email does not match the IAP members the
+ * deployed operator-access job admits (operator-access.ts deploys them as
+ * `installIapAllowlist(ownerEmail)`), or null when it does. Read from
+ * `gcloud run jobs describe --format=json` (v1 or v2 shape).
+ */
+export function deployedOwnerMismatch(describeJson, ownerEmail) {
+    let parsed;
+    try {
+        parsed = JSON.parse(describeJson);
+    }
+    catch {
+        return "the operator-access job's description is not JSON";
+    }
+    const p = parsed;
+    const env = p.spec?.template?.spec?.template?.spec?.containers?.[0]?.env ??
+        p.template?.template?.containers?.[0]?.env ??
+        [];
+    const deployed = env.find((e) => e.name === STATIC_MEMBERS_ENV)?.value;
+    if (deployed === undefined)
+        return `the operator-access job sets no ${STATIC_MEMBERS_ENV}`;
+    const want = installIapAllowlist(ownerEmail).join(",");
+    const have = deployed
+        .split(",")
+        .map((m) => m.trim().toLowerCase())
+        .filter(Boolean)
+        .sort()
+        .join(",");
+    if (have !== [...installIapAllowlist(ownerEmail)].sort().join(",")) {
+        return `the admin admits ${deployed || "nobody"}, the records would make it ${want}`;
+    }
+    return null;
+}
+/**
+ * Why install.json's site does not match what the admin serves today, or
+ * null when it does (#883 review, round 2). install.json is writable by the
+ * upgrader's account, and the converge hands its domain, staging host and
+ * region to code running as the provisioner: a tampered record would have
+ * the provisioner point the site, its certificate and its IAP gate at
+ * another domain. So the job converges only onto the site the deployed
+ * admin already serves (`CAELO_SITE_URL`, `CAELO_STAGING_HOST`, from
+ * `gcloud run services describe --format=json`) in the region this job
+ * runs in. A change of domain is a terminal upgrade by the Owner.
+ *
+ * @param adminJson the admin service's description (v1 or v2 shape)
+ * @param region the region this job runs in (the metadata server's)
+ */
+export function deployedSiteMismatch(adminJson, meta, region) {
+    if (meta.region !== region) {
+        return `the records name region ${meta.region ?? "none"}, the converge job runs in ${region}`;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(adminJson);
+    }
+    catch {
+        return "the admin's description is not JSON";
+    }
+    const p = parsed;
+    const env = p.spec?.template?.spec?.containers?.[0]?.env ?? p.template?.containers?.[0]?.env ?? [];
+    const value = (name) => env.find((e) => e.name === name)?.value;
+    const site = value(SITE_URL_ENV);
+    if (site === undefined)
+        return `the admin sets no ${SITE_URL_ENV}`;
+    if (site !== publicSiteUrl(meta.domain)) {
+        return `the admin serves ${site}, the records would make it ${publicSiteUrl(meta.domain)}`;
+    }
+    // An admin from before #650 has no staging host yet; this converge adds
+    // it, but only the default one derived from the domain.
+    const staging = value(STAGING_HOST_ENV);
+    const want = installStagingHost(meta);
+    const defaultHost = installStagingHost({ domain: meta.domain });
+    if (staging === undefined ? want !== defaultHost : staging !== want) {
+        return `the admin's staging host is ${staging ?? "unset"}, the records would make it ${want}`;
+    }
+    return null;
+}
+/**
+ * Why `CLOUD_RUN_EXECUTION` cannot name a run of the converge job, or null
+ * when it can. The name keys the state lock's holder and the hand-over
+ * between the job's two stages, so a value that names another job's run
+ * (or is not a Cloud Run name at all) stops the job before it acts
+ * (#883 review). Cloud Run sets it and rejects user values for it; this is
+ * the second line.
+ */
+export function convergeExecutionNameError(execution) {
+    if (execution === null)
+        return null;
+    const prefix = `${convergeJobName(GCP_STACK_ENV)}-`;
+    if (!/^[a-z0-9-]{1,63}$/.test(execution) || !execution.startsWith(prefix)) {
+        return `CLOUD_RUN_EXECUTION is "${execution.slice(0, 80)}", not a run of ${convergeJobName(GCP_STACK_ENV)}`;
+    }
+    return null;
+}
+/** The new execution's name from `gcloud run jobs execute --async`. */
+export function startedExecutionName(stdout, stderr) {
+    const name = stdout.trim().split(/\s+/)[0] || /Execution \[([^\]]+)\]/.exec(stderr)?.[1] || "";
+    return /^[a-z0-9-]+$/.test(name) ? name : null;
+}
+/** Every dependency of {@link runConvergeJob} except the database and the log. */
+export function gcpConvergeDeps(placement, queue, log) {
+    const run = gcloud;
+    const http = fetch;
+    const { projectId, region } = placement;
+    const bucket = opsBucketName(projectId);
+    const job = convergeJobName(GCP_STACK_ENV);
+    const location = [`--region=${region}`, `--project=${projectId}`];
+    // Peeks only (uncached); the upgrade writes through install-state.ts.
+    const store = new GcsStateStore(bucket, mkdtempSync(join(tmpdir(), "caelo-converge-")));
+    const upgrade = async ({ manifest: m, reporter, resume, onCheckpoint, }) => {
+        // The container starts empty: mirror the install from its bucket, as
+        // the install job does, so install-state.ts reads and writes it there.
+        const attached = attachInstall(projectId, {
+            run: realSyncGcloud,
+            rootFor: installRoot,
+            hasLocalState: hasLocalPulumiState,
+        });
+        if (!attached.ok) {
+            reporter.error(`Could not read the install's records: ${attached.error}`);
+            return { ok: false, rolledBack: false, unrecorded: false };
+        }
+        const installId = attached.installId;
+        // Lazily: the CLI's lifecycle module (clack, the wizards' Pulumi
+        // helpers) is only needed by stage 2, never by the package's importers.
+        const { recordRolledRelease } = await import("./lifecycle.js");
+        const meta = readMetadata(installId);
+        if ((meta.provider !== "gcp" && meta.provider !== "gcp-firebase") || !meta.region) {
+            reporter.error(`install.json of ${installId} is not a Google Cloud install with a region.`);
+            return { ok: false, rolledBack: false, unrecorded: false };
+        }
+        // #883 review — install.json is writable by the upgrader's account
+        // (install/ in the ops bucket), and this job runs as the provisioner:
+        // the Owner email it hands the converge decides who passes the admin's
+        // IAP gate. Converge only when it matches what is deployed today; a
+        // change of Owner is a terminal upgrade by the Owner.
+        const access = await run([
+            "run",
+            "jobs",
+            "describe",
+            operatorAccessJobName(GCP_STACK_ENV),
+            ...location,
+            "--format=json",
+        ]);
+        const ownerCheck = access.ok
+            ? deployedOwnerMismatch(access.stdout, meta.ownerEmail)
+            : `the deployed operator-access job could not be read (${access.stderr.trim()})`;
+        if (ownerCheck) {
+            reporter.error(`Nothing was changed: the install's records name ${meta.ownerEmail} as Owner, which this update could not confirm against the admin's current access settings (${ownerCheck}). Run the update once from Cloud Shell or the computer you installed from.`);
+            return { ok: false, rolledBack: false, unrecorded: false };
+        }
+        const admin = await resolveGcpResourceName(run, "run-service", `${gcpNamePrefix(GCP_STACK_ENV)}-admin`, projectId, region);
+        const described = admin
+            ? await run(["run", "services", "describe", admin, ...location, "--format=json"])
+            : null;
+        const siteCheck = !admin
+            ? "the admin service could not be found"
+            : described?.ok
+                ? deployedSiteMismatch(described.stdout, meta, region)
+                : `the admin's description could not be read (${described?.stderr.trim() ?? ""})`;
+        if (siteCheck) {
+            reporter.error(`Nothing was changed: the install's records name ${meta.domain} in ${meta.region}, which this update could not confirm against what the admin serves today (${siteCheck}). Run the update once from Cloud Shell or the computer you installed from.`);
+            return { ok: false, rolledBack: false, unrecorded: false };
+        }
+        let recorded = true;
+        let converged = false;
+        const outcome = await upgradeGcpInstallOutcome({
+            provider: meta.provider,
+            projectId,
+            region: meta.region,
+            env: GCP_STACK_ENV,
+            domain: meta.domain,
+            stagingHost: installStagingHost(meta),
+            ownerEmail: meta.ownerEmail,
+            targetTag: m.version,
+            // This code is the target release's (stage 2), so its contract is it.
+            infraContractVersion: INFRA_CONTRACT_VERSION,
+            skipVerify: false,
+            skipHealthCheck: false,
+            migrationsContract: m.migrations.contract,
+        }, {
+            run,
+            http,
+            sleep: realSleep,
+            reporter,
+            // The signed manifest's digests — never a registry tag lookup.
+            resolveImages: async () => ({
+                ok: true,
+                images: {
+                    admin: { digest: m.digests.admin, imageRef: releaseImageRef("admin", m.digests.admin) },
+                    gateway: {
+                        digest: m.digests.gateway,
+                        imageRef: releaseImageRef("gateway", m.digests.gateway),
+                    },
+                },
+            }),
+            verifyImages: verifyCosignAll,
+            migrate: (imageRef) => runMigrationsViaCloudRunJob({ projectId, region: meta.region, imageOverride: imageRef }, { run }),
+            healthProbe: (plan) => healthProbeFor(run, http, plan),
+            recordDigests: async (digests) => {
+                recorded = await recordRolledRelease(installId, meta.provider, digests, m.version);
+            },
+            resolveOpsImage: async () => releaseImageRef("ops", m.digests.ops),
+            recordInfraContractVersion: (version) => {
+                recordInfraContractVersion(installId, version);
+                converged = true;
+            },
+            ...(resume ? { resume } : {}),
+            onCheckpoint,
+        });
+        // rolled_back only when the rollback really put the previous release
+        // back (app-roll.ts reports it structurally), never from log text.
+        const result = outcome.ok && recorded
+            ? { ok: true, converged }
+            : {
+                ok: false,
+                rolledBack: !outcome.ok && outcome.rolledBack,
+                unrecorded: outcome.ok && !recorded,
+            };
+        return result;
+    };
+    return {
+        queue,
+        projectId,
+        execution: placement.execution,
+        ownVersion: CAELO_VERSION,
+        // The default deps: the fixed registry and signer, never overridden.
+        fetchManifest: (version) => fetchVerifiedReleaseManifest(version),
+        readInstall: () => {
+            const text = store.peek("install.json");
+            return text === null ? null : JSON.parse(text);
+        },
+        verifyImage: (slug, digest) => verifyCosignAll([{ slug, digest }]),
+        ownImageDigest: async () => {
+            if (!placement.execution)
+                return null;
+            const r = await run([
+                "run",
+                "jobs",
+                "executions",
+                "describe",
+                placement.execution,
+                ...location,
+                "--format=json",
+            ]);
+            return r.ok ? executionImageDigest(r.stdout) : null;
+        },
+        pointJobAt: async (digest) => {
+            // Only the image changes: the identity, command and args stay what
+            // converge-job-setup.ts deployed.
+            const update = await run([
+                "run",
+                "jobs",
+                "update",
+                job,
+                `--image=${releaseImageRef("ops", digest)}`,
+                ...location,
+                "--quiet",
+            ]);
+            return update.ok
+                ? { ok: true }
+                : { ok: false, error: `update ${job}: ${update.stderr.trim()}` };
+        },
+        startJob: async () => {
+            const exec = await run([
+                "run",
+                "jobs",
+                "execute",
+                job,
+                ...location,
+                "--async",
+                "--format=value(metadata.name)",
+            ]);
+            if (!exec.ok)
+                return { ok: false, error: `start ${job}: ${exec.stderr.trim()}` };
+            const execution = startedExecutionName(exec.stdout, exec.stderr);
+            if (!execution) {
+                return {
+                    ok: false,
+                    error: `${job} started but gcloud did not name the execution (${exec.stderr.trim()})`,
+                };
+            }
+            return { ok: true, execution };
+        },
+        executionState: (execution) => describeExecution(run, { projectId, region, execution }),
+        // #815 — the lock names this execution; a later run breaks it once
+        // Cloud Run says this one has ended (killed at its task timeout).
+        lockState: (onBreak) => acquireBucketStateLock(bucket, "caelo converge job", realSyncGcloud, {
+            onBreak,
+            ...(placement.execution
+                ? {
+                    holder: {
+                        execution: { projectId, region, name: placement.execution },
+                        maxRuntimeMs: CONVERGE_TASK_TIMEOUT_MINUTES * 60_000,
+                    },
+                }
+                : {}),
+        }),
+        readCheckpoint: () => readConvergeCheckpoint(bucket, realSyncGcloud),
+        writeCheckpoint: (checkpoint) => writeConvergeCheckpoint(bucket, checkpoint, realSyncGcloud),
+        upgrade,
+        now: () => new Date(),
+        log,
+    };
+}
+//# sourceMappingURL=converge-job-gcp.js.map

package/dist/converge-job-gcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge-job-gcp.js","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAqB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAEL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAG3E,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,CAAC,GAAG,MAGT,CAAC;IACF,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7F,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAElE,qFAAqF;AACrF,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,UAAkB;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,MAAM,CAAC,GAAG,MAST,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC5D,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1C,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,KAAK,CAAC;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,mCAAmC,kBAAkB,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,KAAK,CAAC,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,oBAAoB,QAAQ,IAAI,QAAQ,+BAA+B,IAAI,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,IAAkE,EAClE,MAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,2BAA2B,IAAI,CAAC,MAAM,IAAI,MAAM,8BAA8B,MAAM,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,MAAM,CAAC,GAAG,MAKT,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC;IACxE,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,qBAAqB,YAAY,EAAE,CAAC;IACnE,IAAI,IAAI,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,oBAAoB,IAAI,+BAA+B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,+BAA+B,OAAO,IAAI,OAAO,+BAA+B,IAAI,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAwB;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO,2BAA2B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAC7B,SAA4B,EAC5B,KAAoB,EACpB,GAAW;IAEX,MAAM,GAAG,GAAiB,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,KAA6B,CAAC;IAC3C,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,YAAY,MAAM,EAAE,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;IAClE,sEAAsE;IACtE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,OAAO,GAA+B,KAAK,EAAE,EACjD,QAAQ,EAAE,CAAC,EACX,QAAQ,EACR,MAAM,EACN,YAAY,GACb,EAAE,EAAE;QACH,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE;YACxC,GAAG,EAAE,cAAc;YACnB,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,mBAAmB;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,KAAK,CAAC,yCAAyC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACrC,iEAAiE;QACjE,wEAAwE;QACxE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAoB,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClF,QAAQ,CAAC,KAAK,CAAC,mBAAmB,SAAS,+CAA+C,CAAC,CAAC;YAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,sDAAsD;QACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,MAAM;YACN,UAAU;YACV,qBAAqB,CAAC,aAAa,CAAC;YACpC,GAAG,QAAQ;YACX,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE;YAC1B,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC;YACvD,CAAC,CAAC,uDAAuD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;QACnF,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,UAAU,+FAA+F,UAAU,6EAA6E,CACzP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CACxC,GAAG,EACH,aAAa,EACb,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,EACvC,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,eAAe,CAAC,CAAC;YACjF,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,SAAS,GAAG,CAAC,KAAK;YACtB,CAAC,CAAC,sCAAsC;YACxC,CAAC,CAAC,SAAS,EAAE,EAAE;gBACb,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;gBACtD,CAAC,CAAC,8CAA8C,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACtF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,8EAA8E,SAAS,6EAA6E,CACrP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,CAAC,CAAC,OAAO;YACpB,sEAAsE;YACtE,oBAAoB,EAAE,sBAAsB;YAC5C,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,KAAK;YACtB,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ;SAC1C,EACD;YACE,GAAG;YACH,IAAI;YACJ,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,+DAA+D;YAC/D,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC1B,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE;oBACN,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;oBACvF,OAAO,EAAE;wBACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO;wBACzB,QAAQ,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;qBACxD;iBACF;aACF,CAAC;YACF,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpB,2BAA2B,CACzB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,EACrE,EAAE,GAAG,EAAE,CACR;YACH,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;YACtD,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC/B,QAAQ,GAAG,MAAM,mBAAmB,CAClC,SAAS,EACT,IAAI,CAAC,QAAkC,EACvC,OAAO,EACP,CAAC,CAAC,OAAO,CACV,CAAC;YACJ,CAAC;YACD,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YAClE,0BAA0B,EAAE,CAAC,OAAO,EAAE,EAAE;gBACtC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC/C,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,YAAY;SACb,CACF,CAAC;QACF,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,MAAM,GACV,OAAO,CAAC,EAAE,IAAI,QAAQ;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,CAAC,CAAC;gBACE,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,UAAU;gBAC7C,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ;aACpC,CAAC;QACR,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU,EAAE,aAAa;QACzB,qEAAqE;QACrE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC;QACjE,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QACtE,CAAC;QACD,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC,SAAS,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;gBAClB,KAAK;gBACL,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS,CAAC,SAAS;gBACnB,GAAG,QAAQ;gBACX,eAAe;aAChB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,mEAAmE;YACnE,kCAAkC;YAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;gBACvB,KAAK;gBACL,MAAM;gBACN,QAAQ;gBACR,GAAG;gBACH,WAAW,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC3C,GAAG,QAAQ;gBACX,SAAS;aACV,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;gBACrB,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,GAAG;gBACH,GAAG,QAAQ;gBACX,SAAS;gBACT,+BAA+B;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACjF,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,GAAG,GAAG,mDAAmD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;iBACtF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QACD,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvF,mEAAmE;QACnE,kEAAkE;QAClE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE;YACnE,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,SAAS;gBACrB,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE;wBAC3D,YAAY,EAAE,6BAA6B,GAAG,MAAM;qBACrD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACJ,cAAc,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,cAAc,CAAC;QACpE,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QAC5F,OAAO;QACP,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/converge-job-setup.d.ts

@@ -0,0 +1,62 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+/**
+ * The job's task timeout in minutes, and the lease on the state lock it
+ * holds (state-lock-lease.ts): after it, Cloud Run has killed the run and a
+ * new execution resumes from the checkpoint. A converge plus a roll takes
+ * 10–20 minutes; the live 0.10.51 run needed 7 before its roll.
+ */
+export declare const CONVERGE_TASK_TIMEOUT_MINUTES = 60;
+/**
+ * Exactly what the admin's runtime service account may do on the converge
+ * job — start it (no overrides) and read its runs. The setup grants these
+ * two and nothing else; the tests assert it.
+ */
+export declare const CONVERGE_ADMIN_ROLES: readonly ["roles/run.jobsExecutor", "roles/run.viewer"];
+/**
+ * The job's entry point and its one argument. `caelo-converge-job`
+ * (packages/provisioning/ops/caelo-converge-job, installed by
+ * Dockerfile.ops) refuses every other argument and starts the job with a
+ * scrubbed environment, so even an execution override could not turn the
+ * provisioner's job into `destroy` or point gcloud/Pulumi elsewhere
+ * (#883 review). Nobody holds run.jobs.runWithOverrides on it anyway.
+ */
+export declare const CONVERGE_JOB_ENTRYPOINT = "caelo-converge-job";
+export declare const CONVERGE_JOB_COMMAND = "converge-job";
+export interface ConvergeSetupTarget {
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    /** The caelo-ops image to run, digest-pinned (`…/ops@sha256:…`). */
+    readonly opsImageRef: string;
+    /** VPC the admin uses to reach Cloud SQL's private IP (the job's queue does too). */
+    readonly network: string;
+    readonly subnet: string;
+}
+export type ConvergeSetupResult = {
+    readonly ok: true;
+    readonly done: string[];
+} | {
+    readonly ok: false;
+    readonly done: string[];
+    readonly error: string;
+    /**
+     * `no-provisioner`: this install has no caelo-provisioner, which the
+     * job would run as. Not a failure of the converge (#883 review): such
+     * an install keeps installing cloud-setup releases from a terminal,
+     * and its admin, without CAELO_CONVERGE_JOB, says so.
+     */
+    readonly reason?: "no-provisioner";
+};
+/**
+ * The `gcloud run jobs deploy` argv of the converge job: the ops image by
+ * digest, the provisioner as its identity, no env and no secrets, the one
+ * fixed subcommand. Exported for the tests that pin the boundary.
+ */
+export declare function convergeJobDeployArgs(target: ConvergeSetupTarget): string[];
+/** Ensure the converge job and everything it needs. Never throws for a gcloud failure. */
+export declare function ensureConvergeJob(target: ConvergeSetupTarget, deps?: {
+    run?: GcloudRunner;
+    sleep?: Sleep;
+}): Promise<ConvergeSetupResult>;
+//# sourceMappingURL=converge-job-setup.d.ts.map

package/dist/converge-job-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge-job-setup.d.ts","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO3F;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,yDAA0D,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAMnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEN;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CA4B3E;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAiH9B"}