@caelo-cms/provisioning 0.11.10 → 0.11.12

package/dist/converge-db-trust.js

@@ -0,0 +1,158 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #1373 — where the converge job (#819) opens its database queue, and whom
+ * it trusts there, BEFORE the install's database TLS step (#1338) ran.
+ *
+ * The job writes the update timeline and the request's end through that
+ * queue. Its code connects with verify-full only, which needs the
+ * instance's DNS name, and on an install whose services still dial the
+ * instance's IP the DNS name exists only once the TLS step has run. When
+ * the job ran that step before opening the queue, a failure of the step
+ * reached only the job's log: Settings → Updates showed "Interrupted" and
+ * nothing else. So the job first opens the queue on the host the install
+ * dials today and runs the TLS step as a timeline step of its own
+ * (converge-job.ts `secureDatabase`).
+ *
+ * Dialling an IP, the host-name half of verify-full cannot hold (the
+ * certificate names no IP). The connection must still authenticate the
+ * server: the job's password is the provisioner's access token, worth far
+ * more than a database password, so `sslmode=require` (encrypted, server
+ * unchecked) is not an option. The trust comes from the Cloud SQL Admin
+ * API, over an authenticated channel, about this one instance:
+ *
+ *   - per-instance CA (`GOOGLE_MANAGED_INTERNAL_CA`, the default before
+ *     #1338): the instance's own server CA (`serverCaCert`). Nobody else
+ *     holds a certificate from it, so a verified chain is this instance.
+ *   - shared CA (`GOOGLE_MANAGED_CAS_CA`): always pinned, because the
+ *     shared CA signs other customers' instances too. With its certificate
+ *     active: Google's shared-CA bundle (the one every image ships) and the
+ *     fingerprints `listServerCertificates` names; not rotated in yet: the
+ *     one certificate the API names active. A listing that does not name
+ *     the active certificate with a well-formed fingerprint is refused —
+ *     fail closed, never a guess.
+ *   - any other CA mode: refused.
+ *
+ * No input but the metadata server's placement and the APIs: the job's
+ * scrubbed-environment contract (§11.C) is unchanged.
+ */
+import { readFileSync } from "node:fs";
+import { CLOUD_SQL_CA_BUNDLE, isIpLiteral } from "@caelo-cms/shared";
+import { z } from "zod";
+import { describeInstance } from "./cloudsql-tls.js";
+import { findSqlInstance } from "./gateway-credentials.js";
+import { gcloud } from "./gcloud.js";
+import { GCP_STACK_ENV } from "./gcp-names.js";
+import { CLOUD_SQL_SERVER_CA_MODE } from "./stack-contract.js";
+import { upgraderDatabaseHost } from "./upgrader-gcp.js";
+/** A SHA-1 fingerprint as hex without separators, lower case (`AB:CD…` and `abcd…` compare equal). */
+export function normalizedSha1(fingerprint) {
+    return fingerprint.replace(/[^0-9a-f]/gi, "").toLowerCase();
+}
+/**
+ * The host the install dials today and, when it is the instance's IP, the
+ * server identity the converge job's connection must verify there. Throws
+ * with what could not be read: without it the job must not connect.
+ */
+export async function convergeDatabaseTarget(placement, deps = {}) {
+    const run = deps.run ?? gcloud;
+    const host = await upgraderDatabaseHost(placement, run);
+    if (!isIpLiteral(host))
+        return { kind: "dns", host };
+    const install = { projectId: placement.projectId, env: GCP_STACK_ENV };
+    const lookup = await findSqlInstance(install, { run });
+    if (lookup.status !== "found") {
+        throw new Error(`could not find the install's Cloud SQL instance (${lookup.status})`);
+    }
+    const target = { ...install, sqlInstance: lookup.name };
+    const described = await describeInstance(target, run);
+    if (!described.ok)
+        throw new Error(described.error);
+    const d = described.d;
+    const mode = d.settings?.ipConfiguration?.serverCaMode;
+    const ownCa = d.serverCaCert?.cert?.trim() || null;
+    if (mode === CLOUD_SQL_SERVER_CA_MODE) {
+        const listing = await serverCertificateListing(target, run, deps.http ?? fetch);
+        // Fail closed: once the shared CA may be active, every connection is
+        // pinned to a certificate the API names — the shared CA alone would
+        // also vouch for other customers' instances.
+        const sharedBundle = (deps.readSharedCaBundle ?? (() => readFileSync(CLOUD_SQL_CA_BUNDLE, "utf8")))();
+        if (listing.fingerprints.includes(listing.active)) {
+            return { kind: "ip", host, caPem: sharedBundle, pinnedSha1: listing.fingerprints };
+        }
+        // Moved to the shared CA, its certificate not rotated in yet: the
+        // server still presents the active one from its own CA. Pinned to
+        // exactly that certificate, so which CA vouches for it does not widen
+        // what is accepted.
+        const caPem = [ownCa, sharedBundle].filter((c) => Boolean(c)).join("\n");
+        return { kind: "ip", host, caPem, pinnedSha1: [listing.active] };
+    }
+    // Per-instance CA (the default, which older instances do not name):
+    // nobody else holds a certificate from it, so the verified chain is this
+    // instance. Any other mode (a customer-managed CA) is not one this job
+    // can reason about.
+    if (mode !== undefined && mode !== PER_INSTANCE_CA_MODE) {
+        throw new Error(`${lookup.name} uses the server CA mode ${mode}, which the converge job cannot verify a connection to ${host} for`);
+    }
+    if (!ownCa) {
+        throw new Error(`${lookup.name} names no server CA certificate (serverCaCert), so the connection to ${host} could not be verified`);
+    }
+    return { kind: "ip", host, caPem: ownCa, pinnedSha1: null };
+}
+/** Cloud SQL's default per-instance server CA mode. */
+const PER_INSTANCE_CA_MODE = "GOOGLE_MANAGED_INTERNAL_CA";
+const SHA1_HEX = /^[0-9a-f]{40}$/;
+/**
+ * The Admin API's `listServerCertificates` answer, validated: the active
+ * certificate's fingerprint and every listed one, normalized. Throws on
+ * anything else — a missing `activeVersion`, a certificate without a
+ * well-formed fingerprint — since a guessed listing would be a guessed
+ * trust decision.
+ */
+async function serverCertificateListing(t, run, http) {
+    const token = await run(["auth", "print-access-token"]);
+    const bearer = token.ok ? token.stdout.trim() : "";
+    if (!bearer)
+        throw new Error(`gcloud auth print-access-token: ${token.stderr.trim()}`);
+    const res = await http(`https://sqladmin.googleapis.com/v1/projects/${encodeURIComponent(t.projectId)}/instances/${encodeURIComponent(t.sqlInstance)}/listServerCertificates`, { method: "GET", headers: { Authorization: `Bearer ${bearer}` } });
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(`list server certificates: HTTP ${res.status} ${text.slice(0, 300)}`);
+    }
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        throw new Error("list server certificates: the Cloud SQL Admin API answered no JSON");
+    }
+    const parsed = ListingSchema.safeParse(body);
+    if (!parsed.success) {
+        throw new Error(`list server certificates: the answer does not name the active certificate and the listed ones with SHA-1 fingerprints (${parsed.error.issues[0]?.message ?? "invalid"}), so the connection is not trusted`);
+    }
+    return {
+        active: parsed.data.activeVersion,
+        fingerprints: parsed.data.serverCerts.map((c) => c.sha1Fingerprint),
+    };
+}
+const Sha1 = z
+    .string()
+    .transform(normalizedSha1)
+    .refine((f) => SHA1_HEX.test(f), "a SHA-1 fingerprint");
+const ListingSchema = z.object({
+    activeVersion: Sha1,
+    // Before the first shared-CA certificate exists the API may list none.
+    serverCerts: z.array(z.object({ sha1Fingerprint: Sha1 })).default([]),
+});
+/**
+ * Why a server certificate with `fingerprint` (as `node:tls` prints it) is
+ * not the instance `target` names, or null when it is. Only for an `ip`
+ * target; the chain itself is checked against `caPem` by the TLS layer.
+ */
+export function serverIdentityProblem(target, fingerprint) {
+    if (target.pinnedSha1 === null)
+        return null;
+    return target.pinnedSha1.includes(normalizedSha1(fingerprint))
+        ? null
+        : `the database at ${target.host} presented a certificate (SHA-1 ${normalizedSha1(fingerprint)}) that the Cloud SQL Admin API does not list for this install's instance`;
+}
+//# sourceMappingURL=converge-db-trust.js.map

package/dist/converge-db-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge-db-trust.js","sourceRoot":"","sources":["../src/converge-db-trust.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAA0B,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAyBjF,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,OAAO,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAA0D,EAC1D,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC;IACvD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACnD,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C,MAAM,EACN,GAAG,EACH,IAAI,CAAC,IAAI,IAAK,KAA8B,CAC7C,CAAC;QACF,qEAAqE;QACrE,oEAAoE;QACpE,6CAA6C;QAC7C,MAAM,YAAY,GAAG,CACnB,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAC7E,EAAE,CAAC;QACJ,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,CAAC;QACD,kEAAkE;QAClE,kEAAkE;QAClE,sEAAsE;QACtE,oBAAoB;QACpB,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,oEAAoE;IACpE,yEAAyE;IACzE,uEAAuE;IACvE,oBAAoB;IACpB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,CAAC,IAAI,4BAA4B,IAAI,0DAA0D,IAAI,MAAM,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,CAAC,IAAI,wEAAwE,IAAI,wBAAwB,CACnH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,uDAAuD;AACvD,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAE1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAElC;;;;;;GAMG;AACH,KAAK,UAAU,wBAAwB,CACrC,CAA+D,EAC/D,GAAiB,EACjB,IAAe;IAEf,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,+CAA+C,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,yBAAyB,EACtJ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAClE,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,0HAA0H,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,SAAS,qCAAqC,CAC5M,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa;QACjC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC;KACX,MAAM,EAAE;KACR,SAAS,CAAC,cAAc,CAAC;KACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAE1D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,aAAa,EAAE,IAAI;IACnB,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtE,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAuD,EACvD,WAAmB;IAEnB,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAC5D,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,mBAAmB,MAAM,CAAC,IAAI,mCAAmC,cAAc,CAAC,WAAW,CAAC,0EAA0E,CAAC;AAC7K,CAAC"}

package/dist/converge-job-gcp.d.ts

@@ -41,6 +41,16 @@ export declare function deployedSiteMismatch(adminJson: string, meta: Pick<Insta
 export declare function convergeExecutionNameError(execution: string | null): string | null;
 /** The new execution's name from `gcloud run jobs execute --async`. */
 export declare function startedExecutionName(stdout: string, stderr: string): string | null;
-/** Every dependency of {@link runConvergeJob} except the database and the log. */
-export declare function gcpConvergeDeps(placement: UpgraderPlacement, queue: ConvergeQueue, log: JobLog): ConvergeJobDeps;
+/**
+ * The `gcloud` argv that grants the install's provisioner — this job's
+ * own identity, never another principal — `role` on the project, or null
+ * when `role` is not on the self-grant allowlist (converge-job-preflight.ts).
+ * Exported for the tests that pin the boundary.
+ */
+export declare function selfGrantArgs(projectId: string, role: string): string[] | null;
+/**
+ * Every dependency of {@link runConvergeJob} except the database (the queue
+ * and how it is secured, #1373) and the log.
+ */
+export declare function gcpConvergeDeps(placement: UpgraderPlacement, queue: ConvergeQueue, secureDatabase: ConvergeJobDeps["secureDatabase"], log: JobLog): ConvergeJobDeps;
 //# sourceMappingURL=converge-job-gcp.d.ts.map

package/dist/converge-job-gcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-gcp.d.ts","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAA0B,MAAM,mBAAmB,CAAC;AAYhG,OAAO,EACL,KAAK,eAAe,EAKrB,MAAM,oBAAoB,CAAC;AAY5B,OAAO,EAAmC,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAQD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkC7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,eAAe,GAAG,QAAQ,CAAC,EAClE,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAiCf;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAOlF;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlF;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,MAAM,GACV,eAAe,CAqOjB"}
+{"version":3,"file":"converge-job-gcp.d.ts","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAA0B,MAAM,mBAAmB,CAAC;AAahG,OAAO,EACL,KAAK,eAAe,EAKrB,MAAM,oBAAoB,CAAC;AAa5B,OAAO,EAAmC,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAQD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkC7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,eAAe,GAAG,QAAQ,CAAC,EAClE,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAiCf;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAOlF;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAY9E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,aAAa,EACpB,cAAc,EAAE,eAAe,CAAC,gBAAgB,CAAC,EACjD,GAAG,EAAE,MAAM,GACV,eAAe,CAmPjB"}

package/dist/converge-job-gcp.js

@@ -19,15 +19,17 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { CAELO_VERSION } from "@caelo-cms/shared";
 import { readConvergeCheckpoint, writeConvergeCheckpoint } from "./converge-checkpoint.js";
+import { isSelfGrantableRole } from "./converge-job-preflight.js";
 import { CONVERGE_TASK_TIMEOUT_MINUTES } from "./converge-job-setup.js";
 import { gcloud } from "./gcloud.js";
-import { realSleep } from "./gcloud-retry.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
 import { convergeJobName, GCP_STACK_ENV, gcpNamePrefix, operatorAccessJobName, } from "./gcp-names.js";
 import { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
 import { describeExecution } from "./install-job.js";
 import { installRoot, installStagingHost, readMetadata, recordInfraContractVersion, } from "./install-state.js";
 import { runMigrationsViaCloudRunJob } from "./migration-runner.js";
 import { installIapAllowlist } from "./operator-access.js";
+import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
 import { fetchVerifiedReleaseManifest, manifestServiceImages } from "./release-manifest.js";
 import { publicSiteUrl, STAGING_HOST_ENV } from "./stack-contract.js";
 import { attachInstall } from "./state-attach.js";
@@ -160,8 +162,31 @@ export function startedExecutionName(stdout, stderr) {
     const name = stdout.trim().split(/\s+/)[0] || /Execution \[([^\]]+)\]/.exec(stderr)?.[1] || "";
     return /^[a-z0-9-]+$/.test(name) ? name : null;
 }
-/** Every dependency of {@link runConvergeJob} except the database and the log. */
-export function gcpConvergeDeps(placement, queue, log) {
+/**
+ * The `gcloud` argv that grants the install's provisioner — this job's
+ * own identity, never another principal — `role` on the project, or null
+ * when `role` is not on the self-grant allowlist (converge-job-preflight.ts).
+ * Exported for the tests that pin the boundary.
+ */
+export function selfGrantArgs(projectId, role) {
+    if (!isSelfGrantableRole(role))
+        return null;
+    return [
+        "projects",
+        "add-iam-policy-binding",
+        projectId,
+        `--member=serviceAccount:${provisionerServiceAccountEmail(projectId)}`,
+        `--role=${role}`,
+        "--condition=None",
+        "--quiet",
+        "--format=none",
+    ];
+}
+/**
+ * Every dependency of {@link runConvergeJob} except the database (the queue
+ * and how it is secured, #1373) and the log.
+ */
+export function gcpConvergeDeps(placement, queue, secureDatabase, log) {
     const run = gcloud;
     const http = fetch;
     const { projectId, region } = placement;
@@ -234,6 +259,9 @@ export function gcpConvergeDeps(placement, queue, log) {
             domain: meta.domain,
             stagingHost: installStagingHost(meta),
             ownerEmail: meta.ownerEmail,
+            ...(meta.schedulerIntervalMinutes !== undefined
+                ? { schedulerIntervalMinutes: meta.schedulerIntervalMinutes }
+                : {}),
             targetTag: m.version,
             // This code is the target release's (stage 2), so its contract is it.
             infraContractVersion: INFRA_CONTRACT_VERSION,
@@ -275,9 +303,20 @@ export function gcpConvergeDeps(placement, queue, log) {
     };
     return {
         queue,
+        secureDatabase,
         projectId,
         region,
         iam: gcloudIamTester(run, http),
+        grantOwnRole: async (role) => {
+            const args = selfGrantArgs(projectId, role);
+            if (!args)
+                return { ok: false, error: `${role} is not a role the converge job may grant itself` };
+            const r = await runWithRetry(run, realSleep, args);
+            return r.ok
+                ? { ok: true }
+                : { ok: false, error: r.stderr.trim() || `gcloud exited ${r.exitCode}` };
+        },
+        sleep: realSleep,
         execution: placement.execution,
         ownVersion: CAELO_VERSION,
         // The default deps: the fixed registry and signer, never overridden.

package/dist/converge-job-gcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-gcp.js","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAqB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAEL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAG5F,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,CAAC,GAAG,MAGT,CAAC;IACF,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7F,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAElE,qFAAqF;AACrF,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,UAAkB;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,MAAM,CAAC,GAAG,MAST,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC5D,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1C,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,KAAK,CAAC;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,mCAAmC,kBAAkB,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,KAAK,CAAC,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,oBAAoB,QAAQ,IAAI,QAAQ,+BAA+B,IAAI,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,IAAkE,EAClE,MAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,2BAA2B,IAAI,CAAC,MAAM,IAAI,MAAM,8BAA8B,MAAM,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,MAAM,CAAC,GAAG,MAKT,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC;IACxE,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,qBAAqB,YAAY,EAAE,CAAC;IACnE,IAAI,IAAI,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,oBAAoB,IAAI,+BAA+B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,+BAA+B,OAAO,IAAI,OAAO,+BAA+B,IAAI,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAwB;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO,2BAA2B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAC7B,SAA4B,EAC5B,KAAoB,EACpB,GAAW;IAEX,MAAM,GAAG,GAAiB,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,KAA6B,CAAC;IAC3C,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,YAAY,MAAM,EAAE,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;IAClE,sEAAsE;IACtE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,OAAO,GAA+B,KAAK,EAAE,EACjD,QAAQ,EAAE,CAAC,EACX,QAAQ,EACR,MAAM,EACN,YAAY,GACb,EAAE,EAAE;QACH,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE;YACxC,GAAG,EAAE,cAAc;YACnB,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,mBAAmB;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,KAAK,CAAC,yCAAyC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACrC,iEAAiE;QACjE,wEAAwE;QACxE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAoB,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClF,QAAQ,CAAC,KAAK,CAAC,mBAAmB,SAAS,+CAA+C,CAAC,CAAC;YAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,sDAAsD;QACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,MAAM;YACN,UAAU;YACV,qBAAqB,CAAC,aAAa,CAAC;YACpC,GAAG,QAAQ;YACX,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE;YAC1B,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC;YACvD,CAAC,CAAC,uDAAuD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;QACnF,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,UAAU,+FAA+F,UAAU,6EAA6E,CACzP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CACxC,GAAG,EACH,aAAa,EACb,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,EACvC,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,OAAO;YACtB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,eAAe,CAAC,CAAC;YACtF,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,OAAO;YACtB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC,2BAA2B,EAAE,KAAK,CAAC;YACzF,CAAC,CAAC,SAAS,EAAE,EAAE;gBACb,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;gBACtD,CAAC,CAAC,8CAA8C,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACxF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,8EAA8E,SAAS,6EAA6E,CACrP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,CAAC,CAAC,OAAO;YACpB,sEAAsE;YACtE,oBAAoB,EAAE,sBAAsB;YAC5C,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,KAAK;YACtB,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ;YACzC,WAAW,EAAE,KAAK;SACnB,EACD;YACE,GAAG;YACH,IAAI;YACJ,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,+DAA+D;YAC/D,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACnD,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpB,2BAA2B,CACzB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,EACrE,EAAE,GAAG,EAAE,CACR;YACH,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;YACxE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC/B,QAAQ,GAAG,MAAM,mBAAmB,CAClC,SAAS,EACT,IAAI,CAAC,QAAkC,EACvC,OAAO,EACP,CAAC,CAAC,OAAO,EACT,CAAC,CACF,CAAC;YACJ,CAAC;YACD,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YAClE,0BAA0B,EAAE,CAAC,OAAO,EAAE,EAAE;gBACtC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC/C,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,YAAY;SACb,CACF,CAAC;QACF,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,MAAM,GACV,OAAO,CAAC,EAAE,IAAI,QAAQ;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,CAAC,CAAC;gBACE,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,UAAU;gBAC7C,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ;aACpC,CAAC;QACR,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,SAAS;QACT,MAAM;QACN,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC;QAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU,EAAE,aAAa;QACzB,qEAAqE;QACrE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC;QACjE,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QACtE,CAAC;QACD,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC,SAAS,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;gBAClB,KAAK;gBACL,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS,CAAC,SAAS;gBACnB,GAAG,QAAQ;gBACX,eAAe;aAChB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,mEAAmE;YACnE,kCAAkC;YAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;gBACvB,KAAK;gBACL,MAAM;gBACN,QAAQ;gBACR,GAAG;gBACH,WAAW,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC3C,GAAG,QAAQ;gBACX,SAAS;aACV,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;gBACrB,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,GAAG;gBACH,GAAG,QAAQ;gBACX,SAAS;gBACT,+BAA+B;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACjF,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,GAAG,GAAG,mDAAmD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;iBACtF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QACD,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvF,mEAAmE;QACnE,kEAAkE;QAClE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE;YACnE,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,SAAS;gBACrB,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE;wBAC3D,YAAY,EAAE,6BAA6B,GAAG,MAAM;qBACrD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACJ,cAAc,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,cAAc,CAAC;QACpE,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QAC5F,OAAO;QACP,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"converge-job-gcp.js","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAEL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAG5F,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,CAAC,GAAG,MAGT,CAAC;IACF,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7F,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAElE,qFAAqF;AACrF,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,UAAkB;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,MAAM,CAAC,GAAG,MAST,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC5D,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1C,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,KAAK,CAAC;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,mCAAmC,kBAAkB,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,KAAK,CAAC,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,oBAAoB,QAAQ,IAAI,QAAQ,+BAA+B,IAAI,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,IAAkE,EAClE,MAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,2BAA2B,IAAI,CAAC,MAAM,IAAI,MAAM,8BAA8B,MAAM,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,MAAM,CAAC,GAAG,MAKT,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC;IACxE,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,qBAAqB,YAAY,EAAE,CAAC;IACnE,IAAI,IAAI,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,oBAAoB,IAAI,+BAA+B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,+BAA+B,OAAO,IAAI,OAAO,+BAA+B,IAAI,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAwB;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO,2BAA2B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,IAAY;IAC3D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO;QACL,UAAU;QACV,wBAAwB;QACxB,SAAS;QACT,2BAA2B,8BAA8B,CAAC,SAAS,CAAC,EAAE;QACtE,UAAU,IAAI,EAAE;QAChB,kBAAkB;QAClB,SAAS;QACT,eAAe;KAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,SAA4B,EAC5B,KAAoB,EACpB,cAAiD,EACjD,GAAW;IAEX,MAAM,GAAG,GAAiB,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,KAA6B,CAAC;IAC3C,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,YAAY,MAAM,EAAE,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;IAClE,sEAAsE;IACtE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,OAAO,GAA+B,KAAK,EAAE,EACjD,QAAQ,EAAE,CAAC,EACX,QAAQ,EACR,MAAM,EACN,YAAY,GACb,EAAE,EAAE;QACH,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE;YACxC,GAAG,EAAE,cAAc;YACnB,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,mBAAmB;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,KAAK,CAAC,yCAAyC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACrC,iEAAiE;QACjE,wEAAwE;QACxE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAoB,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClF,QAAQ,CAAC,KAAK,CAAC,mBAAmB,SAAS,+CAA+C,CAAC,CAAC;YAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,sDAAsD;QACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,MAAM;YACN,UAAU;YACV,qBAAqB,CAAC,aAAa,CAAC;YACpC,GAAG,QAAQ;YACX,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE;YAC1B,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC;YACvD,CAAC,CAAC,uDAAuD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;QACnF,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,UAAU,+FAA+F,UAAU,6EAA6E,CACzP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CACxC,GAAG,EACH,aAAa,EACb,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,EACvC,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,OAAO;YACtB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,eAAe,CAAC,CAAC;YACtF,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,OAAO;YACtB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC,2BAA2B,EAAE,KAAK,CAAC;YACzF,CAAC,CAAC,SAAS,EAAE,EAAE;gBACb,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;gBACtD,CAAC,CAAC,8CAA8C,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACxF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,8EAA8E,SAAS,6EAA6E,CACrP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,CAAC,CAAC,OAAO;YACpB,sEAAsE;YACtE,oBAAoB,EAAE,sBAAsB;YAC5C,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,KAAK;YACtB,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ;YACzC,WAAW,EAAE,KAAK;SACnB,EACD;YACE,GAAG;YACH,IAAI;YACJ,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,+DAA+D;YAC/D,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACnD,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpB,2BAA2B,CACzB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,EACrE,EAAE,GAAG,EAAE,CACR;YACH,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;YACxE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC/B,QAAQ,GAAG,MAAM,mBAAmB,CAClC,SAAS,EACT,IAAI,CAAC,QAAkC,EACvC,OAAO,EACP,CAAC,CAAC,OAAO,EACT,CAAC,CACF,CAAC;YACJ,CAAC;YACD,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YAClE,0BAA0B,EAAE,CAAC,OAAO,EAAE,EAAE;gBACtC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC/C,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,YAAY;SACb,CACF,CAAC;QACF,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,MAAM,GACV,OAAO,CAAC,EAAE,IAAI,QAAQ;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,CAAC,CAAC;gBACE,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,UAAU;gBAC7C,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ;aACpC,CAAC;QACR,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,cAAc;QACd,SAAS;QACT,MAAM;QACN,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC;QAC/B,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,kDAAkD,EAAE,CAAC;YACzF,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,EAAE;gBACT,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7E,CAAC;QACD,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU,EAAE,aAAa;QACzB,qEAAqE;QACrE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC;QACjE,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QACtE,CAAC;QACD,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC,SAAS,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;gBAClB,KAAK;gBACL,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS,CAAC,SAAS;gBACnB,GAAG,QAAQ;gBACX,eAAe;aAChB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,mEAAmE;YACnE,kCAAkC;YAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;gBACvB,KAAK;gBACL,MAAM;gBACN,QAAQ;gBACR,GAAG;gBACH,WAAW,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC3C,GAAG,QAAQ;gBACX,SAAS;aACV,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;gBACrB,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,GAAG;gBACH,GAAG,QAAQ;gBACX,SAAS;gBACT,+BAA+B;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACjF,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,GAAG,GAAG,mDAAmD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;iBACtF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QACD,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvF,mEAAmE;QACnE,kEAAkE;QAClE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE;YACnE,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,SAAS;gBACrB,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE;wBAC3D,YAAY,EAAE,6BAA6B,GAAG,MAAM;qBACrD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACJ,cAAc,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,cAAc,CAAC;QACpE,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QAC5F,OAAO;QACP,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/converge-job-preflight.d.ts

@@ -1,5 +1,5 @@
 import { type InstallJobRole } from "./install-job.js";
-import type { AccessCheck, PreflightVoice } from "./upgrader-iam-preflight.js";
+import type { AccessCheck, MissingAccess, PreflightVoice } from "./upgrader-iam-preflight.js";
 /**
  * What a converge does with each role `ensureConvergeJob` grants the
  * provisioner on top of its install roles, and the permissions of that role
@@ -12,10 +12,42 @@ export declare const INSTALL_ROLE_USES: Record<InstallJobRole, {
 }>;
 /** The converge job's voice: the setup is re-converged by a terminal upgrade. */
 export declare const CONVERGE_PREFLIGHT_VOICE: PreflightVoice;
+/**
+ * The roles the converge job may grant its own account when the self-check
+ * finds them missing: exactly the roles `ensureConvergeJob` grants it, as
+ * compiled into this release (see the file comment).
+ */
+export declare const CONVERGE_SELF_GRANTABLE_ROLES: readonly InstallJobRole[];
+/**
+ * Roles the converge job must never grant itself, whatever a release's list
+ * says — ownership and IAM-policy roles (prefix matches). The tests assert
+ * {@link CONVERGE_SELF_GRANTABLE_ROLES} names none of them, and the grant
+ * step refuses them again at run time.
+ */
+export declare const SELF_GRANT_FORBIDDEN_ROLES: readonly ["roles/owner", "roles/editor", "roles/resourcemanager.", "roles/iam.securityAdmin", "roles/iam.organizationRoleAdmin", "roles/iam.serviceAccountKeyAdmin", "roles/iam.workloadIdentityPoolAdmin", "roles/orgpolicy.", "roles/billing."];
+/** Whether the converge job may grant `role` to its own account (see the file comment). */
+export declare function isSelfGrantableRole(role: string): role is InstallJobRole;
+/** A converge self-check; `role` marks a check that granting that role repairs. */
+export interface ConvergeAccessCheck extends AccessCheck {
+    readonly role?: InstallJobRole;
+}
+/** What the converge job does about the self-check's missing permissions. */
+export interface SelfGrantPlan {
+    /** Allowlisted roles to grant the provisioner, in list order. */
+    readonly grant: readonly InstallJobRole[];
+    /** What no grant of the job repairs: the run stops on any of these. */
+    readonly blocking: readonly MissingAccess<ConvergeAccessCheck>[];
+}
+/**
+ * Split the self-check's missing permissions into roles the job grants
+ * itself and the rest. A check counts as repairable only when its whole
+ * shortfall is permissions of an allowlisted role it is marked with.
+ */
+export declare function selfGrantPlan(missing: readonly MissingAccess<ConvergeAccessCheck>[]): SelfGrantPlan;
 /** Every permission a converge run relies on after its decision (see the file comment). */
 export declare function convergeAccessChecks(target: {
     readonly projectId: string;
     readonly region: string;
     readonly env: string;
-}): AccessCheck[];
+}): ConvergeAccessCheck[];
 //# sourceMappingURL=converge-job-preflight.d.ts.map

package/dist/converge-job-preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-preflight.d.ts","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAG1E,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAG/E;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACpC,cAAc,EACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAkBnE,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,cAItC,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,WAAW,EAAE,CAyChB"}
+{"version":3,"file":"converge-job-preflight.d.ts","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAG1E,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAG9F;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACpC,cAAc,EACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA0BnE,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,cAItC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,cAAc,EAAsB,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,mPAU7B,CAAC;AAEX,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,cAAc,CAKxE;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,CAAC,mBAAmB,CAAC,EAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,aAAa,CAAC,mBAAmB,CAAC,EAAE,GACrD,aAAa,CAcf;AAED,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,mBAAmB,EAAE,CAyCxB"}

package/dist/converge-job-preflight.js

@@ -25,6 +25,23 @@
  *   - the Cloud SQL IAM login `ensureConvergeJob` creates (member of
  *     {@link UPGRADER_DB_ROLE}): the request row and the timeline.
  *
+ * Self-grant (maintainer decision 2026-11-03). A release may add a role to
+ * {@link INSTALL_JOB_ROLES} (0.11.11 added roles/workflows.editor for the
+ * scheduler tick, #1140); an install set up before it lacks that role until
+ * a converge's `ensureConvergeJob` grants it, and the converge job used to
+ * stop here and send the Owner to Cloud Shell for exactly that grant. Now a
+ * missing role of {@link CONVERGE_SELF_GRANTABLE_ROLES} — this release's own
+ * compiled-in list, nothing a request, a record or the environment names —
+ * is not a reason to stop: stage 1 leaves it to stage 2, and stage 2 (the
+ * target release's verified ops image, under the state lock) grants it to
+ * the provisioner at project level, records each grant on the timeline and
+ * asks IAM again (converge-job.ts). Not an escalation: the provisioner holds
+ * roles/resourcemanager.projectIamAdmin since install, so it could grant
+ * itself any role already; the allowlist only narrows what the job does
+ * with that. {@link SELF_GRANT_FORBIDDEN_ROLES} pins that the list never
+ * names an ownership or IAM-policy role, and the upgrader job — which holds
+ * no IAM rights at all — has no grant step.
+ *
  * Not checked: the permissions `pulumi up` needs for the stack. They are the
  * provisioner's PROVISIONER_ROLE_LIST (gcloud.ts), granted at install by the
  * Owner's own account; a converge cannot repair them and Pulumi names what
@@ -55,6 +72,14 @@ export const INSTALL_ROLE_USES = {
             "cloudscheduler.jobs.update",
         ],
     },
+    "roles/workflows.editor": {
+        need: "deploy and update the workflow the scheduler tick runs (#1140)",
+        permissions: [
+            "workflows.workflows.create",
+            "workflows.workflows.get",
+            "workflows.workflows.update",
+        ],
+    },
     "roles/logging.logWriter": {
         need: "write the update's progress to Cloud Logging",
         permissions: ["logging.logEntries.create"],
@@ -65,13 +90,63 @@ export const CONVERGE_PREFLIGHT_VOICE = {
     subject: "the converge job",
     repair: "Run the update once from Cloud Shell or the computer you installed from (Settings → Updates shows the command); it repairs the converge job's access.",
 };
+/**
+ * The roles the converge job may grant its own account when the self-check
+ * finds them missing: exactly the roles `ensureConvergeJob` grants it, as
+ * compiled into this release (see the file comment).
+ */
+export const CONVERGE_SELF_GRANTABLE_ROLES = INSTALL_JOB_ROLES;
+/**
+ * Roles the converge job must never grant itself, whatever a release's list
+ * says — ownership and IAM-policy roles (prefix matches). The tests assert
+ * {@link CONVERGE_SELF_GRANTABLE_ROLES} names none of them, and the grant
+ * step refuses them again at run time.
+ */
+export const SELF_GRANT_FORBIDDEN_ROLES = [
+    "roles/owner",
+    "roles/editor",
+    "roles/resourcemanager.",
+    "roles/iam.securityAdmin",
+    "roles/iam.organizationRoleAdmin",
+    "roles/iam.serviceAccountKeyAdmin",
+    "roles/iam.workloadIdentityPoolAdmin",
+    "roles/orgpolicy.",
+    "roles/billing.",
+];
+/** Whether the converge job may grant `role` to its own account (see the file comment). */
+export function isSelfGrantableRole(role) {
+    return (CONVERGE_SELF_GRANTABLE_ROLES.includes(role) &&
+        !SELF_GRANT_FORBIDDEN_ROLES.some((f) => role === f || (f.endsWith(".") && role.startsWith(f))));
+}
+/**
+ * Split the self-check's missing permissions into roles the job grants
+ * itself and the rest. A check counts as repairable only when its whole
+ * shortfall is permissions of an allowlisted role it is marked with.
+ */
+export function selfGrantPlan(missing) {
+    const grant = [];
+    const blocking = [];
+    for (const m of missing) {
+        const role = m.check.role;
+        if (role && isSelfGrantableRole(role) && !(m.unchecked && m.unchecked.length > 0)) {
+            if (!grant.includes(role))
+                grant.push(role);
+        }
+        else {
+            blocking.push(m);
+        }
+    }
+    const order = CONVERGE_SELF_GRANTABLE_ROLES;
+    grant.sort((a, b) => order.indexOf(a) - order.indexOf(b));
+    return { grant, blocking };
+}
 /** Every permission a converge run relies on after its decision (see the file comment). */
 export function convergeAccessChecks(target) {
     const { projectId, region, env } = target;
     const project = { kind: "project", projectId };
     const bucket = opsBucketName(projectId);
     return [
-        ...INSTALL_JOB_ROLES.map((role) => ({ resource: project, ...INSTALL_ROLE_USES[role] })),
+        ...INSTALL_JOB_ROLES.map((role) => ({ resource: project, role, ...INSTALL_ROLE_USES[role] })),
         {
             need: `read and write the install's records and state lock (${OPS_INSTALL_PREFIX}/) and the update's checkpoint (${CONVERGE_STATE_PREFIX}/) in the ops bucket`,
             resource: { kind: "bucket", bucket },

package/dist/converge-job-preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-preflight.js","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAG1B;IACF,qBAAqB,EAAE;QACrB,IAAI,EAAE,uEAAuE;QAC7E,WAAW,EAAE,CAAC,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,CAAC;KACvE;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,2EAA2E;QACjF,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,8CAA8C;QACpD,WAAW,EAAE,CAAC,2BAA2B,CAAC;KAC3C;CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EACJ,uJAAuJ;CAC1J,CAAC;AAEF,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,MAIpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAW,CAAC;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF;YACE,IAAI,EAAE,wDAAwD,kBAAkB,mCAAmC,qBAAqB,sBAAsB;YAC9J,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;YACpC,WAAW,EAAE;gBACX,sBAAsB;gBACtB,qBAAqB;gBACrB,wBAAwB;gBACxB,wBAAwB;aACzB;SACF;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE;YAC5E,WAAW,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;SACjE;QACD;YACE,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;SACpC;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,SAAS;gBACT,KAAK,EAAE,8BAA8B,CAAC,SAAS,CAAC;aACjD;YACD,WAAW,EAAE,CAAC,2BAA2B,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,kCAAkC,gBAAgB,4CAA4C;YACpG,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;SACpE;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"converge-job-preflight.js","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAG1B;IACF,qBAAqB,EAAE;QACrB,IAAI,EAAE,uEAAuE;QAC7E,WAAW,EAAE,CAAC,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,CAAC;KACvE;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,2EAA2E;QACjF,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,gEAAgE;QACtE,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,8CAA8C;QACpD,WAAW,EAAE,CAAC,2BAA2B,CAAC;KAC3C;CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EACJ,uJAAuJ;CAC1J,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA8B,iBAAiB,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,aAAa;IACb,cAAc;IACd,wBAAwB;IACxB,yBAAyB;IACzB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,kBAAkB;IAClB,gBAAgB;CACR,CAAC;AAEX,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,CACJ,6BAAmD,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/F,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsD;IAEtD,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAyC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,IAAI,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,6BAAkD,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,MAIpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAW,CAAC;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F;YACE,IAAI,EAAE,wDAAwD,kBAAkB,mCAAmC,qBAAqB,sBAAsB;YAC9J,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;YACpC,WAAW,EAAE;gBACX,sBAAsB;gBACtB,qBAAqB;gBACrB,wBAAwB;gBACxB,wBAAwB;aACzB;SACF;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE;YAC5E,WAAW,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;SACjE;QACD;YACE,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;SACpC;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,SAAS;gBACT,KAAK,EAAE,8BAA8B,CAAC,SAAS,CAAC;aACjD;YACD,WAAW,EAAE,CAAC,2BAA2B,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,kCAAkC,gBAAgB,4CAA4C;YACpG,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;SACpE;KACF,CAAC;AACJ,CAAC"}

package/dist/converge-job-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-setup.d.ts","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO3F;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,yDAA0D,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAMnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEN;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CA4B3E;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAiH9B"}
+{"version":3,"file":"converge-job-setup.d.ts","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO3F;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,yDAA0D,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAMnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEN;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CA4B3E;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAiH9B"}

package/dist/converge-job-setup.js

@@ -40,7 +40,10 @@
  *   - {@link INSTALL_JOB_ROLES} (the operator-access step of a converge
  *     creates a custom role and a Cloud Scheduler job, and the job's lines
  *     must reach Cloud Logging) — what an install-job install already
- *     grants; not an escalation, the provisioner holds projectIamAdmin;
+ *     grants; not an escalation, the provisioner holds projectIamAdmin. The
+ *     converge job of a release that adds a role here grants it itself when
+ *     it finds it missing (converge-job-preflight.ts, the self-grant), so
+ *     the role reaches an older install without a terminal run;
  *   - a Cloud SQL IAM database login that is a member of `platform_updater`
  *     only (migration 0267): it reads its request and writes the timeline,
  *     nothing else in the database.

package/dist/converge-job-setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-setup.js","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,wBAAwB,EAAE,kBAAkB,CAAU,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAEnD,2FAA2F;AAC3F,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,UAAU,GAAG,KAAK,CAAC;AA6BzB;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA2B;IAC/D,OAAO;QACL,KAAK;QACL,MAAM;QACN,QAAQ;QACR,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;QAC3B,WAAW,MAAM,CAAC,WAAW,EAAE;QAC/B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,qBAAqB,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QACvE,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,aAAa,uBAAuB,EAAE;QACtC,UAAU,oBAAoB,EAAE;QAChC,oEAAoE;QACpE,kBAAkB;QAClB,iBAAiB;QACjB,WAAW;QACX,qEAAqE;QACrE,kEAAkE;QAClE,iBAAiB;QACjB,kBAAkB,6BAA6B,GAAG;QAClD,SAAS,OAAO,EAAE;QAClB,YAAY,UAAU,EAAE;QACxB,8BAA8B;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,kBAAkB,WAAW,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAuB,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,0DAA0D,MAAM,CAAC,WAAW,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC;QAC5B,SAAS;QACT,SAAS;QACT,UAAU;QACV,QAAQ,MAAM,EAAE;QAChB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uBAAuB,MAAM,kBAAkB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,qFAAqF;SACrK,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,mBAAmB;IACnB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,WAAW;QACX,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,uBAAuB,WAAW,qBAAqB,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,6IAA6I;SAClO,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,yBAAyB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,WAAW;QAChC,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,qBAAqB;IACrB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAE/E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"converge-job-setup.js","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,wBAAwB,EAAE,kBAAkB,CAAU,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAEnD,2FAA2F;AAC3F,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,UAAU,GAAG,KAAK,CAAC;AA6BzB;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA2B;IAC/D,OAAO;QACL,KAAK;QACL,MAAM;QACN,QAAQ;QACR,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;QAC3B,WAAW,MAAM,CAAC,WAAW,EAAE;QAC/B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,qBAAqB,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QACvE,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,aAAa,uBAAuB,EAAE;QACtC,UAAU,oBAAoB,EAAE;QAChC,oEAAoE;QACpE,kBAAkB;QAClB,iBAAiB;QACjB,WAAW;QACX,qEAAqE;QACrE,kEAAkE;QAClE,iBAAiB;QACjB,kBAAkB,6BAA6B,GAAG;QAClD,SAAS,OAAO,EAAE;QAClB,YAAY,UAAU,EAAE;QACxB,8BAA8B;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,kBAAkB,WAAW,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAuB,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,0DAA0D,MAAM,CAAC,WAAW,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC;QAC5B,SAAS;QACT,SAAS;QACT,UAAU;QACV,QAAQ,MAAM,EAAE;QAChB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uBAAuB,MAAM,kBAAkB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,qFAAqF;SACrK,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,mBAAmB;IACnB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,WAAW;QACX,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,uBAAuB,WAAW,qBAAqB,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,6IAA6I;SAClO,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,yBAAyB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,WAAW;QAChC,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,qBAAqB;IACrB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAE/E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}