@caelo-cms/provisioning 0.11.10 → 0.11.12

package/dist/converge-job.d.ts

@@ -14,7 +14,9 @@
  *     verifies its signature (release-manifest.ts), and decides
  *     (upgrader-assess.ts, `route: "converge"`): no downgrade, nothing
  *     below minFromVersion, no automatic converge unless the policy allows
- *     it; then it checks its own IAM access (converge-job-preflight.ts).
+ *     it; then it checks its own IAM access (converge-job-preflight.ts) and
+ *     stops on anything missing — except a role of the self-grant
+ *     allowlist, which it leaves to stage 2.
  *     Then it verifies the target's ops image, points this job at it BY DIGEST and starts a new
  *     execution, handing the request over to it. It changes nothing else:
  *     the converge logic always comes from the release it installs.
@@ -23,7 +25,9 @@
  *     version is the request's). It verifies the manifest again, checks
  *     that the image it runs is the one the manifest signs, takes the
  *     install's state lock (#815; the upgrader job and the terminal
- *     `upgrade` take the same one, so they exclude each other), and runs
+ *     `upgrade` take the same one, so they exclude each other), grants its
+ *     own account the allowlisted roles the self-check found missing (each
+ *     a timeline event; IAM is asked again before it goes on), and runs
  *     the very upgrade the terminal runs (upgrade/upgrade.ts): backup →
  *     converge + app-roll → deep health check, rollback on failure →
  *     install.json + the infrastructure contract → the request's end.
@@ -43,7 +47,7 @@
  * the database (`caelo-ops converge-job`).
  */
 import type { ConvergeCheckpoint } from "./converge-checkpoint.js";
-import { type ExecutionState } from "./install-job.js";
+import { type ExecutionState, type InstallJobRole } from "./install-job.js";
 import type { InstallMetadata } from "./install-state.js";
 import { type ReleaseManifest, type ReleaseManifestResult } from "./release-manifest.js";
 import type { UpgradeCheckpoint } from "./upgrade/upgrade.js";
@@ -87,14 +91,51 @@ export type ConvergeUpgradeOutcome = {
     /** The new release serves but install.json could not record it (#860). */
     readonly unrecorded: boolean;
 };
+/**
+ * How long stage 2 waits for IAM to confirm the roles it granted itself:
+ * Google documents that a policy change usually applies within two minutes
+ * and can take seven (cloud.google.com/iam/docs/access-change-propagation).
+ */
+export declare const SELF_GRANT_RECHECK_INTERVAL_MS = 15000;
+export declare const SELF_GRANT_RECHECK_ATTEMPTS = 32;
+/** How {@link ConvergeJobDeps.secureDatabase} ended. */
+export type SecureDatabaseResult = {
+    readonly ok: true;
+    readonly host: string;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
 export interface ConvergeJobDeps {
     readonly queue: ConvergeQueue;
+    /**
+     * #1373 — the install's database TLS step (#1338, cloudsql-tls.ts), and
+     * then {@link queue} moved onto the database's DNS name with verify-full.
+     * Null when the queue already dials that name. Until it ran the queue
+     * dials the instance's IP (converge-db-trust.ts), so a failure of the
+     * step reaches the timeline and the request's end like any other step;
+     * when it fails the queue is reopened on whatever the install dials then.
+     */
+    readonly secureDatabase: (() => Promise<SecureDatabaseResult>) | null;
     /** From the metadata server — never from env or argv. */
     readonly projectId: string;
     /** The region this job runs in (metadata server). */
     readonly region: string;
     /** Asks IAM as this job's own identity (the IAM self-check, #884). */
     readonly iam: IamTester;
+    /**
+     * Grant this job's own account (the install's provisioner) `role` on the
+     * project. Stage 2 only, and only for roles of the self-grant allowlist
+     * (converge-job-preflight.ts); the real one refuses any other role.
+     */
+    readonly grantOwnRole: (role: InstallJobRole) => Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly error: string;
+    }>;
+    /** Waits between the IAM re-checks after a self-grant. */
+    readonly sleep: (ms: number) => Promise<void>;
     /** This Cloud Run execution; null outside Cloud Run. */
     readonly execution: string | null;
     /** The Caelo release this code belongs to (CAELO_VERSION of the image). */

package/dist/converge-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job.d.ts","sourceRoot":"","sources":["../src/converge-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EACL,KAAK,SAAS,EAIf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,aAAa,EAIlB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,aAAa,EAAiB,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAExF,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;IAC/D;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AAED,2EAA2E;AAC3E,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEN,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5E,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACnD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtD,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,CACnB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAC5B;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GACjD;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CACjD,CAAC;IACF,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACvE,QAAQ,CAAC,cAAc,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;IACzD,QAAQ,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACnE,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;QACnC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;QAC/C,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;KAChE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwZtF"}
+{"version":3,"file":"converge-job.d.ts","sourceRoot":"","sources":["../src/converge-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQnE,OAAO,EAAoB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EACL,KAAK,SAAS,EAKf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,aAAa,EAIlB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,aAAa,EAAiB,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAExF,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;IAC/D;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AAED,2EAA2E;AAC3E,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAAS,CAAC;AACrD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,wDAAwD;AACxD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,CACrB,IAAI,EAAE,cAAc,KACjB,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5E,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACnD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtD,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,CACnB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAC5B;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GACjD;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CACjD,CAAC;IACF,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACvE,QAAQ,CAAC,cAAc,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;IACzD,QAAQ,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACnE,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;QACnC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;QAC/C,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;KAChE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAygBtF"}

package/dist/converge-job.js

@@ -1,13 +1,21 @@
 // SPDX-License-Identifier: MPL-2.0
-import { CONVERGE_PREFLIGHT_VOICE, convergeAccessChecks } from "./converge-job-preflight.js";
+import { CONVERGE_PREFLIGHT_VOICE, convergeAccessChecks, INSTALL_ROLE_USES, selfGrantPlan, } from "./converge-job-preflight.js";
 import { GCP_STACK_ENV } from "./gcp-names.js";
 import { decideInstallJob } from "./install-job.js";
+import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
 import { compareSemver, } from "./release-manifest.js";
 import { StateLockHeldError } from "./state-store.js";
 import { assessUpgradeRequest } from "./upgrader-assess.js";
-import { preflightErrorReason, preflightMissingReason, runIamPreflight, } from "./upgrader-iam-preflight.js";
+import { missingAccessText, preflightErrorReason, preflightMissingReason, runIamPreflight, } from "./upgrader-iam-preflight.js";
 import { recordUpdateEnd, } from "./upgrader-job.js";
 import { eventReporter } from "./upgrader-reporter.js";
+/**
+ * How long stage 2 waits for IAM to confirm the roles it granted itself:
+ * Google documents that a policy change usually applies within two minutes
+ * and can take seven (cloud.google.com/iam/docs/access-change-propagation).
+ */
+export const SELF_GRANT_RECHECK_INTERVAL_MS = 15_000;
+export const SELF_GRANT_RECHECK_ATTEMPTS = 32;
 /** Run the converge job once. Never throws; see the file comment. */
 export async function runConvergeJob(deps) {
     const { queue, log } = deps;
@@ -137,19 +145,32 @@ export async function runConvergeJob(deps) {
         const m = decision.manifest;
         // #884 — decided to run: ask IAM for what the rest needs before the
         // lock, the hand-over or the backup (converge-job-preflight.ts). Both
-        // stages ask; stage 2's list is the target release's own.
-        const access = await runIamPreflight(convergeAccessChecks({ projectId: deps.projectId, region: deps.region, env: GCP_STACK_ENV }), deps.iam);
-        if (access.kind === "missing") {
-            return stopWith("needs_cloud_shell", ["iam-preflight"], preflightMissingReason(access.missing, CONVERGE_PREFLIGHT_VOICE));
-        }
+        // stages ask; stage 2's list is the target release's own. A missing
+        // role of the self-grant allowlist does not stop the run: stage 2
+        // grants it once it has verified its own image and holds the lock.
+        const stage1 = compareSemver(deps.ownVersion, m.version) !== 0;
+        const access = await askIam();
         if (access.kind === "error") {
             return stopWith("failed", ["iam-preflight"], preflightErrorReason(access.errors, CONVERGE_PREFLIGHT_VOICE));
         }
-        r.info("The converge job has every permission this update needs.");
-        if (compareSemver(deps.ownVersion, m.version) !== 0) {
+        let toGrant = [];
+        if (access.kind === "missing") {
+            const plan = selfGrantPlan(access.missing);
+            if (plan.blocking.length > 0) {
+                return stopWith("needs_cloud_shell", ["iam-preflight"], preflightMissingReason(access.missing, CONVERGE_PREFLIGHT_VOICE));
+            }
+            toGrant = plan.grant;
+        }
+        if (toGrant.length === 0) {
+            r.info("The converge job has every permission this update needs.");
+        }
+        else {
+            r.info(`The converge job's account lacks ${toGrant.join(", ")}, which this update needs. ${stage1 ? `The installer of ${m.version} grants them to it` : "It grants them to itself"} before it changes anything, once its own installer image is verified.`);
+        }
+        if (stage1) {
             return await handOver(m);
         }
-        return await convergeHere(m, fromVersion ?? meta.releaseVersion, checkpoint, meta);
+        return await convergeHere(m, fromVersion ?? meta.releaseVersion, checkpoint, meta, toGrant);
     }
     catch (e) {
         return stopWith("failed", ["internal"], `The converge job stopped unexpectedly: ${errorText(e)}. If the site misbehaves, check Settings → Updates and the job's log.`);
@@ -190,7 +211,7 @@ export async function runConvergeJob(deps) {
         return { exitCode: 0, requestId: request.id, status: null };
     }
     /** Stage 2: this image is the release's own installer; converge + roll. */
-    async function convergeHere(m, fromVersion, checkpoint, judged) {
+    async function convergeHere(m, fromVersion, checkpoint, judged, toGrant) {
         const installId = judged.installId;
         const own = await deps.ownImageDigest();
         // Cloud Run records the linux/amd64 platform manifest it resolved, not
@@ -221,6 +242,13 @@ export async function runConvergeJob(deps) {
         const stale = recordsChangedSince(judged, changed);
         if (stale)
             return stopWith(stale.status, stale.codes, stale.reason);
+        // After the image check and under the lock: only the target release's
+        // verified installer grants, and only roles of its own allowlist.
+        if (toGrant.length > 0) {
+            const granted = await grantOwnRoles(m, toGrant, changed);
+            if (granted)
+                return stopWith(granted.status, granted.codes, granted.reason);
+        }
         const startedAt = deps.now().toISOString();
         let current = {
             statusVersion: 1,
@@ -244,6 +272,18 @@ export async function runConvergeJob(deps) {
         // Written before any change: a run killed from here on is resumable.
         save({});
         r.phase("converge");
+        // #1373 — stage 2 only, under the lock and after every check: it
+        // changes the database instance, its DNS and the services' URLs.
+        if (deps.secureDatabase) {
+            r.info("Setting up verified encryption for the database connection (the database's certificate and its private DNS name).");
+            await r.flush();
+            const secured = await deps.secureDatabase();
+            if (!secured.ok) {
+                save({ state: "failed", phase: "stopped" });
+                return stopWith("failed", ["database-tls"], `The update to ${m.version} stopped at the database's TLS step, before it rolled anything: ${secured.error}. The previous release keeps serving. Fix what it names and start the update again; it continues where it stopped.`);
+            }
+            r.success(`The database connection is verified (${secured.host}).`);
+        }
         const outcome = await deps.upgrade({
             manifest: m,
             reporter: r,
@@ -282,6 +322,60 @@ export async function runConvergeJob(deps) {
         }
         return stopWith("failed", ["converge"], `The update to ${m.version} stopped before it finished (see the timeline above); the previous release keeps serving. Fix what it names and start the update again; it continues where it stopped.`);
     }
+    /** The converge self-check against IAM, as this job's identity. */
+    function askIam() {
+        return runIamPreflight(convergeAccessChecks({ projectId: deps.projectId, region: deps.region, env: GCP_STACK_ENV }), deps.iam);
+    }
+    /**
+     * Stage 2: grant this job's account each role in `roles` (the self-check
+     * found them missing; all are on the allowlist), then wait until IAM
+     * confirms the whole self-check. Null when it does; how the request ends
+     * otherwise.
+     */
+    async function grantOwnRoles(m, roles, changed) {
+        const account = provisionerServiceAccountEmail(deps.projectId);
+        const granted = [];
+        const before = () => changed
+            ? "This update already started changing the site; "
+            : granted.length > 0
+                ? `Nothing on the site was changed (the converge job's account got ${granted.join(", ")}): `
+                : "Nothing was changed: ";
+        for (const role of roles) {
+            const result = await deps.grantOwnRole(role);
+            if (!result.ok) {
+                return {
+                    status: "needs_cloud_shell",
+                    codes: ["iam-self-grant"],
+                    reason: `${before()}the converge job could not grant its own account (${account}) ${role}, which Caelo ${m.version} needs to ${INSTALL_ROLE_USES[role].need} (${result.error}). ${CONVERGE_PREFLIGHT_VOICE.repair}`,
+                };
+            }
+            granted.push(role);
+            r.success(`Granted ${role} to the converge job's account (${account}), needed by Caelo ${m.version} to ${INSTALL_ROLE_USES[role].need}.`);
+        }
+        await r.flush();
+        let last = await askIam();
+        for (let attempt = 1; last.kind !== "ok" && attempt < SELF_GRANT_RECHECK_ATTEMPTS; attempt++) {
+            await deps.sleep(SELF_GRANT_RECHECK_INTERVAL_MS);
+            last = await askIam();
+        }
+        if (last.kind === "ok") {
+            r.info("IAM confirms the granted roles; the converge job has every permission this update needs.");
+            return null;
+        }
+        const minutes = Math.round((SELF_GRANT_RECHECK_INTERVAL_MS * (SELF_GRANT_RECHECK_ATTEMPTS - 1)) / 60_000);
+        if (last.kind === "error") {
+            return {
+                status: "failed",
+                codes: ["iam-self-grant"],
+                reason: `${before()}after granting its own account ${granted.join(", ")}, the converge job could not check its access again (${last.errors.join("; ")}). Start the update again from Settings → Updates in a few minutes.`,
+            };
+        }
+        return {
+            status: "needs_cloud_shell",
+            codes: ["iam-self-grant"],
+            reason: `${before()}the converge job granted its own account ${granted.join(", ")}, but ${minutes} minutes later Google Cloud still reports permissions missing — ${missingAccessText(last.missing)}. ${CONVERGE_PREFLIGHT_VOICE.repair}`,
+        };
+    }
     /**
      * Whether install.json, re-read under the lock, is still what the run was
      * judged on; how the request ends otherwise.

package/dist/converge-job.js.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job.js","sourceRoot":"","sources":["../src/converge-job.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAgDnC,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAuB,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EACL,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAEL,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,eAAe,GAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAsB,aAAa,EAAe,MAAM,wBAAwB,CAAC;AA8FxF,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,CAAC,GAAG,aAAa,CACrB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EACzE,GAAG,EACH,OAAO,CAAC,EAAE,CACX,CAAC;IACF,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,OAAe,EAAqB,EAAE;QACnD,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC;IACF,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAc,EAA8B,EAAE;QAClE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,CAAC,CAAC,OAAO,CAAC,SAAS,OAAO,CAAC,aAAa,gBAAgB,CAAC,CAAC;;YACrF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACjF,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAuB,EAAE,KAAwB,EAAE,MAAc,EAAE,EAAE,CACrF,MAAM,CAAC;QACL,MAAM;QACN,MAAM;QACN,KAAK;QACL,gBAAgB,EACd,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;KAClF,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,mEAAmE;QACnE,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CAAC,aAAa,KAAK,CAAC,SAAS,6CAA6C,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACzE,OAAO,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC/E,CAAC;YACD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,4BAA4B,OAAO,CAAC,aAAa,SAAS,IAAI,CAAC,SAAS,qBAAqB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,+BAA+B,CACzK,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,uBAAuB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,OAAO,CAAC,aAAa,iEAAiE,CACpL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,mCAAmC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACxF,CAAC;QAED,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/C,OAAO,QAAQ,CACb,mBAAmB,EACnB,CAAC,eAAe,CAAC,EACjB,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChE,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,UAAU,CAAC,EACZ,oEAAoE,IAAI,CAAC,QAAQ,GAAG,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC;QACvF,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,WAAW,GACf,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtC,CAAC,CAAC,UAAU,CAAC,WAAW;YACxB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9F,CAAC,CAAC,IAAI,CAAC,8CAA8C,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,OAAO;YACP,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC,EAAE;YACzF,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,OAAO,CACP,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,OAAO,gDAAgD,CACpG,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC7B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;gBAC5C,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ;gBACzD,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,CAAC,oBAAoB;gBAC7D,sBAAsB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC;gBACtD,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;gBAC5C,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;gBAChD,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG;aACzC,CAAC,CAAC;QACL,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAE5B,oEAAoE;QACpE,sEAAsE;QACtE,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAC5F,IAAI,CAAC,GAAG,CACT,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,QAAQ,CACb,mBAAmB,EACnB,CAAC,eAAe,CAAC,EACjB,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,wBAAwB,CAAC,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,eAAe,CAAC,EACjB,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAC9D,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAEnE,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,YAAY,CAAC,CAAC,EAAE,WAAW,IAAK,IAAI,CAAC,cAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,0CAA0C,SAAS,CAAC,CAAC,CAAC,uEAAuE,CAC9H,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,UAAU,QAAQ,CAAC,CAAkB;QACxC,CAAC,CAAC,IAAI,CACJ,mCAAmC,IAAI,CAAC,UAAU,sCAAsC,CAAC,CAAC,OAAO,sEAAsE,CACxK,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,0BAA0B,CAAC,CAAC,OAAO,qEAAqE,CACzG,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,2BAA2B,OAAO,CAAC,KAAK,2BAA2B,CACtH,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,0BAA0B,OAAO,CAAC,KAAK,2BAA2B,CACrH,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,kBAAkB,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC;YACF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAAS,EAAE;YAC9C,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,YAAY,CACzB,CAAkB,EAClB,WAAmB,EACnB,UAAqC,EACrC,MAAuB;QAEvB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,oDAAoD,GAAG,IAAI,SAAS,wDAAwD,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,oDAAoD,CACvN,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,MAAM,IAAI,GACR,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YACnD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CACV,aAAa,OAAO,CAAC,MAAM,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,aAAa,KAAK,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtF,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,OAAO,GAAG,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,OAAO,GAAuB;YAChC,aAAa,EAAE,CAAC;YAChB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW;YACxC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,UAAU;YACjB,YAAY,EAAE,IAAI,CAAC,UAAU;YAC7B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,CAAC,CAAC,OAAO;YACxB,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,KAAkC,EAAE,EAAE;YAClD,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACxE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,qEAAqE;QACrE,IAAI,CAAC,EAAE,CAAC,CAAC;QAET,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,UAAU;gBAChB,CAAC,CAAC;oBACE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF;gBACH,CAAC,CAAC,SAAS;YACb,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBAClB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAC7E,GAAG,CAAC;wBACF,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,kDAAkD,SAAS,CAAC,CAAC,CAAC,EAAE;wBACzE,SAAS,EAAE,OAAO,CAAC,EAAE;qBACtB,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,CAAC,cAAc;oBAAE,IAAI,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,CAAC,CAAC,IAAI,CACJ,8GAA8G,CAC/G,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,yMAAyM,CAC5N,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,aAAa,EACb,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,4GAA4G,CAC/H,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,iBAAiB,CAAC,CAAC,OAAO,wKAAwK,CACnM,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAC1B,MAAuB,EACvB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC,oBAAoB,CAAC;gBAC7B,MAAM,EAAE,GAAG,MAAM,wFAAwF,SAAS,CAAC,CAAC,CAAC,2DAA2D;aACjL,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,uBAAuB,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,4LAA4L;SAC9M,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,WAAW,CAClB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;gBACpC,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,CAAC,cAAc,CAAC;oBACvB,MAAM,EAAE,GAAG,MAAM,sDAAsD,SAAS,CAAC,CAAC,CAAC,gFAAgF;iBACpK,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,CAAC,cAAc,CAAC;gBACvB,MAAM,EAAE,GAAG,MAAM,6DAA6D,SAAS,CAAC,CAAC,CAAC,sGAAsG;aACjM,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"converge-job.js","sourceRoot":"","sources":["../src/converge-job.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAoDnC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,GACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAA4C,MAAM,kBAAkB,CAAC;AAE9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EACL,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAEL,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,eAAe,GAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAsB,aAAa,EAAe,MAAM,wBAAwB,CAAC;AA4CxF;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AA4E9C,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,CAAC,GAAG,aAAa,CACrB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EACzE,GAAG,EACH,OAAO,CAAC,EAAE,CACX,CAAC;IACF,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,OAAe,EAAqB,EAAE;QACnD,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC;IACF,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAc,EAA8B,EAAE;QAClE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,CAAC,CAAC,OAAO,CAAC,SAAS,OAAO,CAAC,aAAa,gBAAgB,CAAC,CAAC;;YACrF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACjF,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAuB,EAAE,KAAwB,EAAE,MAAc,EAAE,EAAE,CACrF,MAAM,CAAC;QACL,MAAM;QACN,MAAM;QACN,KAAK;QACL,gBAAgB,EACd,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;KAClF,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,mEAAmE;QACnE,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CAAC,aAAa,KAAK,CAAC,SAAS,6CAA6C,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACzE,OAAO,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC/E,CAAC;YACD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,4BAA4B,OAAO,CAAC,aAAa,SAAS,IAAI,CAAC,SAAS,qBAAqB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,+BAA+B,CACzK,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,uBAAuB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,OAAO,CAAC,aAAa,iEAAiE,CACpL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,mCAAmC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACxF,CAAC;QAED,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/C,OAAO,QAAQ,CACb,mBAAmB,EACnB,CAAC,eAAe,CAAC,EACjB,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChE,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,UAAU,CAAC,EACZ,oEAAoE,IAAI,CAAC,QAAQ,GAAG,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC;QACvF,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,WAAW,GACf,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtC,CAAC,CAAC,UAAU,CAAC,WAAW;YACxB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9F,CAAC,CAAC,IAAI,CAAC,8CAA8C,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,OAAO;YACP,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC,EAAE;YACzF,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,OAAO,CACP,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,OAAO,gDAAgD,CACpG,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC7B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;gBAC5C,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ;gBACzD,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,CAAC,oBAAoB;gBAC7D,sBAAsB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC;gBACtD,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;gBAC5C,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;gBAChD,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG;aACzC,CAAC,CAAC;QACL,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAE5B,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,eAAe,CAAC,EACjB,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAA8B,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CACb,mBAAmB,EACnB,CAAC,eAAe,CAAC,EACjB,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,wBAAwB,CAAC,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CACJ,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,0BAA0B,wEAAwE,CACpP,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,YAAY,CACvB,CAAC,EACD,WAAW,IAAK,IAAI,CAAC,cAAyB,EAC9C,UAAU,EACV,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,0CAA0C,SAAS,CAAC,CAAC,CAAC,uEAAuE,CAC9H,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,UAAU,QAAQ,CAAC,CAAkB;QACxC,CAAC,CAAC,IAAI,CACJ,mCAAmC,IAAI,CAAC,UAAU,sCAAsC,CAAC,CAAC,OAAO,sEAAsE,CACxK,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,0BAA0B,CAAC,CAAC,OAAO,qEAAqE,CACzG,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,2BAA2B,OAAO,CAAC,KAAK,2BAA2B,CACtH,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,0BAA0B,OAAO,CAAC,KAAK,2BAA2B,CACrH,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,kBAAkB,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC;YACF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAAS,EAAE;YAC9C,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,YAAY,CACzB,CAAkB,EAClB,WAAmB,EACnB,UAAqC,EACrC,MAAuB,EACvB,OAAkC;QAElC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,oDAAoD,GAAG,IAAI,SAAS,wDAAwD,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,oDAAoD,CACvN,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,MAAM,IAAI,GACR,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YACnD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CACV,aAAa,OAAO,CAAC,MAAM,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,aAAa,KAAK,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtF,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,OAAO,GAAG,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,OAAO;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,OAAO,GAAuB;YAChC,aAAa,EAAE,CAAC;YAChB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW;YACxC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,UAAU;YACjB,YAAY,EAAE,IAAI,CAAC,UAAU;YAC7B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,CAAC,CAAC,OAAO;YACxB,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,KAAkC,EAAE,EAAE;YAClD,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACxE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,qEAAqE;QACrE,IAAI,CAAC,EAAE,CAAC,CAAC;QAET,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpB,iEAAiE;QACjE,iEAAiE;QACjE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,CAAC,CAAC,IAAI,CACJ,mHAAmH,CACpH,CAAC;YACF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC5C,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,cAAc,CAAC,EAChB,iBAAiB,CAAC,CAAC,OAAO,mEAAmE,OAAO,CAAC,KAAK,oHAAoH,CAC/N,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,OAAO,CAAC,wCAAwC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,UAAU;gBAChB,CAAC,CAAC;oBACE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF;gBACH,CAAC,CAAC,SAAS;YACb,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBAClB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAC7E,GAAG,CAAC;wBACF,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,kDAAkD,SAAS,CAAC,CAAC,CAAC,EAAE;wBACzE,SAAS,EAAE,OAAO,CAAC,EAAE;qBACtB,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,CAAC,cAAc;oBAAE,IAAI,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,CAAC,CAAC,IAAI,CACJ,8GAA8G,CAC/G,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,yMAAyM,CAC5N,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,aAAa,EACb,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,4GAA4G,CAC/H,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,iBAAiB,CAAC,CAAC,OAAO,wKAAwK,CACnM,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,SAAS,MAAM;QACb,OAAO,eAAe,CACpB,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAC5F,IAAI,CAAC,GAAG,CACT,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,aAAa,CAC1B,CAAkB,EAClB,KAAgC,EAChC,OAAgB;QAEhB,MAAM,OAAO,GAAG,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,OAAO;YACL,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAClB,CAAC,CAAC,mEAAmE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAC5F,CAAC,CAAC,uBAAuB,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,KAAK,EAAE,CAAC,gBAAgB,CAAC;oBACzB,MAAM,EAAE,GAAG,MAAM,EAAE,qDAAqD,OAAO,KAAK,IAAI,iBAAiB,CAAC,CAAC,OAAO,aAAa,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,MAAM,wBAAwB,CAAC,MAAM,EAAE;iBACpN,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC,CAAC,OAAO,CACP,WAAW,IAAI,mCAAmC,OAAO,sBAAsB,CAAC,CAAC,OAAO,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAC/H,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,2BAA2B,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7F,MAAM,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACjD,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,CAAC,CAAC,IAAI,CACJ,0FAA0F,CAC3F,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,CAAC,8BAA8B,GAAG,CAAC,2BAA2B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAC9E,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC,gBAAgB,CAAC;gBACzB,MAAM,EAAE,GAAG,MAAM,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE;aAC3N,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,mBAAmB;YAC3B,KAAK,EAAE,CAAC,gBAAgB,CAAC;YACzB,MAAM,EAAE,GAAG,MAAM,EAAE,4CAA4C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,mEAAmE,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,wBAAwB,CAAC,MAAM,EAAE;SAC1O,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAC1B,MAAuB,EACvB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC,oBAAoB,CAAC;gBAC7B,MAAM,EAAE,GAAG,MAAM,wFAAwF,SAAS,CAAC,CAAC,CAAC,2DAA2D;aACjL,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,uBAAuB,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,4LAA4L;SAC9M,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,WAAW,CAClB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;gBACpC,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,CAAC,cAAc,CAAC;oBACvB,MAAM,EAAE,GAAG,MAAM,sDAAsD,SAAS,CAAC,CAAC,CAAC,gFAAgF;iBACpK,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,CAAC,cAAc,CAAC;gBACvB,MAAM,EAAE,GAAG,MAAM,6DAA6D,SAAS,CAAC,CAAC,CAAC,sGAAsG;aACjM,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/gcp-names.d.ts

@@ -123,6 +123,19 @@ export declare function captureJobResource(projectId: string, region: string, en
 export declare function captureServiceAccountId(env: string): string;
 /** Email of the capture job's service account. */
 export declare function captureServiceAccountEmail(projectId: string, env: string): string;
+/**
+ * #1140 — account id of the scheduler tick's service account: signs its own
+ * IAP credential and calls the admin's tick endpoint, nothing else
+ * (scheduler-setup.ts). `caelo-production-scheduler` is 26 of the 30
+ * characters an account id may have.
+ */
+export declare function schedulerServiceAccountId(env: string): string;
+/** Email of the scheduler tick's service account. */
+export declare function schedulerServiceAccountEmail(projectId: string, env: string): string;
+/** #1140 — the Cloud Workflows workflow one scheduler tick runs (scheduler-setup.ts). */
+export declare function schedulerWorkflowName(env: string): string;
+/** #1140 — the Cloud Scheduler job that starts the tick workflow every N minutes. */
+export declare function schedulerJobName(env: string): string;
 /**
  * Account id of the upgrader job's own service account: may roll the two
  * Cloud Run services, run the migration job and back up Cloud SQL, never

package/dist/gcp-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAGA;AAED,+DAA+D;AAC/D,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,GACnE,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,gDAAgD;AAChD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,kDAAkD;AAClD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mDAAmD;AACnD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAO1D,CAAC"}
+{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG;IAClD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAGA;AAED,+DAA+D;AAC/D,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,GACnE,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,gDAAgD;AAChD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,kDAAkD;AAClD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,qDAAqD;AACrD,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnF;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mDAAmD;AACnD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAO1D,CAAC"}

package/dist/gcp-names.js

@@ -180,6 +180,27 @@ export function captureServiceAccountId(env) {
 export function captureServiceAccountEmail(projectId, env) {
     return `${captureServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
 }
+/**
+ * #1140 — account id of the scheduler tick's service account: signs its own
+ * IAP credential and calls the admin's tick endpoint, nothing else
+ * (scheduler-setup.ts). `caelo-production-scheduler` is 26 of the 30
+ * characters an account id may have.
+ */
+export function schedulerServiceAccountId(env) {
+    return `${gcpNamePrefix(env)}-scheduler`;
+}
+/** Email of the scheduler tick's service account. */
+export function schedulerServiceAccountEmail(projectId, env) {
+    return `${schedulerServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
+}
+/** #1140 — the Cloud Workflows workflow one scheduler tick runs (scheduler-setup.ts). */
+export function schedulerWorkflowName(env) {
+    return `${gcpNamePrefix(env)}-scheduler-tick`;
+}
+/** #1140 — the Cloud Scheduler job that starts the tick workflow every N minutes. */
+export function schedulerJobName(env) {
+    return `${gcpNamePrefix(env)}-scheduler-tick`;
+}
 /**
  * Account id of the upgrader job's own service account: may roll the two
  * Cloud Run services, run the migration job and back up Cloud SQL, never

package/dist/gcp-names.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAK/C,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACtD,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;AAC3F,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,+BAA+B,CAAC,SAAiB,EAAE,GAAW;IAC5E,OAAO,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAoE;IAEpE,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC7E,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,GAAW;IACrE,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC/E,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;AACzC,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,SAAS,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,kBAAkB,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,4BAA4B;IAC5B,6BAA6B;IAC7B,8BAA8B;CAC/B,CAAC"}
+{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAK/C,MAAM,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACtD,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;AAC3F,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,+BAA+B,CAAC,SAAiB,EAAE,GAAW;IAC5E,OAAO,GAAG,4BAA4B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAoE;IAEpE,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC7E,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,GAAW;IACrE,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC/E,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;AACzC,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;AAC3C,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,4BAA4B,CAAC,SAAiB,EAAE,GAAW;IACzE,OAAO,GAAG,yBAAyB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAClF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,SAAS,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,kBAAkB,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,4BAA4B;IAC5B,6BAA6B;IAC7B,8BAA8B;CAC/B,CAAC"}

package/dist/index.d.ts

@@ -19,7 +19,8 @@ export { type BootstrapToken, generateBootstrapToken, } from "./bootstrap-token.
 export { type CaddyDomainSpec, type CaddyfileSpec, generateCaddyfile, } from "./caddy.js";
 export { type CdnCopyAdapter, loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { type ComposeSpec, generateDockerCompose, type RolePasswords } from "./compose.js";
-export { type ConvergeClaim, type ConvergeJobDeps, type ConvergeQueue, type ConvergeUpgradeOutcome, runConvergeJob, } from "./converge-job.js";
+export { type ConvergeDatabaseTarget, convergeDatabaseTarget, serverIdentityProblem, } from "./converge-db-trust.js";
+export { type ConvergeClaim, type ConvergeJobDeps, type ConvergeQueue, type ConvergeUpgradeOutcome, runConvergeJob, type SecureDatabaseResult, } from "./converge-job.js";
 export { convergeExecutionNameError, gcpConvergeDeps } from "./converge-job-gcp.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
 export { INFRA_CONTRACT_PATHS, isInfraContractPath, RELEASE_MIN_FROM_VERSION, } from "./release-contract.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,SAAS,EACT,WAAW,EACX,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,cAAc,EACnB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAE,qBAAqB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EACL,KAAK,sBAAsB,EAC3B,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,cAAc,EACd,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,KAAK,cAAc,EACnB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,KAAK,iBAAiB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,aAAa,EAClB,cAAc,EACd,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -3,6 +3,7 @@ export { generateBootstrapToken, } from "./bootstrap-token.js";
 export { generateCaddyfile, } from "./caddy.js";
 export { loadCdnCopyAdapter, selfHostedCdnCopy, } from "./cdn-copy.js";
 export { generateDockerCompose } from "./compose.js";
+export { convergeDatabaseTarget, serverIdentityProblem, } from "./converge-db-trust.js";
 export { runConvergeJob, } from "./converge-job.js";
 export { convergeExecutionNameError, gcpConvergeDeps } from "./converge-job-gcp.js";
 export { INFRA_CONTRACT_VERSION } from "./infra-contract.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAKL,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,eAAe,EAEf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,cAAc,GAOf,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAEL,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAEL,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,cAAc,CAAC;AAC3F,OAAO,EAEL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAKL,cAAc,GAEf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EAEb,4BAA4B,EAI5B,gBAAgB,EAChB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EAQnB,qBAAqB,EACrB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,eAAe,EAEf,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,cAAc,GAOf,MAAM,mBAAmB,CAAC"}

package/dist/infra-contract.d.ts

@@ -20,7 +20,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export declare const INFRA_CONTRACT_VERSION = 16;
+export declare const INFRA_CONTRACT_VERSION = 18;
 /**
  * What each contract version adds, in operator terms — the upgrader's
  * refusal names the steps an install is missing. Keep one entry per version

package/dist/infra-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AA8GzC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBjE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}
+{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAiIzC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBjE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/infra-contract.js

@@ -21,7 +21,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 16;
+export const INFRA_CONTRACT_VERSION = 18;
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
 //   1 — epic #696 split: converge vs app-roll.
@@ -129,6 +129,25 @@ export const INFRA_CONTRACT_VERSION = 16;
 //       services, accounts, IAM and load-balancer resources — none of which
 //       the in-cloud upgrader may create, and the app-roll rolls three
 //       services from now on.
+//  17 — #1329: staging's own database. The Cloud SQL database
+//       `cms_public_staging`, the Admin API user `public_staging_role` (its
+//       password the new CLI-generated secret `public-staging-role-password`)
+//       and its membership revoke; the admin's PUBLIC_STAGING_ADMIN_DATABASE_URL
+//       and the gateway's CAELO_GATEWAY_ENVIRONMENT. The in-cloud upgrader
+//       may create no database, user or secret, and the new admin and
+//       gateway refuse to start without them. Additive only (converge
+//       release 1 of the gateway hardening): nothing is served from the
+//       staging database yet, so rolling back stays harmless.
+//  18 — #1140: the scheduler tick (scheduler-setup.ts). Its service account
+//       (token creator on itself, workflows.invoker, logWriter, IAP access to
+//       the admin), the Cloud Workflows workflow that signs its IAP JWT and
+//       calls the admin's /api/internal/scheduler/tick, the one Cloud
+//       Scheduler job that starts it every schedulerIntervalMinutes, the
+//       operator-access job's CAELO_OPERATOR_ACCESS_IAP_SERVICE_ACCOUNTS (so
+//       its sync keeps the account on IAP) and CAELO_SCHEDULER_SERVICE_ACCOUNT
+//       on the admin. The new admin runs its periodic work and plugin workers
+//       only on that tick, so an in-cloud upgrader must not roll an install
+//       onto it before the tick exists.
 /**
  * What each contract version adds, in operator terms — the upgrader's
  * refusal names the steps an install is missing. Keep one entry per version
@@ -151,6 +170,8 @@ export const INFRA_CONTRACT_STEPS = {
     14: "the capture job that takes server-side screenshots outside the admin, its service account, bucket and grants (#1217)",
     15: "verified TLS to the database: Cloud SQL's shared server CA, encrypted connections only, and a private DNS name the services dial (#1338)",
     16: "the MCP sign-in service as its own Cloud Run service with its own account (no database access), the visitor gateway as its own service on Firebase installs, and on Google Cloud load-balancer installs the sign-in service's backend and Cloud Armor rule (#1328)",
+    17: "the staging site's own database and its gateway login, kept apart from the live data (#1329)",
+    18: "the scheduler tick that runs the admin's periodic work and plugin workers every few minutes: its service account, workflow and Cloud Scheduler job, and its IAP access (#1140)",
 };
 /**
  * The steps an install at contract `installed` lacks for `target`, oldest

package/dist/infra-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAC9D,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,6DAA6D;AAC7D,gEAAgE;AAChE,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,4BAA4B;AAC5B,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wCAAwC;AACxC,4EAA4E;AAC5E,wDAAwD;AACxD,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,6DAA6D;AAC7D,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,8CAA8C;AAC9C,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,kDAAkD;AAClD,2EAA2E;AAC3E,yEAAyE;AACzE,yDAAyD;AACzD,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,2CAA2C;AAC3C,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,oEAAoE;AACpE,uEAAuE;AACvE,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,8DAA8D;AAC9D,2EAA2E;AAC3E,mEAAmE;AACnE,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,oEAAoE;AACpE,4EAA4E;AAC5E,uEAAuE;AACvE,8BAA8B;AAE9B;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;IAC5E,CAAC,EAAE,mEAAmE;IACtE,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,wEAAwE;IAC3E,CAAC,EAAE,8EAA8E;IACjF,CAAC,EAAE,mIAAmI;IACtI,EAAE,EAAE,sKAAsK;IAC1K,EAAE,EAAE,wKAAwK;IAC5K,EAAE,EAAE,sIAAsI;IAC1I,EAAE,EAAE,uKAAuK;IAC3K,EAAE,EAAE,sHAAsH;IAC1H,EAAE,EAAE,0IAA0I;IAC9I,EAAE,EAAE,oQAAoQ;CACzQ,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAC9D,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,6DAA6D;AAC7D,gEAAgE;AAChE,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,4BAA4B;AAC5B,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wCAAwC;AACxC,4EAA4E;AAC5E,wDAAwD;AACxD,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,6DAA6D;AAC7D,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,8CAA8C;AAC9C,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,kDAAkD;AAClD,2EAA2E;AAC3E,yEAAyE;AACzE,yDAAyD;AACzD,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,2CAA2C;AAC3C,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,oEAAoE;AACpE,uEAAuE;AACvE,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,8DAA8D;AAC9D,2EAA2E;AAC3E,mEAAmE;AACnE,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,oEAAoE;AACpE,4EAA4E;AAC5E,uEAAuE;AACvE,8BAA8B;AAC9B,8DAA8D;AAC9D,4EAA4E;AAC5E,8EAA8E;AAC9E,iFAAiF;AACjF,2EAA2E;AAC3E,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,8DAA8D;AAC9D,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,wCAAwC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;IAC5E,CAAC,EAAE,mEAAmE;IACtE,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,wEAAwE;IAC3E,CAAC,EAAE,8EAA8E;IACjF,CAAC,EAAE,mIAAmI;IACtI,EAAE,EAAE,sKAAsK;IAC1K,EAAE,EAAE,wKAAwK;IAC5K,EAAE,EAAE,sIAAsI;IAC1I,EAAE,EAAE,uKAAuK;IAC3K,EAAE,EAAE,sHAAsH;IAC1H,EAAE,EAAE,0IAA0I;IAC9I,EAAE,EAAE,oQAAoQ;IACxQ,EAAE,EAAE,8FAA8F;IAClG,EAAE,EAAE,gLAAgL;CACrL,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/install-job.d.ts

@@ -51,11 +51,19 @@ export declare const OPS_IMAGE_REPOSITORY = "europe-west1-docker.pkg.dev/caelo-w
  * Roles the provisioner needs on top of {@link PROVISIONER_ROLE_LIST} when it
  * runs the install job instead of the operator: the operator-access sync job
  * creates a project custom role and a Cloud Scheduler job (operator-access.ts),
- * and the job's own output has to reach Cloud Logging so the terminal can
+ * the scheduler tick deploys a Cloud Workflows workflow (scheduler-setup.ts,
+ * #1140; the converge job gets the same roles, converge-job-setup.ts), and
+ * the job's own output has to reach Cloud Logging so the terminal can
  * tail it. Granted only to installs that use the job. Not an escalation: the
  * provisioner already holds `resourcemanager.projectIamAdmin`.
+ *
+ * This list is also the converge job's self-grant allowlist
+ * (converge-job-preflight.ts `CONVERGE_SELF_GRANTABLE_ROLES`): a role added
+ * here is granted by the converge job of the release that adds it to an
+ * install that lacks it, with no terminal run. Never add an ownership or
+ * IAM-policy role (the tests refuse `SELF_GRANT_FORBIDDEN_ROLES`).
  */
-export declare const INSTALL_JOB_ROLES: readonly ["roles/iam.roleAdmin", "roles/cloudscheduler.admin", "roles/logging.logWriter"];
+export declare const INSTALL_JOB_ROLES: readonly ["roles/iam.roleAdmin", "roles/cloudscheduler.admin", "roles/workflows.editor", "roles/logging.logWriter"];
 /** One of {@link INSTALL_JOB_ROLES}. */
 export type InstallJobRole = (typeof INSTALL_JOB_ROLES)[number];
 /** The ops image pinned by digest. */

package/dist/install-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-job.d.ts","sourceRoot":"","sources":["../src/install-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,mCAAmC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,mEACiC,CAAC;AAEnE;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,2FAIpB,CAAC;AAEX,wCAAwC;AACxC,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQhE,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAcjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,gDAAgD;AAChD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,GAAG,CAAC,GAAG,IAAI,CAmBhG;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,MAAM,EAAE,CAAC,EACT,GAAG,EAAE,UAAU,GACd,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAE7F;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,IAAI,CAEN;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,OAAO,CAyBT;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,IAAI,CAgB7E;AAED,0CAA0C;AAC1C,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AAW5E,6CAA6C;AAC7C,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,cAAc,CAAC,CAuBzB;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAC/B,IAAI,EAAE,cAAc,GAAG,IAAI,GAC1B,kBAAkB,CAgBpB;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAwBnE;AAED,gEAAgE;AAChE,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BzE;AA2BD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAChD,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAyCrD;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoCtD;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAchG"}
+{"version":3,"file":"install-job.d.ts","sourceRoot":"","sources":["../src/install-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,mCAAmC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,mEACiC,CAAC;AAEnE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,qHAKpB,CAAC;AAEX,wCAAwC;AACxC,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQhE,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAcjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,gDAAgD;AAChD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,GAAG,CAAC,GAAG,IAAI,CAmBhG;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,MAAM,EAAE,CAAC,EACT,GAAG,EAAE,UAAU,GACd,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAE7F;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,IAAI,CAEN;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,OAAO,CAyBT;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,IAAI,CAgB7E;AAED,0CAA0C;AAC1C,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AAW5E,6CAA6C;AAC7C,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,cAAc,CAAC,CAuBzB;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAC/B,IAAI,EAAE,cAAc,GAAG,IAAI,GAC1B,kBAAkB,CAgBpB;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAwBnE;AAED,gEAAgE;AAChE,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BzE;AA2BD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAChD,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAyCrD;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoCtD;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAchG"}