@caelo-cms/provisioning 0.11.11 → 0.11.12

package/dist/agent-db.js

@@ -18856,6 +18856,7 @@ async function recordAudit(tx, opts) {
 var SYSTEM_ACTOR_ID = "00000000-0000-0000-0000-00000000ffff";
 
 // ../query-api/src/branch-access.ts
+import { AsyncLocalStorage } from "async_hooks";
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function namedBranches(ctx, input) {
   const out = new Set;
@@ -18879,12 +18880,71 @@ function branchNotFound(operation, chatBranchId) {
 function firstMalformedBranch(branches) {
   return branches.find((b) => !UUID_RE2.test(b)) ?? null;
 }
-async function firstInvisibleBranch(tx, branches) {
+var VERDICT_MAX_AGE_MS = 30000;
+var visibilityScope = new AsyncLocalStorage;
+function verdictKey(ctx, branch) {
+  return `${ctx.actorKind}|${ctx.actorId}|${ctx.chatTaskId ?? ""}|${branch}`;
+}
+function rememberedVerdict(ctx, branch) {
+  const scope = visibilityScope.getStore();
+  if (!scope)
+    return;
+  const key = verdictKey(ctx, branch);
+  const hit = scope.verdicts.get(key);
+  if (!hit)
+    return;
+  if (Date.now() - hit.at > VERDICT_MAX_AGE_MS) {
+    scope.verdicts.delete(key);
+    return;
+  }
+  return hit.visible;
+}
+function rememberVerdict(ctx, branch, visible) {
+  const scope = visibilityScope.getStore();
+  if (!scope)
+    return;
+  const key = verdictKey(ctx, branch);
+  const entry = { visible, at: Date.now() };
+  scope.verdicts.set(key, entry);
+  visible.catch(() => {
+    if (scope.verdicts.get(key) === entry)
+      scope.verdicts.delete(key);
+  });
+}
+async function rememberedFirstInvisible(ctx, branches) {
+  const pending = [];
+  for (const branch of branches) {
+    if (!UUID_RE2.test(branch))
+      return branch;
+    const visible = rememberedVerdict(ctx, branch);
+    if (!visible)
+      return;
+    pending.push({ branch, visible });
+  }
+  for (const p of pending) {
+    try {
+      if (!await p.visible)
+        return p.branch;
+    } catch {
+      return;
+    }
+  }
+  return null;
+}
+async function firstInvisibleBranch(tx, branches, ctx) {
   for (const branch of branches) {
     if (!UUID_RE2.test(branch))
       return branch;
-    const rows = await tx.execute(sql`SELECT caelo_branch_visible(${branch}::uuid) AS visible`);
-    if (rows[0]?.visible !== true)
+    let visible = ctx ? rememberedVerdict(ctx, branch) : undefined;
+    if (!visible) {
+      visible = (async () => {
+        const rows = await tx.execute(sql`SELECT caelo_branch_visible(${branch}::uuid) AS visible`);
+        return rows[0]?.visible === true;
+      })();
+      if (ctx)
+        rememberVerdict(ctx, branch, visible);
+    }
+    if (!await visible)
       return branch;
   }
   return null;
@@ -19106,7 +19166,7 @@ async function provisionPluginSchemaInTx(tx, caller, opts) {
 }
 
 // ../query-api/src/pool-guard.ts
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 var POOL_ACQUIRE_TIMEOUT_MS = 1e4;
 var LONG_TRANSACTIONS = [
   {
@@ -19146,13 +19206,14 @@ class PoolAcquireTimeoutError extends Error {
   timeoutMs;
   name = "PoolAcquireTimeoutError";
   constructor(pool, requester, timeoutMs) {
-    super(`the ${pool} database pool had no free connection for ${requester} within ${timeoutMs} ms: every connection is busy. ` + "Nothing was changed. Retry in a few seconds; if it keeps happening the admin is overloaded or a request holds its connections \u2014 the server log names it.");
+    super(`the ${pool} database pool had no free connection for ${requester} within ${timeoutMs} ms: every connection is busy. ` + `Nothing was changed. Retry in a few seconds (wait about ${Math.round(POOL_BUSY_RETRY_AFTER_MS / 1000)} s, then send the same call again unchanged); ` + "if it keeps happening the admin is overloaded or a request holds its connections \u2014 the server log names it.");
     this.pool = pool;
     this.requester = requester;
     this.timeoutMs = timeoutMs;
   }
 }
-var joining = new AsyncLocalStorage;
+var POOL_BUSY_RETRY_AFTER_MS = 5000;
+var joining = new AsyncLocalStorage2;
 function newMarker(holder, root) {
   return {
     holder,
@@ -19168,8 +19229,8 @@ function newMarker(holder, root) {
 
 class PoolGuard {
   #stores = {
-    admin: new AsyncLocalStorage,
-    public: new AsyncLocalStorage
+    admin: new AsyncLocalStorage2,
+    public: new AsyncLocalStorage2
   };
   plan(pool, holder) {
     const outer = this.held(pool);
@@ -19231,6 +19292,50 @@ function detachedRunner(operation, open) {
   });
 }
 
+// ../query-api/src/pool-pressure.ts
+var BUN_DEFAULT_POOL_MAX = 10;
+
+class PoolDemand {
+  #pool;
+  #max;
+  #now;
+  #next = 0;
+  #waiting = new Map;
+  #holding = new Map;
+  constructor(pool, max, now = Date.now) {
+    this.#pool = pool;
+    this.#max = max;
+    this.#now = now;
+  }
+  beginWait() {
+    const id = this.#next++;
+    this.#waiting.set(id, this.#now());
+    return () => {
+      this.#waiting.delete(id);
+    };
+  }
+  beginHold(holder) {
+    const id = this.#next++;
+    this.#holding.set(id, { holder, since: this.#now() });
+    return () => {
+      this.#holding.delete(id);
+    };
+  }
+  snapshot() {
+    const now = this.#now();
+    const firstWait = this.#waiting.values().next();
+    const holders = [...this.#holding.values()].map((h) => ({ holder: h.holder, heldMs: now - h.since })).sort((a, b) => b.heldMs - a.heldMs);
+    return {
+      pool: this.#pool,
+      max: this.#max,
+      inUse: this.#holding.size,
+      waiting: this.#waiting.size,
+      oldestWaitMs: firstWait.done ? 0 : now - firstWait.value,
+      holders
+    };
+  }
+}
+
 // ../query-api/src/post-commit.ts
 var pendingByTx = new WeakMap;
 function collectPostCommitEffects(tx) {
@@ -19377,6 +19482,7 @@ class DatabaseAdapter {
   #publicDatabase;
   #acquireTimeoutMs;
   #guard = new PoolGuard;
+  #demand;
   #verifyPromise = null;
   #projectionPublisher = null;
   #onStatement;
@@ -19405,6 +19511,13 @@ class DatabaseAdapter {
     this.#public = drizzle(this.#publicRaw, this.#drizzleOptions);
     this.#skipVerify = config.skipRoleVerification === true;
     this.#acquireTimeoutMs = config.poolAcquireTimeoutMs ?? POOL_ACQUIRE_TIMEOUT_MS;
+    this.#demand = {
+      admin: new PoolDemand("admin", poolMax ?? BUN_DEFAULT_POOL_MAX),
+      public: new PoolDemand("public", publicPoolMax ?? BUN_DEFAULT_POOL_MAX)
+    };
+  }
+  poolPressure(pool) {
+    return this.#demand[pool].snapshot();
   }
   async#transaction(pool, holder, fn) {
     const raw = pool === "admin" ? this.#adminRaw : this.#publicRaw;
@@ -19415,6 +19528,7 @@ class DatabaseAdapter {
       return this.#joinHeld(pool, plan.outer, plan.marker, fn);
     const marker = plan.marker;
     const reserved = await this.#reserve(pool, raw, holder);
+    const endHold = this.#demand[pool].beginHold(holder);
     try {
       const db = drizzle({ client: reserved, ...this.#drizzleOptions });
       this.#onStatement?.("BEGIN");
@@ -19428,6 +19542,7 @@ class DatabaseAdapter {
       return out;
     } finally {
       reserved.release();
+      endHold();
       await this.#runAfterEnd(marker);
     }
   }
@@ -19471,6 +19586,7 @@ class DatabaseAdapter {
   async#reserve(pool, raw, requester) {
     const deadline = new AbortController;
     const timer = setTimeout(() => deadline.abort(), this.#acquireTimeoutMs);
+    const endWait = this.#demand[pool].beginWait();
     try {
       return await raw.reserve({ signal: deadline.signal });
     } catch (e) {
@@ -19479,6 +19595,7 @@ class DatabaseAdapter {
       }
       throw e;
     } finally {
+      endWait();
       clearTimeout(timer);
     }
   }
@@ -19590,7 +19707,7 @@ class DatabaseAdapter {
           postCommit = collectPostCommitEffects(tx);
         await this.#setIdentity(tx, ctx, op.name);
         if (op.database === "cms_admin") {
-          const denied = await firstInvisibleBranch(tx, namedBranches(ctx, validatedInput));
+          const denied = await firstInvisibleBranch(tx, namedBranches(ctx, validatedInput), ctx);
           if (denied !== null)
             return err(branchNotFound(op.name, denied));
         }
@@ -19647,9 +19764,10 @@ class DatabaseAdapter {
     try {
       const branches = op.database === "cms_admin" ? namedBranches(ctx, validatedInput) : [];
       if (branches.length > 0) {
-        const denied = await this.#transaction("admin", op.name, async (tx) => {
+        const remembered = await rememberedFirstInvisible(ctx, branches);
+        const denied = remembered !== undefined ? remembered : await this.#transaction("admin", op.name, async (tx) => {
           await this.#setIdentity(tx, ctx);
-          return firstInvisibleBranch(tx, branches);
+          return firstInvisibleBranch(tx, branches, ctx);
         });
         if (denied !== null)
           return err(branchNotFound(op.name, denied));
@@ -19749,7 +19867,8 @@ class DatabaseAdapter {
     try {
       const branches = namedBranches(ctx, validatedInput);
       if (branches.length > 0) {
-        const denied = await this.#shortRead(ctx, op.name, (tx) => firstInvisibleBranch(tx, branches));
+        const remembered = await rememberedFirstInvisible(ctx, branches);
+        const denied = remembered !== undefined ? remembered : await this.#shortRead(ctx, op.name, (tx) => firstInvisibleBranch(tx, branches, ctx));
         if (denied !== null)
           return err(branchNotFound(op.name, denied));
       }
@@ -19829,7 +19948,7 @@ class DatabaseAdapter {
       if (!joined)
         postCommit = collectPostCommitEffects(tx);
       await this.#setIdentity(tx, ctx, options.holder ?? null);
-      const denied = await firstInvisibleBranch(tx, namedBranches(ctx, undefined));
+      const denied = await firstInvisibleBranch(tx, namedBranches(ctx, undefined), ctx);
       if (denied !== null) {
         throw new OperationAbortError(branchNotFound("withAdminTransaction", denied));
       }
@@ -19866,11 +19985,40 @@ class DatabaseAdapter {
     if (this.#adminRaw === null)
       throw new AdminDatabaseUnavailableError("rawAdmin");
     this.#guard.assertNoHeldTransaction("admin", "rawAdmin()");
-    return this.#adminRaw;
+    return this.#trackedRaw("admin", this.#adminRaw);
   }
   rawPublic() {
     this.#guard.assertNoHeldTransaction("public", "rawPublic()");
-    return this.#publicRaw;
+    return this.#trackedRaw("public", this.#publicRaw);
+  }
+  #trackedRaw(pool, raw) {
+    const demand = this.#demand[pool];
+    return new Proxy(raw, {
+      get(target, property, receiver) {
+        const value = Reflect.get(target, property, receiver);
+        if (property !== "begin" || typeof value !== "function") {
+          return typeof value === "function" ? value.bind(target) : value;
+        }
+        return (...args) => {
+          const last = args.length - 1;
+          const fn = args[last];
+          if (typeof fn !== "function")
+            return value.apply(target, args);
+          const endWait = demand.beginWait();
+          const counted = async (tx) => {
+            endWait();
+            const endHold = demand.beginHold("raw.begin");
+            try {
+              return await fn(tx);
+            } finally {
+              endHold();
+            }
+          };
+          const out = value.apply(target, [...args.slice(0, last), counted]);
+          return out.finally(endWait);
+        };
+      }
+    });
   }
   async provisionPluginPublicSchema(opts) {
     if (!/^[0-9a-f-]{36}$/i.test(opts.pluginId)) {
@@ -19963,6 +20111,14 @@ async function auditDroppedColumns(tx, database, pluginId, outcome) {
 }
 function thrownToQueryError(operation, thrown, access) {
   const raw = thrown instanceof Error ? thrown.message : String(thrown);
+  if (thrown instanceof PoolAcquireTimeoutError) {
+    return {
+      kind: "HandlerError",
+      operation,
+      message: raw,
+      busy: { retryAfterMs: POOL_BUSY_RETRY_AFTER_MS }
+    };
+  }
   if (isRlsDenial(thrown)) {
     console.warn(`[query-api] ${operation}: RLS denied the ${access}: ${raw}`);
     return { kind: "RLSDenied", operation, detail: rlsDenialMessage(operation, access) };

package/dist/converge-job-gcp.d.ts

@@ -41,6 +41,13 @@ export declare function deployedSiteMismatch(adminJson: string, meta: Pick<Insta
 export declare function convergeExecutionNameError(execution: string | null): string | null;
 /** The new execution's name from `gcloud run jobs execute --async`. */
 export declare function startedExecutionName(stdout: string, stderr: string): string | null;
+/**
+ * The `gcloud` argv that grants the install's provisioner — this job's
+ * own identity, never another principal — `role` on the project, or null
+ * when `role` is not on the self-grant allowlist (converge-job-preflight.ts).
+ * Exported for the tests that pin the boundary.
+ */
+export declare function selfGrantArgs(projectId: string, role: string): string[] | null;
 /**
  * Every dependency of {@link runConvergeJob} except the database (the queue
  * and how it is secured, #1373) and the log.

package/dist/converge-job-gcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-gcp.d.ts","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAA0B,MAAM,mBAAmB,CAAC;AAYhG,OAAO,EACL,KAAK,eAAe,EAKrB,MAAM,oBAAoB,CAAC;AAY5B,OAAO,EAAmC,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAQD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkC7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,eAAe,GAAG,QAAQ,CAAC,EAClE,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAiCf;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAOlF;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlF;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,aAAa,EACpB,cAAc,EAAE,eAAe,CAAC,gBAAgB,CAAC,EACjD,GAAG,EAAE,MAAM,GACV,eAAe,CAyOjB"}
+{"version":3,"file":"converge-job-gcp.d.ts","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAA0B,MAAM,mBAAmB,CAAC;AAahG,OAAO,EACL,KAAK,eAAe,EAKrB,MAAM,oBAAoB,CAAC;AAa5B,OAAO,EAAmC,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAIrD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBxE;AAQD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkC7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,eAAe,GAAG,QAAQ,CAAC,EAClE,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CAiCf;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAOlF;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAY9E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,aAAa,EACpB,cAAc,EAAE,eAAe,CAAC,gBAAgB,CAAC,EACjD,GAAG,EAAE,MAAM,GACV,eAAe,CAmPjB"}

package/dist/converge-job-gcp.js

@@ -19,15 +19,17 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { CAELO_VERSION } from "@caelo-cms/shared";
 import { readConvergeCheckpoint, writeConvergeCheckpoint } from "./converge-checkpoint.js";
+import { isSelfGrantableRole } from "./converge-job-preflight.js";
 import { CONVERGE_TASK_TIMEOUT_MINUTES } from "./converge-job-setup.js";
 import { gcloud } from "./gcloud.js";
-import { realSleep } from "./gcloud-retry.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
 import { convergeJobName, GCP_STACK_ENV, gcpNamePrefix, operatorAccessJobName, } from "./gcp-names.js";
 import { INFRA_CONTRACT_VERSION } from "./infra-contract.js";
 import { describeExecution } from "./install-job.js";
 import { installRoot, installStagingHost, readMetadata, recordInfraContractVersion, } from "./install-state.js";
 import { runMigrationsViaCloudRunJob } from "./migration-runner.js";
 import { installIapAllowlist } from "./operator-access.js";
+import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
 import { fetchVerifiedReleaseManifest, manifestServiceImages } from "./release-manifest.js";
 import { publicSiteUrl, STAGING_HOST_ENV } from "./stack-contract.js";
 import { attachInstall } from "./state-attach.js";
@@ -160,6 +162,26 @@ export function startedExecutionName(stdout, stderr) {
     const name = stdout.trim().split(/\s+/)[0] || /Execution \[([^\]]+)\]/.exec(stderr)?.[1] || "";
     return /^[a-z0-9-]+$/.test(name) ? name : null;
 }
+/**
+ * The `gcloud` argv that grants the install's provisioner — this job's
+ * own identity, never another principal — `role` on the project, or null
+ * when `role` is not on the self-grant allowlist (converge-job-preflight.ts).
+ * Exported for the tests that pin the boundary.
+ */
+export function selfGrantArgs(projectId, role) {
+    if (!isSelfGrantableRole(role))
+        return null;
+    return [
+        "projects",
+        "add-iam-policy-binding",
+        projectId,
+        `--member=serviceAccount:${provisionerServiceAccountEmail(projectId)}`,
+        `--role=${role}`,
+        "--condition=None",
+        "--quiet",
+        "--format=none",
+    ];
+}
 /**
  * Every dependency of {@link runConvergeJob} except the database (the queue
  * and how it is secured, #1373) and the log.
@@ -285,6 +307,16 @@ export function gcpConvergeDeps(placement, queue, secureDatabase, log) {
         projectId,
         region,
         iam: gcloudIamTester(run, http),
+        grantOwnRole: async (role) => {
+            const args = selfGrantArgs(projectId, role);
+            if (!args)
+                return { ok: false, error: `${role} is not a role the converge job may grant itself` };
+            const r = await runWithRetry(run, realSleep, args);
+            return r.ok
+                ? { ok: true }
+                : { ok: false, error: r.stderr.trim() || `gcloud exited ${r.exitCode}` };
+        },
+        sleep: realSleep,
         execution: placement.execution,
         ownVersion: CAELO_VERSION,
         // The default deps: the fixed registry and signer, never overridden.

package/dist/converge-job-gcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-gcp.js","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAqB,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAEL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAG5F,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,CAAC,GAAG,MAGT,CAAC;IACF,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7F,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAElE,qFAAqF;AACrF,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,UAAkB;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,MAAM,CAAC,GAAG,MAST,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC5D,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1C,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,KAAK,CAAC;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,mCAAmC,kBAAkB,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,KAAK,CAAC,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,oBAAoB,QAAQ,IAAI,QAAQ,+BAA+B,IAAI,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,IAAkE,EAClE,MAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,2BAA2B,IAAI,CAAC,MAAM,IAAI,MAAM,8BAA8B,MAAM,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,MAAM,CAAC,GAAG,MAKT,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC;IACxE,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,qBAAqB,YAAY,EAAE,CAAC;IACnE,IAAI,IAAI,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,oBAAoB,IAAI,+BAA+B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,+BAA+B,OAAO,IAAI,OAAO,+BAA+B,IAAI,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAwB;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO,2BAA2B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,SAA4B,EAC5B,KAAoB,EACpB,cAAiD,EACjD,GAAW;IAEX,MAAM,GAAG,GAAiB,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,KAA6B,CAAC;IAC3C,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,YAAY,MAAM,EAAE,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;IAClE,sEAAsE;IACtE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,OAAO,GAA+B,KAAK,EAAE,EACjD,QAAQ,EAAE,CAAC,EACX,QAAQ,EACR,MAAM,EACN,YAAY,GACb,EAAE,EAAE;QACH,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE;YACxC,GAAG,EAAE,cAAc;YACnB,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,mBAAmB;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,KAAK,CAAC,yCAAyC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACrC,iEAAiE;QACjE,wEAAwE;QACxE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAoB,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClF,QAAQ,CAAC,KAAK,CAAC,mBAAmB,SAAS,+CAA+C,CAAC,CAAC;YAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,sDAAsD;QACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,MAAM;YACN,UAAU;YACV,qBAAqB,CAAC,aAAa,CAAC;YACpC,GAAG,QAAQ;YACX,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE;YAC1B,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC;YACvD,CAAC,CAAC,uDAAuD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;QACnF,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,UAAU,+FAA+F,UAAU,6EAA6E,CACzP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CACxC,GAAG,EACH,aAAa,EACb,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,EACvC,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,OAAO;YACtB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,eAAe,CAAC,CAAC;YACtF,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,OAAO;YACtB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC,2BAA2B,EAAE,KAAK,CAAC;YACzF,CAAC,CAAC,SAAS,EAAE,EAAE;gBACb,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;gBACtD,CAAC,CAAC,8CAA8C,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACxF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,8EAA8E,SAAS,6EAA6E,CACrP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,CAAC,CAAC,OAAO;YACpB,sEAAsE;YACtE,oBAAoB,EAAE,sBAAsB;YAC5C,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,KAAK;YACtB,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ;YACzC,WAAW,EAAE,KAAK;SACnB,EACD;YACE,GAAG;YACH,IAAI;YACJ,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,+DAA+D;YAC/D,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACnD,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpB,2BAA2B,CACzB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,EACrE,EAAE,GAAG,EAAE,CACR;YACH,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;YACxE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC/B,QAAQ,GAAG,MAAM,mBAAmB,CAClC,SAAS,EACT,IAAI,CAAC,QAAkC,EACvC,OAAO,EACP,CAAC,CAAC,OAAO,EACT,CAAC,CACF,CAAC;YACJ,CAAC;YACD,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YAClE,0BAA0B,EAAE,CAAC,OAAO,EAAE,EAAE;gBACtC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC/C,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,YAAY;SACb,CACF,CAAC;QACF,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,MAAM,GACV,OAAO,CAAC,EAAE,IAAI,QAAQ;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,CAAC,CAAC;gBACE,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,UAAU;gBAC7C,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ;aACpC,CAAC;QACR,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,cAAc;QACd,SAAS;QACT,MAAM;QACN,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC;QAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU,EAAE,aAAa;QACzB,qEAAqE;QACrE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC;QACjE,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QACtE,CAAC;QACD,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC,SAAS,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;gBAClB,KAAK;gBACL,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS,CAAC,SAAS;gBACnB,GAAG,QAAQ;gBACX,eAAe;aAChB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,mEAAmE;YACnE,kCAAkC;YAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;gBACvB,KAAK;gBACL,MAAM;gBACN,QAAQ;gBACR,GAAG;gBACH,WAAW,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC3C,GAAG,QAAQ;gBACX,SAAS;aACV,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;gBACrB,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,GAAG;gBACH,GAAG,QAAQ;gBACX,SAAS;gBACT,+BAA+B;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACjF,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,GAAG,GAAG,mDAAmD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;iBACtF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QACD,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvF,mEAAmE;QACnE,kEAAkE;QAClE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE;YACnE,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,SAAS;gBACrB,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE;wBAC3D,YAAY,EAAE,6BAA6B,GAAG,MAAM;qBACrD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACJ,cAAc,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,cAAc,CAAC;QACpE,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QAC5F,OAAO;QACP,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"converge-job-gcp.js","sourceRoot":"","sources":["../src/converge-job-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAEL,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,cAAc,EAA0B,MAAM,mBAAmB,CAAC;AAG5F,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,CAAC,GAAG,MAGT,CAAC;IACF,MAAM,KAAK,GACT,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7F,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAElE,qFAAqF;AACrF,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,UAAkB;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,mDAAmD,CAAC;IAC7D,CAAC;IACD,MAAM,CAAC,GAAG,MAST,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC5D,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG;QAC1C,EAAE,CAAC;IACL,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAAE,KAAK,CAAC;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,mCAAmC,kBAAkB,EAAE,CAAC;IAC3F,MAAM,IAAI,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,IAAI,KAAK,CAAC,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,oBAAoB,QAAQ,IAAI,QAAQ,+BAA+B,IAAI,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,IAAkE,EAClE,MAAc;IAEd,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,2BAA2B,IAAI,CAAC,MAAM,IAAI,MAAM,8BAA8B,MAAM,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,MAAM,CAAC,GAAG,MAKT,CAAC;IACF,MAAM,GAAG,GACP,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC;IACxE,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,qBAAqB,YAAY,EAAE,CAAC;IACnE,IAAI,IAAI,KAAK,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,oBAAoB,IAAI,+BAA+B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7F,CAAC;IACD,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,+BAA+B,OAAO,IAAI,OAAO,+BAA+B,IAAI,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAwB;IACjE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,GAAG,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1E,OAAO,2BAA2B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,eAAe,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,IAAY;IAC3D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO;QACL,UAAU;QACV,wBAAwB;QACxB,SAAS;QACT,2BAA2B,8BAA8B,CAAC,SAAS,CAAC,EAAE;QACtE,UAAU,IAAI,EAAE;QAChB,kBAAkB;QAClB,SAAS;QACT,eAAe;KAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,SAA4B,EAC5B,KAAoB,EACpB,cAAiD,EACjD,GAAW;IAEX,MAAM,GAAG,GAAiB,MAAM,CAAC;IACjC,MAAM,IAAI,GAAG,KAA6B,CAAC;IAC3C,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,YAAY,MAAM,EAAE,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;IAClE,sEAAsE;IACtE,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAExF,MAAM,OAAO,GAA+B,KAAK,EAAE,EACjD,QAAQ,EAAE,CAAC,EACX,QAAQ,EACR,MAAM,EACN,YAAY,GACb,EAAE,EAAE;QACH,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE;YACxC,GAAG,EAAE,cAAc;YACnB,OAAO,EAAE,WAAW;YACpB,aAAa,EAAE,mBAAmB;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,QAAQ,CAAC,KAAK,CAAC,yCAAyC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACrC,iEAAiE;QACjE,wEAAwE;QACxE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAoB,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAClF,QAAQ,CAAC,KAAK,CAAC,mBAAmB,SAAS,+CAA+C,CAAC,CAAC;YAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,uEAAuE;QACvE,oEAAoE;QACpE,sDAAsD;QACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,MAAM;YACN,UAAU;YACV,qBAAqB,CAAC,aAAa,CAAC;YACpC,GAAG,QAAQ;YACX,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE;YAC1B,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC;YACvD,CAAC,CAAC,uDAAuD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;QACnF,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,UAAU,+FAA+F,UAAU,6EAA6E,CACzP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,sBAAsB,CACxC,GAAG,EACH,aAAa,EACb,GAAG,aAAa,CAAC,aAAa,CAAC,QAAQ,EACvC,SAAS,EACT,MAAM,CACP,CAAC;QACF,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,OAAO;YACtB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,QAAQ,EAAE,eAAe,CAAC,CAAC;YACtF,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,OAAO;YACtB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,aAAa,CAAC,aAAa,CAAC,2BAA2B,EAAE,KAAK,CAAC;YACzF,CAAC,CAAC,SAAS,EAAE,EAAE;gBACb,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;gBACtD,CAAC,CAAC,8CAA8C,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QACxF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,KAAK,CACZ,mDAAmD,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,8EAA8E,SAAS,6EAA6E,CACrP,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAC5C;YACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,wBAAwB,KAAK,SAAS;gBAC7C,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,CAAC,CAAC,OAAO;YACpB,sEAAsE;YACtE,oBAAoB,EAAE,sBAAsB;YAC5C,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,KAAK;YACtB,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ;YACzC,WAAW,EAAE,KAAK;SACnB,EACD;YACE,GAAG;YACH,IAAI;YACJ,KAAK,EAAE,SAAS;YAChB,QAAQ;YACR,+DAA+D;YAC/D,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACnD,YAAY,EAAE,eAAe;YAC7B,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACpB,2BAA2B,CACzB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,EACrE,EAAE,GAAG,EAAE,CACR;YACH,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;YACxE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBAC/B,QAAQ,GAAG,MAAM,mBAAmB,CAClC,SAAS,EACT,IAAI,CAAC,QAAkC,EACvC,OAAO,EACP,CAAC,CAAC,OAAO,EACT,CAAC,CACF,CAAC;YACJ,CAAC;YACD,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YAClE,0BAA0B,EAAE,CAAC,OAAO,EAAE,EAAE;gBACtC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAC/C,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,YAAY;SACb,CACF,CAAC;QACF,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,MAAM,GACV,OAAO,CAAC,EAAE,IAAI,QAAQ;YACpB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,CAAC,CAAC;gBACE,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,UAAU;gBAC7C,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ;aACpC,CAAC;QACR,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK;QACL,cAAc;QACd,SAAS;QACT,MAAM;QACN,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC;QAC/B,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,kDAAkD,EAAE,CAAC;YACzF,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,CAAC,CAAC,EAAE;gBACT,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC7E,CAAC;QACD,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU,EAAE,aAAa;QACzB,qEAAqE;QACrE,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,4BAA4B,CAAC,OAAO,CAAC;QACjE,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;QACtE,CAAC;QACD,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,cAAc,EAAE,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC,SAAS,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;gBAClB,KAAK;gBACL,MAAM;gBACN,YAAY;gBACZ,UAAU;gBACV,SAAS,CAAC,SAAS;gBACnB,GAAG,QAAQ;gBACX,eAAe;aAChB,CAAC,CAAC;YACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3B,mEAAmE;YACnE,kCAAkC;YAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;gBACvB,KAAK;gBACL,MAAM;gBACN,QAAQ;gBACR,GAAG;gBACH,WAAW,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAC3C,GAAG,QAAQ;gBACX,SAAS;aACV,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACrE,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;gBACrB,KAAK;gBACL,MAAM;gBACN,SAAS;gBACT,GAAG;gBACH,GAAG,QAAQ;gBACX,SAAS;gBACT,+BAA+B;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACjF,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACjE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,GAAG,GAAG,mDAAmD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG;iBACtF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QACD,cAAc,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvF,mEAAmE;QACnE,kEAAkE;QAClE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CACrB,sBAAsB,CAAC,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE;YACnE,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,SAAS;gBACrB,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,EAAE;wBAC3D,YAAY,EAAE,6BAA6B,GAAG,MAAM;qBACrD;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QACJ,cAAc,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,cAAc,CAAC;QACpE,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC;QAC5F,OAAO;QACP,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACrB,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/converge-job-preflight.d.ts

@@ -1,5 +1,5 @@
 import { type InstallJobRole } from "./install-job.js";
-import type { AccessCheck, PreflightVoice } from "./upgrader-iam-preflight.js";
+import type { AccessCheck, MissingAccess, PreflightVoice } from "./upgrader-iam-preflight.js";
 /**
  * What a converge does with each role `ensureConvergeJob` grants the
  * provisioner on top of its install roles, and the permissions of that role
@@ -12,10 +12,42 @@ export declare const INSTALL_ROLE_USES: Record<InstallJobRole, {
 }>;
 /** The converge job's voice: the setup is re-converged by a terminal upgrade. */
 export declare const CONVERGE_PREFLIGHT_VOICE: PreflightVoice;
+/**
+ * The roles the converge job may grant its own account when the self-check
+ * finds them missing: exactly the roles `ensureConvergeJob` grants it, as
+ * compiled into this release (see the file comment).
+ */
+export declare const CONVERGE_SELF_GRANTABLE_ROLES: readonly InstallJobRole[];
+/**
+ * Roles the converge job must never grant itself, whatever a release's list
+ * says — ownership and IAM-policy roles (prefix matches). The tests assert
+ * {@link CONVERGE_SELF_GRANTABLE_ROLES} names none of them, and the grant
+ * step refuses them again at run time.
+ */
+export declare const SELF_GRANT_FORBIDDEN_ROLES: readonly ["roles/owner", "roles/editor", "roles/resourcemanager.", "roles/iam.securityAdmin", "roles/iam.organizationRoleAdmin", "roles/iam.serviceAccountKeyAdmin", "roles/iam.workloadIdentityPoolAdmin", "roles/orgpolicy.", "roles/billing."];
+/** Whether the converge job may grant `role` to its own account (see the file comment). */
+export declare function isSelfGrantableRole(role: string): role is InstallJobRole;
+/** A converge self-check; `role` marks a check that granting that role repairs. */
+export interface ConvergeAccessCheck extends AccessCheck {
+    readonly role?: InstallJobRole;
+}
+/** What the converge job does about the self-check's missing permissions. */
+export interface SelfGrantPlan {
+    /** Allowlisted roles to grant the provisioner, in list order. */
+    readonly grant: readonly InstallJobRole[];
+    /** What no grant of the job repairs: the run stops on any of these. */
+    readonly blocking: readonly MissingAccess<ConvergeAccessCheck>[];
+}
+/**
+ * Split the self-check's missing permissions into roles the job grants
+ * itself and the rest. A check counts as repairable only when its whole
+ * shortfall is permissions of an allowlisted role it is marked with.
+ */
+export declare function selfGrantPlan(missing: readonly MissingAccess<ConvergeAccessCheck>[]): SelfGrantPlan;
 /** Every permission a converge run relies on after its decision (see the file comment). */
 export declare function convergeAccessChecks(target: {
     readonly projectId: string;
     readonly region: string;
     readonly env: string;
-}): AccessCheck[];
+}): ConvergeAccessCheck[];
 //# sourceMappingURL=converge-job-preflight.d.ts.map

package/dist/converge-job-preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-preflight.d.ts","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAG1E,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAG/E;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACpC,cAAc,EACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA0BnE,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,cAItC,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,WAAW,EAAE,CAyChB"}
+{"version":3,"file":"converge-job-preflight.d.ts","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAG1E,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAG9F;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACpC,cAAc,EACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA0BnE,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,cAItC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,cAAc,EAAsB,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,mPAU7B,CAAC;AAEX,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,cAAc,CAKxE;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,CAAC,mBAAmB,CAAC,EAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,aAAa,CAAC,mBAAmB,CAAC,EAAE,GACrD,aAAa,CAcf;AAED,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,mBAAmB,EAAE,CAyCxB"}

package/dist/converge-job-preflight.js

@@ -25,6 +25,23 @@
  *   - the Cloud SQL IAM login `ensureConvergeJob` creates (member of
  *     {@link UPGRADER_DB_ROLE}): the request row and the timeline.
  *
+ * Self-grant (maintainer decision 2026-11-03). A release may add a role to
+ * {@link INSTALL_JOB_ROLES} (0.11.11 added roles/workflows.editor for the
+ * scheduler tick, #1140); an install set up before it lacks that role until
+ * a converge's `ensureConvergeJob` grants it, and the converge job used to
+ * stop here and send the Owner to Cloud Shell for exactly that grant. Now a
+ * missing role of {@link CONVERGE_SELF_GRANTABLE_ROLES} — this release's own
+ * compiled-in list, nothing a request, a record or the environment names —
+ * is not a reason to stop: stage 1 leaves it to stage 2, and stage 2 (the
+ * target release's verified ops image, under the state lock) grants it to
+ * the provisioner at project level, records each grant on the timeline and
+ * asks IAM again (converge-job.ts). Not an escalation: the provisioner holds
+ * roles/resourcemanager.projectIamAdmin since install, so it could grant
+ * itself any role already; the allowlist only narrows what the job does
+ * with that. {@link SELF_GRANT_FORBIDDEN_ROLES} pins that the list never
+ * names an ownership or IAM-policy role, and the upgrader job — which holds
+ * no IAM rights at all — has no grant step.
+ *
  * Not checked: the permissions `pulumi up` needs for the stack. They are the
  * provisioner's PROVISIONER_ROLE_LIST (gcloud.ts), granted at install by the
  * Owner's own account; a converge cannot repair them and Pulumi names what
@@ -73,13 +90,63 @@ export const CONVERGE_PREFLIGHT_VOICE = {
     subject: "the converge job",
     repair: "Run the update once from Cloud Shell or the computer you installed from (Settings → Updates shows the command); it repairs the converge job's access.",
 };
+/**
+ * The roles the converge job may grant its own account when the self-check
+ * finds them missing: exactly the roles `ensureConvergeJob` grants it, as
+ * compiled into this release (see the file comment).
+ */
+export const CONVERGE_SELF_GRANTABLE_ROLES = INSTALL_JOB_ROLES;
+/**
+ * Roles the converge job must never grant itself, whatever a release's list
+ * says — ownership and IAM-policy roles (prefix matches). The tests assert
+ * {@link CONVERGE_SELF_GRANTABLE_ROLES} names none of them, and the grant
+ * step refuses them again at run time.
+ */
+export const SELF_GRANT_FORBIDDEN_ROLES = [
+    "roles/owner",
+    "roles/editor",
+    "roles/resourcemanager.",
+    "roles/iam.securityAdmin",
+    "roles/iam.organizationRoleAdmin",
+    "roles/iam.serviceAccountKeyAdmin",
+    "roles/iam.workloadIdentityPoolAdmin",
+    "roles/orgpolicy.",
+    "roles/billing.",
+];
+/** Whether the converge job may grant `role` to its own account (see the file comment). */
+export function isSelfGrantableRole(role) {
+    return (CONVERGE_SELF_GRANTABLE_ROLES.includes(role) &&
+        !SELF_GRANT_FORBIDDEN_ROLES.some((f) => role === f || (f.endsWith(".") && role.startsWith(f))));
+}
+/**
+ * Split the self-check's missing permissions into roles the job grants
+ * itself and the rest. A check counts as repairable only when its whole
+ * shortfall is permissions of an allowlisted role it is marked with.
+ */
+export function selfGrantPlan(missing) {
+    const grant = [];
+    const blocking = [];
+    for (const m of missing) {
+        const role = m.check.role;
+        if (role && isSelfGrantableRole(role) && !(m.unchecked && m.unchecked.length > 0)) {
+            if (!grant.includes(role))
+                grant.push(role);
+        }
+        else {
+            blocking.push(m);
+        }
+    }
+    const order = CONVERGE_SELF_GRANTABLE_ROLES;
+    grant.sort((a, b) => order.indexOf(a) - order.indexOf(b));
+    return { grant, blocking };
+}
 /** Every permission a converge run relies on after its decision (see the file comment). */
 export function convergeAccessChecks(target) {
     const { projectId, region, env } = target;
     const project = { kind: "project", projectId };
     const bucket = opsBucketName(projectId);
     return [
-        ...INSTALL_JOB_ROLES.map((role) => ({ resource: project, ...INSTALL_ROLE_USES[role] })),
+        ...INSTALL_JOB_ROLES.map((role) => ({ resource: project, role, ...INSTALL_ROLE_USES[role] })),
         {
             need: `read and write the install's records and state lock (${OPS_INSTALL_PREFIX}/) and the update's checkpoint (${CONVERGE_STATE_PREFIX}/) in the ops bucket`,
             resource: { kind: "bucket", bucket },

package/dist/converge-job-preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-preflight.js","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAG1B;IACF,qBAAqB,EAAE;QACrB,IAAI,EAAE,uEAAuE;QAC7E,WAAW,EAAE,CAAC,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,CAAC;KACvE;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,2EAA2E;QACjF,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,gEAAgE;QACtE,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,8CAA8C;QACpD,WAAW,EAAE,CAAC,2BAA2B,CAAC;KAC3C;CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EACJ,uJAAuJ;CAC1J,CAAC;AAEF,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,MAIpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAW,CAAC;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF;YACE,IAAI,EAAE,wDAAwD,kBAAkB,mCAAmC,qBAAqB,sBAAsB;YAC9J,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;YACpC,WAAW,EAAE;gBACX,sBAAsB;gBACtB,qBAAqB;gBACrB,wBAAwB;gBACxB,wBAAwB;aACzB;SACF;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE;YAC5E,WAAW,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;SACjE;QACD;YACE,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;SACpC;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,SAAS;gBACT,KAAK,EAAE,8BAA8B,CAAC,SAAS,CAAC;aACjD;YACD,WAAW,EAAE,CAAC,2BAA2B,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,kCAAkC,gBAAgB,4CAA4C;YACpG,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;SACpE;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"converge-job-preflight.js","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAG1B;IACF,qBAAqB,EAAE;QACrB,IAAI,EAAE,uEAAuE;QAC7E,WAAW,EAAE,CAAC,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,CAAC;KACvE;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,2EAA2E;QACjF,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,gEAAgE;QACtE,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,8CAA8C;QACpD,WAAW,EAAE,CAAC,2BAA2B,CAAC;KAC3C;CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EACJ,uJAAuJ;CAC1J,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA8B,iBAAiB,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,aAAa;IACb,cAAc;IACd,wBAAwB;IACxB,yBAAyB;IACzB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,kBAAkB;IAClB,gBAAgB;CACR,CAAC;AAEX,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,CACJ,6BAAmD,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/F,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsD;IAEtD,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAyC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,IAAI,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,6BAAkD,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,MAIpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAW,CAAC;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F;YACE,IAAI,EAAE,wDAAwD,kBAAkB,mCAAmC,qBAAqB,sBAAsB;YAC9J,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;YACpC,WAAW,EAAE;gBACX,sBAAsB;gBACtB,qBAAqB;gBACrB,wBAAwB;gBACxB,wBAAwB;aACzB;SACF;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE;YAC5E,WAAW,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;SACjE;QACD;YACE,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;SACpC;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,SAAS;gBACT,KAAK,EAAE,8BAA8B,CAAC,SAAS,CAAC;aACjD;YACD,WAAW,EAAE,CAAC,2BAA2B,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,kCAAkC,gBAAgB,4CAA4C;YACpG,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;SACpE;KACF,CAAC;AACJ,CAAC"}

package/dist/converge-job-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-setup.d.ts","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO3F;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,yDAA0D,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAMnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEN;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CA4B3E;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAiH9B"}
+{"version":3,"file":"converge-job-setup.d.ts","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO3F;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,yDAA0D,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAMnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEN;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CA4B3E;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAiH9B"}

package/dist/converge-job-setup.js

@@ -40,7 +40,10 @@
  *   - {@link INSTALL_JOB_ROLES} (the operator-access step of a converge
  *     creates a custom role and a Cloud Scheduler job, and the job's lines
  *     must reach Cloud Logging) — what an install-job install already
- *     grants; not an escalation, the provisioner holds projectIamAdmin;
+ *     grants; not an escalation, the provisioner holds projectIamAdmin. The
+ *     converge job of a release that adds a role here grants it itself when
+ *     it finds it missing (converge-job-preflight.ts, the self-grant), so
+ *     the role reaches an older install without a terminal run;
  *   - a Cloud SQL IAM database login that is a member of `platform_updater`
  *     only (migration 0267): it reads its request and writes the timeline,
  *     nothing else in the database.