@caelo-cms/provisioning 0.11.11 → 0.11.13

package/dist/converge-job-preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-preflight.d.ts","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAG1E,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAG/E;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACpC,cAAc,EACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA0BnE,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,cAItC,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,WAAW,EAAE,CAyChB"}
+{"version":3,"file":"converge-job-preflight.d.ts","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAG1E,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAG9F;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACpC,cAAc,EACd;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA0BnE,CAAC;AAEF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,cAItC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,cAAc,EAAsB,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,mPAU7B,CAAC;AAEX,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,cAAc,CAKxE;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,CAAC,mBAAmB,CAAC,EAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,aAAa,CAAC,mBAAmB,CAAC,EAAE,GACrD,aAAa,CAcf;AAED,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,GAAG,mBAAmB,EAAE,CAyCxB"}

package/dist/converge-job-preflight.js

@@ -25,6 +25,23 @@
  *   - the Cloud SQL IAM login `ensureConvergeJob` creates (member of
  *     {@link UPGRADER_DB_ROLE}): the request row and the timeline.
  *
+ * Self-grant (maintainer decision 2026-11-03). A release may add a role to
+ * {@link INSTALL_JOB_ROLES} (0.11.11 added roles/workflows.editor for the
+ * scheduler tick, #1140); an install set up before it lacks that role until
+ * a converge's `ensureConvergeJob` grants it, and the converge job used to
+ * stop here and send the Owner to Cloud Shell for exactly that grant. Now a
+ * missing role of {@link CONVERGE_SELF_GRANTABLE_ROLES} — this release's own
+ * compiled-in list, nothing a request, a record or the environment names —
+ * is not a reason to stop: stage 1 leaves it to stage 2, and stage 2 (the
+ * target release's verified ops image, under the state lock) grants it to
+ * the provisioner at project level, records each grant on the timeline and
+ * asks IAM again (converge-job.ts). Not an escalation: the provisioner holds
+ * roles/resourcemanager.projectIamAdmin since install, so it could grant
+ * itself any role already; the allowlist only narrows what the job does
+ * with that. {@link SELF_GRANT_FORBIDDEN_ROLES} pins that the list never
+ * names an ownership or IAM-policy role, and the upgrader job — which holds
+ * no IAM rights at all — has no grant step.
+ *
  * Not checked: the permissions `pulumi up` needs for the stack. They are the
  * provisioner's PROVISIONER_ROLE_LIST (gcloud.ts), granted at install by the
  * Owner's own account; a converge cannot repair them and Pulumi names what
@@ -73,13 +90,63 @@ export const CONVERGE_PREFLIGHT_VOICE = {
     subject: "the converge job",
     repair: "Run the update once from Cloud Shell or the computer you installed from (Settings → Updates shows the command); it repairs the converge job's access.",
 };
+/**
+ * The roles the converge job may grant its own account when the self-check
+ * finds them missing: exactly the roles `ensureConvergeJob` grants it, as
+ * compiled into this release (see the file comment).
+ */
+export const CONVERGE_SELF_GRANTABLE_ROLES = INSTALL_JOB_ROLES;
+/**
+ * Roles the converge job must never grant itself, whatever a release's list
+ * says — ownership and IAM-policy roles (prefix matches). The tests assert
+ * {@link CONVERGE_SELF_GRANTABLE_ROLES} names none of them, and the grant
+ * step refuses them again at run time.
+ */
+export const SELF_GRANT_FORBIDDEN_ROLES = [
+    "roles/owner",
+    "roles/editor",
+    "roles/resourcemanager.",
+    "roles/iam.securityAdmin",
+    "roles/iam.organizationRoleAdmin",
+    "roles/iam.serviceAccountKeyAdmin",
+    "roles/iam.workloadIdentityPoolAdmin",
+    "roles/orgpolicy.",
+    "roles/billing.",
+];
+/** Whether the converge job may grant `role` to its own account (see the file comment). */
+export function isSelfGrantableRole(role) {
+    return (CONVERGE_SELF_GRANTABLE_ROLES.includes(role) &&
+        !SELF_GRANT_FORBIDDEN_ROLES.some((f) => role === f || (f.endsWith(".") && role.startsWith(f))));
+}
+/**
+ * Split the self-check's missing permissions into roles the job grants
+ * itself and the rest. A check counts as repairable only when its whole
+ * shortfall is permissions of an allowlisted role it is marked with.
+ */
+export function selfGrantPlan(missing) {
+    const grant = [];
+    const blocking = [];
+    for (const m of missing) {
+        const role = m.check.role;
+        if (role && isSelfGrantableRole(role) && !(m.unchecked && m.unchecked.length > 0)) {
+            if (!grant.includes(role))
+                grant.push(role);
+        }
+        else {
+            blocking.push(m);
+        }
+    }
+    const order = CONVERGE_SELF_GRANTABLE_ROLES;
+    grant.sort((a, b) => order.indexOf(a) - order.indexOf(b));
+    return { grant, blocking };
+}
 /** Every permission a converge run relies on after its decision (see the file comment). */
 export function convergeAccessChecks(target) {
     const { projectId, region, env } = target;
     const project = { kind: "project", projectId };
     const bucket = opsBucketName(projectId);
     return [
-        ...INSTALL_JOB_ROLES.map((role) => ({ resource: project, ...INSTALL_ROLE_USES[role] })),
+        ...INSTALL_JOB_ROLES.map((role) => ({ resource: project, role, ...INSTALL_ROLE_USES[role] })),
         {
             need: `read and write the install's records and state lock (${OPS_INSTALL_PREFIX}/) and the update's checkpoint (${CONVERGE_STATE_PREFIX}/) in the ops bucket`,
             resource: { kind: "bucket", bucket },

package/dist/converge-job-preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-preflight.js","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAG1B;IACF,qBAAqB,EAAE;QACrB,IAAI,EAAE,uEAAuE;QAC7E,WAAW,EAAE,CAAC,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,CAAC;KACvE;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,2EAA2E;QACjF,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,gEAAgE;QACtE,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,8CAA8C;QACpD,WAAW,EAAE,CAAC,2BAA2B,CAAC;KAC3C;CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EACJ,uJAAuJ;CAC1J,CAAC;AAEF,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,MAIpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAW,CAAC;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF;YACE,IAAI,EAAE,wDAAwD,kBAAkB,mCAAmC,qBAAqB,sBAAsB;YAC9J,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;YACpC,WAAW,EAAE;gBACX,sBAAsB;gBACtB,qBAAqB;gBACrB,wBAAwB;gBACxB,wBAAwB;aACzB;SACF;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE;YAC5E,WAAW,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;SACjE;QACD;YACE,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;SACpC;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,SAAS;gBACT,KAAK,EAAE,8BAA8B,CAAC,SAAS,CAAC;aACjD;YACD,WAAW,EAAE,CAAC,2BAA2B,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,kCAAkC,gBAAgB,4CAA4C;YACpG,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;SACpE;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"converge-job-preflight.js","sourceRoot":"","sources":["../src/converge-job-preflight.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAG1B;IACF,qBAAqB,EAAE;QACrB,IAAI,EAAE,uEAAuE;QAC7E,WAAW,EAAE,CAAC,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,CAAC;KACvE;IACD,4BAA4B,EAAE;QAC5B,IAAI,EAAE,2EAA2E;QACjF,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,wBAAwB,EAAE;QACxB,IAAI,EAAE,gEAAgE;QACtE,WAAW,EAAE;YACX,4BAA4B;YAC5B,yBAAyB;YACzB,4BAA4B;SAC7B;KACF;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,8CAA8C;QACpD,WAAW,EAAE,CAAC,2BAA2B,CAAC;KAC3C;CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EACJ,uJAAuJ;CAC1J,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAA8B,iBAAiB,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,aAAa;IACb,cAAc;IACd,wBAAwB;IACxB,yBAAyB;IACzB,iCAAiC;IACjC,kCAAkC;IAClC,qCAAqC;IACrC,kBAAkB;IAClB,gBAAgB;CACR,CAAC;AAEX,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,CACJ,6BAAmD,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnE,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/F,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsD;IAEtD,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAyC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,IAAI,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,6BAAkD,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,MAIpC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAW,CAAC;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F;YACE,IAAI,EAAE,wDAAwD,kBAAkB,mCAAmC,qBAAqB,sBAAsB;YAC9J,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;YACpC,WAAW,EAAE;gBACX,sBAAsB;gBACtB,qBAAqB;gBACrB,wBAAwB;gBACxB,wBAAwB;aACzB;SACF;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE;YAC5E,WAAW,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;SACjE;QACD;YACE,IAAI,EAAE,0DAA0D;YAChE,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,oBAAoB,CAAC;SACpC;QACD;YACE,IAAI,EAAE,oEAAoE;YAC1E,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,SAAS;gBACT,KAAK,EAAE,8BAA8B,CAAC,SAAS,CAAC;aACjD;YACD,WAAW,EAAE,CAAC,2BAA2B,CAAC;SAC3C;QACD;YACE,IAAI,EAAE,kCAAkC,gBAAgB,4CAA4C;YACpG,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;SACpE;KACF,CAAC;AACJ,CAAC"}

package/dist/converge-job-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-setup.d.ts","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAmDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO3F;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,yDAA0D,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAMnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEN;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CA4B3E;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAiH9B"}
+{"version":3,"file":"converge-job-setup.d.ts","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO3F;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,yDAA0D,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAMnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC,CAAC;AAEN;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,EAAE,CA4B3E;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAiH9B"}

package/dist/converge-job-setup.js

@@ -40,7 +40,10 @@
  *   - {@link INSTALL_JOB_ROLES} (the operator-access step of a converge
  *     creates a custom role and a Cloud Scheduler job, and the job's lines
  *     must reach Cloud Logging) — what an install-job install already
- *     grants; not an escalation, the provisioner holds projectIamAdmin;
+ *     grants; not an escalation, the provisioner holds projectIamAdmin. The
+ *     converge job of a release that adds a role here grants it itself when
+ *     it finds it missing (converge-job-preflight.ts, the self-grant), so
+ *     the role reaches an older install without a terminal run;
  *   - a Cloud SQL IAM database login that is a member of `platform_updater`
  *     only (migration 0267): it reads its request and writes the timeline,
  *     nothing else in the database.

package/dist/converge-job-setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job-setup.js","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,wBAAwB,EAAE,kBAAkB,CAAU,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAEnD,2FAA2F;AAC3F,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,UAAU,GAAG,KAAK,CAAC;AA6BzB;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA2B;IAC/D,OAAO;QACL,KAAK;QACL,MAAM;QACN,QAAQ;QACR,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;QAC3B,WAAW,MAAM,CAAC,WAAW,EAAE;QAC/B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,qBAAqB,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QACvE,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,aAAa,uBAAuB,EAAE;QACtC,UAAU,oBAAoB,EAAE;QAChC,oEAAoE;QACpE,kBAAkB;QAClB,iBAAiB;QACjB,WAAW;QACX,qEAAqE;QACrE,kEAAkE;QAClE,iBAAiB;QACjB,kBAAkB,6BAA6B,GAAG;QAClD,SAAS,OAAO,EAAE;QAClB,YAAY,UAAU,EAAE;QACxB,8BAA8B;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,kBAAkB,WAAW,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAuB,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,0DAA0D,MAAM,CAAC,WAAW,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC;QAC5B,SAAS;QACT,SAAS;QACT,UAAU;QACV,QAAQ,MAAM,EAAE;QAChB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uBAAuB,MAAM,kBAAkB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,qFAAqF;SACrK,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,mBAAmB;IACnB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,WAAW;QACX,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,uBAAuB,WAAW,qBAAqB,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,6IAA6I;SAClO,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,yBAAyB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,WAAW;QAChC,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,qBAAqB;IACrB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAE/E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"converge-job-setup.js","sourceRoot":"","sources":["../src/converge-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,wBAAwB,EAAE,kBAAkB,CAAU,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAEnD,2FAA2F;AAC3F,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,UAAU,GAAG,KAAK,CAAC;AA6BzB;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA2B;IAC/D,OAAO;QACL,KAAK;QACL,MAAM;QACN,QAAQ;QACR,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;QAC3B,WAAW,MAAM,CAAC,WAAW,EAAE;QAC/B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,qBAAqB,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QACvE,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,aAAa,uBAAuB,EAAE;QACtC,UAAU,oBAAoB,EAAE;QAChC,oEAAoE;QACpE,kBAAkB;QAClB,iBAAiB;QACjB,WAAW;QACX,qEAAqE;QACrE,kEAAkE;QAClE,iBAAiB;QACjB,kBAAkB,6BAA6B,GAAG;QAClD,SAAS,OAAO,EAAE;QAClB,YAAY,UAAU,EAAE;QACxB,8BAA8B;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,kBAAkB,WAAW,EAAE,CAAC;IAC/C,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAuB,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,0DAA0D,MAAM,CAAC,WAAW,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC;QAC5B,SAAS;QACT,SAAS;QACT,UAAU;QACV,QAAQ,MAAM,EAAE;QAChB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uBAAuB,MAAM,kBAAkB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,qFAAqF;SACrK,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,mBAAmB;IACnB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,WAAW;QACX,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,uBAAuB,WAAW,qBAAqB,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,6IAA6I;SAClO,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,yBAAyB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,WAAW;QAChC,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,qBAAqB;IACrB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAE/E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/converge-job.d.ts

@@ -14,7 +14,9 @@
  *     verifies its signature (release-manifest.ts), and decides
  *     (upgrader-assess.ts, `route: "converge"`): no downgrade, nothing
  *     below minFromVersion, no automatic converge unless the policy allows
- *     it; then it checks its own IAM access (converge-job-preflight.ts).
+ *     it; then it checks its own IAM access (converge-job-preflight.ts) and
+ *     stops on anything missing — except a role of the self-grant
+ *     allowlist, which it leaves to stage 2.
  *     Then it verifies the target's ops image, points this job at it BY DIGEST and starts a new
  *     execution, handing the request over to it. It changes nothing else:
  *     the converge logic always comes from the release it installs.
@@ -23,7 +25,9 @@
  *     version is the request's). It verifies the manifest again, checks
  *     that the image it runs is the one the manifest signs, takes the
  *     install's state lock (#815; the upgrader job and the terminal
- *     `upgrade` take the same one, so they exclude each other), and runs
+ *     `upgrade` take the same one, so they exclude each other), grants its
+ *     own account the allowlisted roles the self-check found missing (each
+ *     a timeline event; IAM is asked again before it goes on), and runs
  *     the very upgrade the terminal runs (upgrade/upgrade.ts): backup →
  *     converge + app-roll → deep health check, rollback on failure →
  *     install.json + the infrastructure contract → the request's end.
@@ -43,7 +47,7 @@
  * the database (`caelo-ops converge-job`).
  */
 import type { ConvergeCheckpoint } from "./converge-checkpoint.js";
-import { type ExecutionState } from "./install-job.js";
+import { type ExecutionState, type InstallJobRole } from "./install-job.js";
 import type { InstallMetadata } from "./install-state.js";
 import { type ReleaseManifest, type ReleaseManifestResult } from "./release-manifest.js";
 import type { UpgradeCheckpoint } from "./upgrade/upgrade.js";
@@ -87,6 +91,13 @@ export type ConvergeUpgradeOutcome = {
     /** The new release serves but install.json could not record it (#860). */
     readonly unrecorded: boolean;
 };
+/**
+ * How long stage 2 waits for IAM to confirm the roles it granted itself:
+ * Google documents that a policy change usually applies within two minutes
+ * and can take seven (cloud.google.com/iam/docs/access-change-propagation).
+ */
+export declare const SELF_GRANT_RECHECK_INTERVAL_MS = 15000;
+export declare const SELF_GRANT_RECHECK_ATTEMPTS = 32;
 /** How {@link ConvergeJobDeps.secureDatabase} ended. */
 export type SecureDatabaseResult = {
     readonly ok: true;
@@ -112,6 +123,19 @@ export interface ConvergeJobDeps {
     readonly region: string;
     /** Asks IAM as this job's own identity (the IAM self-check, #884). */
     readonly iam: IamTester;
+    /**
+     * Grant this job's own account (the install's provisioner) `role` on the
+     * project. Stage 2 only, and only for roles of the self-grant allowlist
+     * (converge-job-preflight.ts); the real one refuses any other role.
+     */
+    readonly grantOwnRole: (role: InstallJobRole) => Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly error: string;
+    }>;
+    /** Waits between the IAM re-checks after a self-grant. */
+    readonly sleep: (ms: number) => Promise<void>;
     /** This Cloud Run execution; null outside Cloud Run. */
     readonly execution: string | null;
     /** The Caelo release this code belongs to (CAELO_VERSION of the image). */

package/dist/converge-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job.d.ts","sourceRoot":"","sources":["../src/converge-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EACL,KAAK,SAAS,EAIf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,aAAa,EAIlB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,aAAa,EAAiB,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAExF,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;IAC/D;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AAED,2EAA2E;AAC3E,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEN,wDAAwD;AACxD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5E,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACnD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtD,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,CACnB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAC5B;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GACjD;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CACjD,CAAC;IACF,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACvE,QAAQ,CAAC,cAAc,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;IACzD,QAAQ,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACnE,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;QACnC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;QAC/C,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;KAChE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0atF"}
+{"version":3,"file":"converge-job.d.ts","sourceRoot":"","sources":["../src/converge-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAQnE,OAAO,EAAoB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EACL,KAAK,SAAS,EAKf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,aAAa,EAIlB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,aAAa,EAAiB,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAExF,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;IAC/D;;;OAGG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACvE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AAED,2EAA2E;AAC3E,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEN;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAAS,CAAC;AACrD,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C,wDAAwD;AACxD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,CACrB,IAAI,EAAE,cAAc,KACjB,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5E,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,eAAe,GAAG,IAAI,CAAC;IACnD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtD,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,CACnB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAC5B;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GACjD;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CACjD,CAAC;IACF,yDAAyD;IACzD,QAAQ,CAAC,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxE;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IACvE,QAAQ,CAAC,cAAc,EAAE,MAAM,kBAAkB,GAAG,IAAI,CAAC;IACzD,QAAQ,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACnE,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;QACnC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,CAAC;QAC/C,QAAQ,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;KAChE,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAygBtF"}

package/dist/converge-job.js

@@ -1,13 +1,21 @@
 // SPDX-License-Identifier: MPL-2.0
-import { CONVERGE_PREFLIGHT_VOICE, convergeAccessChecks } from "./converge-job-preflight.js";
+import { CONVERGE_PREFLIGHT_VOICE, convergeAccessChecks, INSTALL_ROLE_USES, selfGrantPlan, } from "./converge-job-preflight.js";
 import { GCP_STACK_ENV } from "./gcp-names.js";
 import { decideInstallJob } from "./install-job.js";
+import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
 import { compareSemver, } from "./release-manifest.js";
 import { StateLockHeldError } from "./state-store.js";
 import { assessUpgradeRequest } from "./upgrader-assess.js";
-import { preflightErrorReason, preflightMissingReason, runIamPreflight, } from "./upgrader-iam-preflight.js";
+import { missingAccessText, preflightErrorReason, preflightMissingReason, runIamPreflight, } from "./upgrader-iam-preflight.js";
 import { recordUpdateEnd, } from "./upgrader-job.js";
 import { eventReporter } from "./upgrader-reporter.js";
+/**
+ * How long stage 2 waits for IAM to confirm the roles it granted itself:
+ * Google documents that a policy change usually applies within two minutes
+ * and can take seven (cloud.google.com/iam/docs/access-change-propagation).
+ */
+export const SELF_GRANT_RECHECK_INTERVAL_MS = 15_000;
+export const SELF_GRANT_RECHECK_ATTEMPTS = 32;
 /** Run the converge job once. Never throws; see the file comment. */
 export async function runConvergeJob(deps) {
     const { queue, log } = deps;
@@ -137,19 +145,32 @@ export async function runConvergeJob(deps) {
         const m = decision.manifest;
         // #884 — decided to run: ask IAM for what the rest needs before the
         // lock, the hand-over or the backup (converge-job-preflight.ts). Both
-        // stages ask; stage 2's list is the target release's own.
-        const access = await runIamPreflight(convergeAccessChecks({ projectId: deps.projectId, region: deps.region, env: GCP_STACK_ENV }), deps.iam);
-        if (access.kind === "missing") {
-            return stopWith("needs_cloud_shell", ["iam-preflight"], preflightMissingReason(access.missing, CONVERGE_PREFLIGHT_VOICE));
-        }
+        // stages ask; stage 2's list is the target release's own. A missing
+        // role of the self-grant allowlist does not stop the run: stage 2
+        // grants it once it has verified its own image and holds the lock.
+        const stage1 = compareSemver(deps.ownVersion, m.version) !== 0;
+        const access = await askIam();
         if (access.kind === "error") {
             return stopWith("failed", ["iam-preflight"], preflightErrorReason(access.errors, CONVERGE_PREFLIGHT_VOICE));
         }
-        r.info("The converge job has every permission this update needs.");
-        if (compareSemver(deps.ownVersion, m.version) !== 0) {
+        let toGrant = [];
+        if (access.kind === "missing") {
+            const plan = selfGrantPlan(access.missing);
+            if (plan.blocking.length > 0) {
+                return stopWith("needs_cloud_shell", ["iam-preflight"], preflightMissingReason(access.missing, CONVERGE_PREFLIGHT_VOICE));
+            }
+            toGrant = plan.grant;
+        }
+        if (toGrant.length === 0) {
+            r.info("The converge job has every permission this update needs.");
+        }
+        else {
+            r.info(`The converge job's account lacks ${toGrant.join(", ")}, which this update needs. ${stage1 ? `The installer of ${m.version} grants them to it` : "It grants them to itself"} before it changes anything, once its own installer image is verified.`);
+        }
+        if (stage1) {
             return await handOver(m);
         }
-        return await convergeHere(m, fromVersion ?? meta.releaseVersion, checkpoint, meta);
+        return await convergeHere(m, fromVersion ?? meta.releaseVersion, checkpoint, meta, toGrant);
     }
     catch (e) {
         return stopWith("failed", ["internal"], `The converge job stopped unexpectedly: ${errorText(e)}. If the site misbehaves, check Settings → Updates and the job's log.`);
@@ -190,7 +211,7 @@ export async function runConvergeJob(deps) {
         return { exitCode: 0, requestId: request.id, status: null };
     }
     /** Stage 2: this image is the release's own installer; converge + roll. */
-    async function convergeHere(m, fromVersion, checkpoint, judged) {
+    async function convergeHere(m, fromVersion, checkpoint, judged, toGrant) {
         const installId = judged.installId;
         const own = await deps.ownImageDigest();
         // Cloud Run records the linux/amd64 platform manifest it resolved, not
@@ -221,6 +242,13 @@ export async function runConvergeJob(deps) {
         const stale = recordsChangedSince(judged, changed);
         if (stale)
             return stopWith(stale.status, stale.codes, stale.reason);
+        // After the image check and under the lock: only the target release's
+        // verified installer grants, and only roles of its own allowlist.
+        if (toGrant.length > 0) {
+            const granted = await grantOwnRoles(m, toGrant, changed);
+            if (granted)
+                return stopWith(granted.status, granted.codes, granted.reason);
+        }
         const startedAt = deps.now().toISOString();
         let current = {
             statusVersion: 1,
@@ -294,6 +322,60 @@ export async function runConvergeJob(deps) {
         }
         return stopWith("failed", ["converge"], `The update to ${m.version} stopped before it finished (see the timeline above); the previous release keeps serving. Fix what it names and start the update again; it continues where it stopped.`);
     }
+    /** The converge self-check against IAM, as this job's identity. */
+    function askIam() {
+        return runIamPreflight(convergeAccessChecks({ projectId: deps.projectId, region: deps.region, env: GCP_STACK_ENV }), deps.iam);
+    }
+    /**
+     * Stage 2: grant this job's account each role in `roles` (the self-check
+     * found them missing; all are on the allowlist), then wait until IAM
+     * confirms the whole self-check. Null when it does; how the request ends
+     * otherwise.
+     */
+    async function grantOwnRoles(m, roles, changed) {
+        const account = provisionerServiceAccountEmail(deps.projectId);
+        const granted = [];
+        const before = () => changed
+            ? "This update already started changing the site; "
+            : granted.length > 0
+                ? `Nothing on the site was changed (the converge job's account got ${granted.join(", ")}): `
+                : "Nothing was changed: ";
+        for (const role of roles) {
+            const result = await deps.grantOwnRole(role);
+            if (!result.ok) {
+                return {
+                    status: "needs_cloud_shell",
+                    codes: ["iam-self-grant"],
+                    reason: `${before()}the converge job could not grant its own account (${account}) ${role}, which Caelo ${m.version} needs to ${INSTALL_ROLE_USES[role].need} (${result.error}). ${CONVERGE_PREFLIGHT_VOICE.repair}`,
+                };
+            }
+            granted.push(role);
+            r.success(`Granted ${role} to the converge job's account (${account}), needed by Caelo ${m.version} to ${INSTALL_ROLE_USES[role].need}.`);
+        }
+        await r.flush();
+        let last = await askIam();
+        for (let attempt = 1; last.kind !== "ok" && attempt < SELF_GRANT_RECHECK_ATTEMPTS; attempt++) {
+            await deps.sleep(SELF_GRANT_RECHECK_INTERVAL_MS);
+            last = await askIam();
+        }
+        if (last.kind === "ok") {
+            r.info("IAM confirms the granted roles; the converge job has every permission this update needs.");
+            return null;
+        }
+        const minutes = Math.round((SELF_GRANT_RECHECK_INTERVAL_MS * (SELF_GRANT_RECHECK_ATTEMPTS - 1)) / 60_000);
+        if (last.kind === "error") {
+            return {
+                status: "failed",
+                codes: ["iam-self-grant"],
+                reason: `${before()}after granting its own account ${granted.join(", ")}, the converge job could not check its access again (${last.errors.join("; ")}). Start the update again from Settings → Updates in a few minutes.`,
+            };
+        }
+        return {
+            status: "needs_cloud_shell",
+            codes: ["iam-self-grant"],
+            reason: `${before()}the converge job granted its own account ${granted.join(", ")}, but ${minutes} minutes later Google Cloud still reports permissions missing — ${missingAccessText(last.missing)}. ${CONVERGE_PREFLIGHT_VOICE.repair}`,
+        };
+    }
     /**
      * Whether install.json, re-read under the lock, is still what the run was
      * judged on; how the request ends otherwise.

package/dist/converge-job.js.map

@@ -1 +1 @@
-{"version":3,"file":"converge-job.js","sourceRoot":"","sources":["../src/converge-job.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAgDnC,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAuB,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EACL,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAEL,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,eAAe,GAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAsB,aAAa,EAAe,MAAM,wBAAwB,CAAC;AA4GxF,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,CAAC,GAAG,aAAa,CACrB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EACzE,GAAG,EACH,OAAO,CAAC,EAAE,CACX,CAAC;IACF,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,OAAe,EAAqB,EAAE;QACnD,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC;IACF,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAc,EAA8B,EAAE;QAClE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,CAAC,CAAC,OAAO,CAAC,SAAS,OAAO,CAAC,aAAa,gBAAgB,CAAC,CAAC;;YACrF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACjF,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAuB,EAAE,KAAwB,EAAE,MAAc,EAAE,EAAE,CACrF,MAAM,CAAC;QACL,MAAM;QACN,MAAM;QACN,KAAK;QACL,gBAAgB,EACd,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;KAClF,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,mEAAmE;QACnE,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CAAC,aAAa,KAAK,CAAC,SAAS,6CAA6C,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACzE,OAAO,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC/E,CAAC;YACD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,4BAA4B,OAAO,CAAC,aAAa,SAAS,IAAI,CAAC,SAAS,qBAAqB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,+BAA+B,CACzK,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,uBAAuB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,OAAO,CAAC,aAAa,iEAAiE,CACpL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,mCAAmC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACxF,CAAC;QAED,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/C,OAAO,QAAQ,CACb,mBAAmB,EACnB,CAAC,eAAe,CAAC,EACjB,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChE,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,UAAU,CAAC,EACZ,oEAAoE,IAAI,CAAC,QAAQ,GAAG,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC;QACvF,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,WAAW,GACf,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtC,CAAC,CAAC,UAAU,CAAC,WAAW;YACxB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9F,CAAC,CAAC,IAAI,CAAC,8CAA8C,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,OAAO;YACP,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC,EAAE;YACzF,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,OAAO,CACP,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,OAAO,gDAAgD,CACpG,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC7B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;gBAC5C,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ;gBACzD,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,CAAC,oBAAoB;gBAC7D,sBAAsB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC;gBACtD,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;gBAC5C,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;gBAChD,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG;aACzC,CAAC,CAAC;QACL,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAE5B,oEAAoE;QACpE,sEAAsE;QACtE,0DAA0D;QAC1D,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAC5F,IAAI,CAAC,GAAG,CACT,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,QAAQ,CACb,mBAAmB,EACnB,CAAC,eAAe,CAAC,EACjB,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,wBAAwB,CAAC,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,eAAe,CAAC,EACjB,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAC9D,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAEnE,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,YAAY,CAAC,CAAC,EAAE,WAAW,IAAK,IAAI,CAAC,cAAyB,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,0CAA0C,SAAS,CAAC,CAAC,CAAC,uEAAuE,CAC9H,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,UAAU,QAAQ,CAAC,CAAkB;QACxC,CAAC,CAAC,IAAI,CACJ,mCAAmC,IAAI,CAAC,UAAU,sCAAsC,CAAC,CAAC,OAAO,sEAAsE,CACxK,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,0BAA0B,CAAC,CAAC,OAAO,qEAAqE,CACzG,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,2BAA2B,OAAO,CAAC,KAAK,2BAA2B,CACtH,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,0BAA0B,OAAO,CAAC,KAAK,2BAA2B,CACrH,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,kBAAkB,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC;YACF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAAS,EAAE;YAC9C,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,YAAY,CACzB,CAAkB,EAClB,WAAmB,EACnB,UAAqC,EACrC,MAAuB;QAEvB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,oDAAoD,GAAG,IAAI,SAAS,wDAAwD,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,oDAAoD,CACvN,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,MAAM,IAAI,GACR,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YACnD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CACV,aAAa,OAAO,CAAC,MAAM,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,aAAa,KAAK,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtF,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,OAAO,GAAG,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,OAAO,GAAuB;YAChC,aAAa,EAAE,CAAC;YAChB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW;YACxC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,UAAU;YACjB,YAAY,EAAE,IAAI,CAAC,UAAU;YAC7B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,CAAC,CAAC,OAAO;YACxB,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,KAAkC,EAAE,EAAE;YAClD,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACxE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,qEAAqE;QACrE,IAAI,CAAC,EAAE,CAAC,CAAC;QAET,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpB,iEAAiE;QACjE,iEAAiE;QACjE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,CAAC,CAAC,IAAI,CACJ,mHAAmH,CACpH,CAAC;YACF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC5C,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,cAAc,CAAC,EAChB,iBAAiB,CAAC,CAAC,OAAO,mEAAmE,OAAO,CAAC,KAAK,oHAAoH,CAC/N,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,OAAO,CAAC,wCAAwC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,UAAU;gBAChB,CAAC,CAAC;oBACE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF;gBACH,CAAC,CAAC,SAAS;YACb,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBAClB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAC7E,GAAG,CAAC;wBACF,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,kDAAkD,SAAS,CAAC,CAAC,CAAC,EAAE;wBACzE,SAAS,EAAE,OAAO,CAAC,EAAE;qBACtB,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,CAAC,cAAc;oBAAE,IAAI,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,CAAC,CAAC,IAAI,CACJ,8GAA8G,CAC/G,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,yMAAyM,CAC5N,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,aAAa,EACb,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,4GAA4G,CAC/H,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,iBAAiB,CAAC,CAAC,OAAO,wKAAwK,CACnM,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAC1B,MAAuB,EACvB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC,oBAAoB,CAAC;gBAC7B,MAAM,EAAE,GAAG,MAAM,wFAAwF,SAAS,CAAC,CAAC,CAAC,2DAA2D;aACjL,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,uBAAuB,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,4LAA4L;SAC9M,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,WAAW,CAClB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;gBACpC,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,CAAC,cAAc,CAAC;oBACvB,MAAM,EAAE,GAAG,MAAM,sDAAsD,SAAS,CAAC,CAAC,CAAC,gFAAgF;iBACpK,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,CAAC,cAAc,CAAC;gBACvB,MAAM,EAAE,GAAG,MAAM,6DAA6D,SAAS,CAAC,CAAC,CAAC,sGAAsG;aACjM,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"converge-job.js","sourceRoot":"","sources":["../src/converge-job.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAoDnC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,GACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAA4C,MAAM,kBAAkB,CAAC;AAE9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EACL,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAEL,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,eAAe,GAChB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,eAAe,GAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAsB,aAAa,EAAe,MAAM,wBAAwB,CAAC;AA4CxF;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AA4E9C,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,CAAC,GAAG,aAAa,CACrB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EACzE,GAAG,EACH,OAAO,CAAC,EAAE,CACX,CAAC;IACF,4EAA4E;IAC5E,MAAM,KAAK,GAAG,CAAC,OAAe,EAAqB,EAAE;QACnD,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC,CAAC;IACF,IAAI,WAAW,GAAwB,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAc,EAA8B,EAAE;QAClE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,CAAC,CAAC,OAAO,CAAC,SAAS,OAAO,CAAC,aAAa,gBAAgB,CAAC,CAAC;;YACrF,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,QAAQ,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACjF,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAuB,EAAE,KAAwB,EAAE,MAAc,EAAE,EAAE,CACrF,MAAM,CAAC;QACL,MAAM;QACN,MAAM;QACN,KAAK;QACL,gBAAgB,EACd,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,aAAa,CAAC;KAClF,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,mEAAmE;QACnE,uDAAuD;QACvD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,KAAK,CAAC,aAAa,KAAK,CAAC,SAAS,6CAA6C,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACzE,OAAO,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAC/E,CAAC;YACD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,4BAA4B,OAAO,CAAC,aAAa,SAAS,IAAI,CAAC,SAAS,qBAAqB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,+BAA+B,CACzK,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CACJ,uBAAuB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,OAAO,CAAC,aAAa,iEAAiE,CACpL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,mCAAmC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACxF,CAAC;QAED,oEAAoE;QACpE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/C,OAAO,QAAQ,CACb,mBAAmB,EACnB,CAAC,eAAe,CAAC,EACjB,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChE,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,UAAU,CAAC,EACZ,oEAAoE,IAAI,CAAC,QAAQ,GAAG,CACrF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC;QACvF,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,WAAW,GACf,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtC,CAAC,CAAC,UAAU,CAAC,WAAW;YACxB,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YAC9F,CAAC,CAAC,IAAI,CAAC,8CAA8C,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC;YACpC,OAAO;YACP,QAAQ,EAAE,cAAc;YACxB,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC,EAAE;YACzF,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC,CAAC,OAAO,CACP,0BAA0B,QAAQ,CAAC,QAAQ,CAAC,OAAO,gDAAgD,CACpG,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE;gBAC7B,gBAAgB,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ;gBAC5C,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ;gBACzD,qBAAqB,EAAE,QAAQ,CAAC,QAAQ,CAAC,oBAAoB;gBAC7D,sBAAsB,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC;gBACtD,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;gBAC5C,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;gBAChD,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG;aACzC,CAAC,CAAC;QACL,CAAC;QACD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClB,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAE5B,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,eAAe,CAAC,EACjB,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAA8B,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CACb,mBAAmB,EACnB,CAAC,eAAe,CAAC,EACjB,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,wBAAwB,CAAC,CACjE,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CACJ,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC,0BAA0B,wEAAwE,CACpP,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,YAAY,CACvB,CAAC,EACD,WAAW,IAAK,IAAI,CAAC,cAAyB,EAC9C,UAAU,EACV,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,0CAA0C,SAAS,CAAC,CAAC,CAAC,uEAAuE,CAC9H,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,UAAU,QAAQ,CAAC,CAAkB;QACxC,CAAC,CAAC,IAAI,CACJ,mCAAmC,IAAI,CAAC,UAAU,sCAAsC,CAAC,CAAC,OAAO,sEAAsE,CACxK,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,0BAA0B,CAAC,CAAC,OAAO,qEAAqE,CACzG,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,gEAAgE;QAChE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,2BAA2B,OAAO,CAAC,KAAK,2BAA2B,CACtH,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,gDAAgD;QAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,yCAAyC,CAAC,CAAC,OAAO,0BAA0B,OAAO,CAAC,KAAK,2BAA2B,CACrH,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,kBAAkB,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QAC7E,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,GAAG,CAAC;YACF,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAAS,EAAE;YAC9C,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,YAAY,CACzB,CAAkB,EAClB,WAAmB,EACnB,UAAqC,EACrC,MAAuB,EACvB,OAAkC;QAElC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,QAAQ,CACb,SAAS,EACT,CAAC,WAAW,CAAC,EACb,oDAAoD,GAAG,IAAI,SAAS,wDAAwD,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,oDAAoD,CACvN,CAAC;QACJ,CAAC;QACD,gEAAgE;QAChE,MAAM,IAAI,GACR,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YACnD,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CACV,aAAa,OAAO,CAAC,MAAM,CAAC,SAAS,6CAA6C,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GACd,UAAU,IAAI,UAAU,CAAC,aAAa,KAAK,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,KAAK,WAAW;YACtF,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,OAAO,GAAG,UAAU,EAAE,MAAM,KAAK,SAAS,CAAC;QACjD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,KAAK;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpE,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,OAAO;gBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,OAAO,GAAuB;YAChC,aAAa,EAAE,CAAC;YAChB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW;YACxC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,UAAU;YACjB,YAAY,EAAE,IAAI,CAAC,UAAU;YAC7B,SAAS,EAAE,UAAU,EAAE,SAAS,IAAI,SAAS;YAC7C,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,CAAC,CAAC,OAAO;YACxB,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,KAAkC,EAAE,EAAE;YAClD,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACxE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,qEAAqE;QACrE,IAAI,CAAC,EAAE,CAAC,CAAC;QAET,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACpB,iEAAiE;QACjE,iEAAiE;QACjE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,CAAC,CAAC,IAAI,CACJ,mHAAmH,CACpH,CAAC;YACF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC5C,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,cAAc,CAAC,EAChB,iBAAiB,CAAC,CAAC,OAAO,mEAAmE,OAAO,CAAC,KAAK,oHAAoH,CAC/N,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,OAAO,CAAC,wCAAwC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;YACjC,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,UAAU;gBAChB,CAAC,CAAC;oBACE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF;gBACH,CAAC,CAAC,SAAS;YACb,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;gBAClB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;oBACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAC7E,GAAG,CAAC;wBACF,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,kDAAkD,SAAS,CAAC,CAAC,CAAC,EAAE;wBACzE,SAAS,EAAE,OAAO,CAAC,EAAE;qBACtB,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,CAAC,cAAc;oBAAE,IAAI,CAAC,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,CAAC,CAAC,IAAI,CACJ,8GAA8G,CAC/G,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,yMAAyM,CAC5N,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,aAAa,EACb,CAAC,QAAQ,CAAC,EACV,SAAS,CAAC,CAAC,OAAO,4GAA4G,CAC/H,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CACb,QAAQ,EACR,CAAC,UAAU,CAAC,EACZ,iBAAiB,CAAC,CAAC,OAAO,wKAAwK,CACnM,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,SAAS,MAAM;QACb,OAAO,eAAe,CACpB,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,EAC5F,IAAI,CAAC,GAAG,CACT,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,aAAa,CAC1B,CAAkB,EAClB,KAAgC,EAChC,OAAgB;QAEhB,MAAM,OAAO,GAAG,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,OAAO;YACL,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAClB,CAAC,CAAC,mEAAmE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAC5F,CAAC,CAAC,uBAAuB,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,mBAAmB;oBAC3B,KAAK,EAAE,CAAC,gBAAgB,CAAC;oBACzB,MAAM,EAAE,GAAG,MAAM,EAAE,qDAAqD,OAAO,KAAK,IAAI,iBAAiB,CAAC,CAAC,OAAO,aAAa,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,MAAM,wBAAwB,CAAC,MAAM,EAAE;iBACpN,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC,CAAC,OAAO,CACP,WAAW,IAAI,mCAAmC,OAAO,sBAAsB,CAAC,CAAC,OAAO,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAC/H,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,2BAA2B,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7F,MAAM,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACjD,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,CAAC,CAAC,IAAI,CACJ,0FAA0F,CAC3F,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,CAAC,8BAA8B,GAAG,CAAC,2BAA2B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAC9E,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC,gBAAgB,CAAC;gBACzB,MAAM,EAAE,GAAG,MAAM,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qEAAqE;aAC3N,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,mBAAmB;YAC3B,KAAK,EAAE,CAAC,gBAAgB,CAAC;YACzB,MAAM,EAAE,GAAG,MAAM,EAAE,4CAA4C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,mEAAmE,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,wBAAwB,CAAC,MAAM,EAAE;SAC1O,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,mBAAmB,CAC1B,MAAuB,EACvB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,CAAC,oBAAoB,CAAC;gBAC7B,MAAM,EAAE,GAAG,MAAM,wFAAwF,SAAS,CAAC,CAAC,CAAC,2DAA2D;aACjL,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,CAAC,uBAAuB,CAAC;YAChC,MAAM,EAAE,GAAG,MAAM,4LAA4L;SAC9M,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,SAAS,WAAW,CAClB,OAAgB;QAEhB,MAAM,MAAM,GAAG,OAAO;YACpB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,uBAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;gBACpC,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,CAAC,cAAc,CAAC;oBACvB,MAAM,EAAE,GAAG,MAAM,sDAAsD,SAAS,CAAC,CAAC,CAAC,gFAAgF;iBACpK,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,CAAC,cAAc,CAAC;gBACvB,MAAM,EAAE,GAAG,MAAM,6DAA6D,SAAS,CAAC,CAAC,CAAC,sGAAsG;aACjM,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/infra-contract.d.ts

@@ -20,7 +20,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export declare const INFRA_CONTRACT_VERSION = 18;
+export declare const INFRA_CONTRACT_VERSION = 19;
 /**
  * What each contract version adds, in operator terms — the upgrader's
  * refusal names the steps an install is missing. Keep one entry per version

package/dist/infra-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAiIzC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBjE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}
+{"version":3,"file":"infra-contract.d.ts","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAoIzC;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAoBjE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM7E;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/infra-contract.js

@@ -21,7 +21,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 18;
+export const INFRA_CONTRACT_VERSION = 19;
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
 //   1 — epic #696 split: converge vs app-roll.
@@ -148,6 +148,9 @@ export const INFRA_CONTRACT_VERSION = 18;
 //       on the admin. The new admin runs its periodic work and plugin workers
 //       only on that tick, so an in-cloud upgrader must not roll an install
 //       onto it before the tick exists.
+//  19 — the scheduler workflow's tick is a JSON POST. Without a content type
+//       SvelteKit refused every tick of contract 18 with 403, so no periodic
+//       work ran. The workflow source is only deployed by a converge.
 /**
  * What each contract version adds, in operator terms — the upgrader's
  * refusal names the steps an install is missing. Keep one entry per version
@@ -172,6 +175,7 @@ export const INFRA_CONTRACT_STEPS = {
     16: "the MCP sign-in service as its own Cloud Run service with its own account (no database access), the visitor gateway as its own service on Firebase installs, and on Google Cloud load-balancer installs the sign-in service's backend and Cloud Armor rule (#1328)",
     17: "the staging site's own database and its gateway login, kept apart from the live data (#1329)",
     18: "the scheduler tick that runs the admin's periodic work and plugin workers every few minutes: its service account, workflow and Cloud Scheduler job, and its IAP access (#1140)",
+    19: "the scheduler tick sent as a JSON request, because the admin refused every tick before (#1140)",
 };
 /**
  * The steps an install at contract `installed` lacks for `target`, oldest

package/dist/infra-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAC9D,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,6DAA6D;AAC7D,gEAAgE;AAChE,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,4BAA4B;AAC5B,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wCAAwC;AACxC,4EAA4E;AAC5E,wDAAwD;AACxD,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,6DAA6D;AAC7D,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,8CAA8C;AAC9C,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,kDAAkD;AAClD,2EAA2E;AAC3E,yEAAyE;AACzE,yDAAyD;AACzD,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,2CAA2C;AAC3C,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,oEAAoE;AACpE,uEAAuE;AACvE,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,8DAA8D;AAC9D,2EAA2E;AAC3E,mEAAmE;AACnE,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,oEAAoE;AACpE,4EAA4E;AAC5E,uEAAuE;AACvE,8BAA8B;AAC9B,8DAA8D;AAC9D,4EAA4E;AAC5E,8EAA8E;AAC9E,iFAAiF;AACjF,2EAA2E;AAC3E,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,8DAA8D;AAC9D,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,wCAAwC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;IAC5E,CAAC,EAAE,mEAAmE;IACtE,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,wEAAwE;IAC3E,CAAC,EAAE,8EAA8E;IACjF,CAAC,EAAE,mIAAmI;IACtI,EAAE,EAAE,sKAAsK;IAC1K,EAAE,EAAE,wKAAwK;IAC5K,EAAE,EAAE,sIAAsI;IAC1I,EAAE,EAAE,uKAAuK;IAC3K,EAAE,EAAE,sHAAsH;IAC1H,EAAE,EAAE,0IAA0I;IAC9I,EAAE,EAAE,oQAAoQ;IACxQ,EAAE,EAAE,8FAA8F;IAClG,EAAE,EAAE,gLAAgL;CACrL,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"infra-contract.js","sourceRoot":"","sources":["../src/infra-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,wEAAwE;AACxE,gCAAgC;AAChC,+CAA+C;AAC/C,sEAAsE;AACtE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,eAAe;AACf,0EAA0E;AAC1E,8DAA8D;AAC9D,6EAA6E;AAC7E,qEAAqE;AACrE,2EAA2E;AAC3E,6DAA6D;AAC7D,gEAAgE;AAChE,8EAA8E;AAC9E,yEAAyE;AACzE,wEAAwE;AACxE,4BAA4B;AAC5B,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,wCAAwC;AACxC,4EAA4E;AAC5E,wDAAwD;AACxD,0EAA0E;AAC1E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,6DAA6D;AAC7D,6EAA6E;AAC7E,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,8CAA8C;AAC9C,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,kDAAkD;AAClD,2EAA2E;AAC3E,yEAAyE;AACzE,yDAAyD;AACzD,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,2CAA2C;AAC3C,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,oEAAoE;AACpE,uEAAuE;AACvE,0EAA0E;AAC1E,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,8DAA8D;AAC9D,2EAA2E;AAC3E,mEAAmE;AACnE,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,6EAA6E;AAC7E,oEAAoE;AACpE,4EAA4E;AAC5E,uEAAuE;AACvE,8BAA8B;AAC9B,8DAA8D;AAC9D,4EAA4E;AAC5E,8EAA8E;AAC9E,iFAAiF;AACjF,2EAA2E;AAC3E,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,8DAA8D;AAC9D,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,wCAAwC;AACxC,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,CAAC,EAAE,6BAA6B;IAChC,CAAC,EAAE,sDAAsD;IACzD,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,yEAAyE;IAC5E,CAAC,EAAE,mEAAmE;IACtE,CAAC,EAAE,yDAAyD;IAC5D,CAAC,EAAE,wEAAwE;IAC3E,CAAC,EAAE,8EAA8E;IACjF,CAAC,EAAE,mIAAmI;IACtI,EAAE,EAAE,sKAAsK;IAC1K,EAAE,EAAE,wKAAwK;IAC5K,EAAE,EAAE,sIAAsI;IAC1I,EAAE,EAAE,uKAAuK;IAC3K,EAAE,EAAE,sHAAsH;IAC1H,EAAE,EAAE,0IAA0I;IAC9I,EAAE,EAAE,oQAAoQ;IACxQ,EAAE,EAAE,8FAA8F;IAClG,EAAE,EAAE,gLAAgL;IACpL,EAAE,EAAE,gGAAgG;CACrG,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,6BAA6B,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAc;IAC9D,OAAO,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/install-job.d.ts

@@ -56,6 +56,12 @@ export declare const OPS_IMAGE_REPOSITORY = "europe-west1-docker.pkg.dev/caelo-w
  * the job's own output has to reach Cloud Logging so the terminal can
  * tail it. Granted only to installs that use the job. Not an escalation: the
  * provisioner already holds `resourcemanager.projectIamAdmin`.
+ *
+ * This list is also the converge job's self-grant allowlist
+ * (converge-job-preflight.ts `CONVERGE_SELF_GRANTABLE_ROLES`): a role added
+ * here is granted by the converge job of the release that adds it to an
+ * install that lacks it, with no terminal run. Never add an ownership or
+ * IAM-policy role (the tests refuse `SELF_GRANT_FORBIDDEN_ROLES`).
  */
 export declare const INSTALL_JOB_ROLES: readonly ["roles/iam.roleAdmin", "roles/cloudscheduler.admin", "roles/workflows.editor", "roles/logging.logWriter"];
 /** One of {@link INSTALL_JOB_ROLES}. */

package/dist/install-job.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-job.d.ts","sourceRoot":"","sources":["../src/install-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,mCAAmC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,mEACiC,CAAC;AAEnE;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,qHAKpB,CAAC;AAEX,wCAAwC;AACxC,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQhE,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAcjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,gDAAgD;AAChD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,GAAG,CAAC,GAAG,IAAI,CAmBhG;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,MAAM,EAAE,CAAC,EACT,GAAG,EAAE,UAAU,GACd,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAE7F;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,IAAI,CAEN;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,OAAO,CAyBT;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,IAAI,CAgB7E;AAED,0CAA0C;AAC1C,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AAW5E,6CAA6C;AAC7C,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,cAAc,CAAC,CAuBzB;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAC/B,IAAI,EAAE,cAAc,GAAG,IAAI,GAC1B,kBAAkB,CAgBpB;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAwBnE;AAED,gEAAgE;AAChE,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BzE;AA2BD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAChD,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAyCrD;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoCtD;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAchG"}
+{"version":3,"file":"install-job.d.ts","sourceRoot":"","sources":["../src/install-job.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,6BAA6B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,mCAAmC,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,mEACiC,CAAC;AAEnE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,qHAKpB,CAAC;AAEX,wCAAwC;AACxC,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQhE,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAcjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,gDAAgD;AAChD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,GAAG,CAAC,GAAG,IAAI,CAmBhG;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,MAAM,EAAE,CAAC,EACT,GAAG,EAAE,UAAU,GACd,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAE7F;AAED,mEAAmE;AACnE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,IAAI,CAEN;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,EACxB,GAAG,EAAE,UAAU,GACd,OAAO,CAyBT;AAED,2FAA2F;AAC3F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,IAAI,CAgB7E;AAED,0CAA0C;AAC1C,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;AAW5E,6CAA6C;AAC7C,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC,cAAc,CAAC,CAuBzB;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAC/B,IAAI,EAAE,cAAc,GAAG,IAAI,GAC1B,kBAAkB,CAgBpB;AAED,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAwBnE;AAED,gEAAgE;AAChE,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA2BzE;AA2BD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAChD,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAChB,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAyCrD;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoCtD;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtD;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAchG"}

package/dist/install-job.js

@@ -60,6 +60,12 @@ export const OPS_IMAGE_REPOSITORY = "europe-west1-docker.pkg.dev/caelo-website/c
  * the job's own output has to reach Cloud Logging so the terminal can
  * tail it. Granted only to installs that use the job. Not an escalation: the
  * provisioner already holds `resourcemanager.projectIamAdmin`.
+ *
+ * This list is also the converge job's self-grant allowlist
+ * (converge-job-preflight.ts `CONVERGE_SELF_GRANTABLE_ROLES`): a role added
+ * here is granted by the converge job of the release that adds it to an
+ * install that lacks it, with no terminal run. Never add an ownership or
+ * IAM-policy role (the tests refuse `SELF_GRANT_FORBIDDEN_ROLES`).
  */
 export const INSTALL_JOB_ROLES = [
     "roles/iam.roleAdmin",