@caelo-cms/provisioning 0.11.2 → 0.11.4

package/src/upgrade/app-roll.ts

@@ -55,7 +55,7 @@ import {
   rollService,
   serviceRollArgs,
 } from "../stack-converge.js";
-import { describeAuditJobImage, setAuditJobImage } from "./audit-job-roll.js";
+import { adminImageJobs, describeJobImage, setJobImage } from "./admin-image-jobs.js";
 import { restoreCommand, type SqlBackup } from "./backup.js";
 import {
   describeServiceJson,
@@ -494,15 +494,15 @@ export async function executeAppRoll(
   }
 
   const rolled: RollPlan[] = [];
-  /** The audit job's image before this roll moved it (#875); null = not moved. */
-  let auditJobPriorImage: string | null = null;
+  /** Jobs this roll moved onto the admin's image (#875, #1217), with their prior image. */
+  const movedJobs: { readonly name: string; readonly label: string; readonly prior: string }[] = [];
   const rollBack = async (alsoCurrent?: RollPlan): Promise<void> => {
-    if (auditJobPriorImage) {
-      const back = await setAuditJobImage(run, install, auditJobPriorImage);
-      if (back.ok) r.info(`  audit job image restored to ${auditJobPriorImage.slice(-19)}`);
+    for (const j of movedJobs) {
+      const back = await setJobImage(run, install, j.name, j.prior);
+      if (back.ok) r.info(`  ${j.label} image restored to ${j.prior.slice(-19)}`);
       else
         r.error(
-          `  audit job rollback FAILED (${back.error}) — set its image to ${auditJobPriorImage} by hand`,
+          `  ${j.label} rollback FAILED (${back.error}) — set its image to ${j.prior} by hand`,
         );
     }
     const services = alsoCurrent ? [...rolled, alsoCurrent] : rolled;
@@ -589,31 +589,34 @@ export async function executeAppRoll(
     rolled.push(p);
   }
 
-  // #875 — the audit job runs the admin's image; it follows the admin. A
-  // failure here does not undo the release: audits then fail loudly with
-  // the version mismatch and the fix, until the next upgrade moves it.
-  const sAudit = r.step("Moving the quality-audit job onto the admin's image...");
-  const described = await describeAuditJobImage(run, install);
-  const auditPrior = described.ok ? described.image : null;
-  if (!described.ok) {
-    sAudit.warned(
-      `Could not read the quality-audit job (${described.error}); Stage audits fail until the next upgrade moves it.`,
-    );
-  } else if (!auditPrior) {
-    sAudit.warned(
-      "The install has no quality-audit job yet; Stage audits fail until `cms-provision upgrade` sets it up.",
-    );
-  } else if (auditPrior === admin.imageRef) {
-    sAudit.done("Quality-audit job already on the admin's image");
-  } else {
-    const moved = await setAuditJobImage(run, install, admin.imageRef);
-    if (moved.ok) {
-      auditJobPriorImage = auditPrior;
-      sAudit.done(`Quality-audit job on ${admin.digest.slice(0, 19)}...`);
-    } else {
-      sAudit.warned(
-        `Quality-audit job not moved (${moved.error}); Stage audits fail until the next upgrade moves it.`,
+  // #875 / #1217 — the audit and capture jobs run the admin's image; they
+  // follow the admin. A failure here does not undo the release: the job then
+  // refuses with the version mismatch and the fix, until the next upgrade
+  // moves it.
+  for (const job of adminImageJobs(install.env)) {
+    const sJob = r.step(`Moving the ${job.label} onto the admin's image...`);
+    const described = await describeJobImage(run, install, job.name);
+    const prior = described.ok ? described.image : null;
+    if (!described.ok) {
+      sJob.warned(
+        `Could not read the ${job.label} (${described.error}); ${job.lagging} until the next upgrade moves it.`,
       );
+    } else if (!prior) {
+      sJob.warned(
+        `The install has no ${job.label} yet; ${job.lagging} until \`cms-provision upgrade\` sets it up.`,
+      );
+    } else if (prior === admin.imageRef) {
+      sJob.done(`The ${job.label} is already on the admin's image`);
+    } else {
+      const moved = await setJobImage(run, install, job.name, admin.imageRef);
+      if (moved.ok) {
+        movedJobs.push({ name: job.name, label: job.label, prior });
+        sJob.done(`The ${job.label} is on ${admin.digest.slice(0, 19)}...`);
+      } else {
+        sJob.warned(
+          `The ${job.label} was not moved (${moved.error}); ${job.lagging} until the next upgrade moves it.`,
+        );
+      }
     }
   }
 

package/src/upgrade/converge.ts

@@ -29,6 +29,7 @@
  */
 
 import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
+import { ensureCaptureJob } from "../capture-job-setup.js";
 import { ensureConvergeJob } from "../converge-job-setup.js";
 import { findSqlInstance, planPublicRoleSwitch } from "../gateway-credentials.js";
 import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
@@ -49,6 +50,8 @@ import { selfCommand } from "../self-command.js";
 import {
   AUDIT_JOB_ENV_VAR,
   AUDIT_RESULTS_BUCKET_ENV_VAR,
+  CAPTURE_BUCKET_ENV_VAR,
+  CAPTURE_JOB_ENV_VAR,
   type CloudRunEnvVar,
   CONVERGE_JOB_ENV_VAR,
   MCP_ENV_VAR,
@@ -331,6 +334,42 @@ export function startConverge(
     leaveUntouched.push(AUDIT_JOB_ENV_VAR, AUDIT_RESULTS_BUCKET_ENV_VAR);
   }
 
+  async function captureJob(): Promise<void> {
+    // #1217 — the job every server-side browser render runs in, so no
+    // Chromium runs in the admin. Deployed with the admin's CURRENT image
+    // (the app-roll then moves both together; the job refuses an order from
+    // another version). A failure only costs server-side screenshots, so it
+    // warns and the admin keeps its current env.
+    const s = r.step("Ensuring the capture job (server-side screenshots outside the admin)...");
+    const image = await resolveAdminImage(
+      { projectId: install.projectId, region: install.region, env: install.env },
+      { run },
+    );
+    const cj = image.ok
+      ? await ensureCaptureJob(
+          {
+            provider: install.provider,
+            projectId: install.projectId,
+            region: install.region,
+            env: install.env,
+            adminImageRef: image.imageRef,
+          },
+          runDeps,
+        )
+      : { ok: false as const, done: [], error: image.error };
+    for (const step of cj.done) r.info(`  ${step}`);
+    if (cj.ok) {
+      s.done("Capture job ready (screenshots run outside the admin)");
+      return;
+    }
+    s.warned(`Capture job not set up: ${cj.error}`);
+    r.warn(
+      "The upgrade continues; server-side screenshots fail with the missing job until this succeeds. Re-run upgrade once the cause is fixed.",
+    );
+    incomplete = true;
+    leaveUntouched.push(CAPTURE_JOB_ENV_VAR, CAPTURE_BUCKET_ENV_VAR);
+  }
+
   async function remoteMcpEdge(): Promise<void> {
     // #806 — on `gcp` the load balancer routes the remote-MCP discovery
     // paths to the gateway and Cloud Armor lets agent traffic through on
@@ -592,6 +631,7 @@ export function startConverge(
       await mcpAccess();
       await urlMapRedirectsAccess();
       await auditJob();
+      await captureJob();
       await remoteMcpEdge();
       return true;
     },

package/src/upgrade/upgrade.test.ts

@@ -112,7 +112,7 @@ function fakeInstall(events: string[], overrides: [RegExp, Answer][] = []) {
     [new RegExp(`describe ${GATEWAY} .*--format=json`), ok(GATEWAY_JSON)],
     [/describe (\S+) .*status\.url/, (l) => ok(`https://${l.split(" ")[3]}-xyz.a.run.app\n`)],
     [
-      /^run jobs describe caelo-production-audit .*containers\[0\]\.image/,
+      /^run jobs describe caelo-production-(audit|capture) .*containers\[0\]\.image/,
       ok(`${OLD_ADMIN_IMAGE}\n`),
     ],
     [/^sql instances list/, ok(`${SQL}\n`)],
@@ -242,7 +242,7 @@ const CONVERGE_WRITE =
   /add-iam-policy-binding|remove-iam-policy-binding|set-iam-policy|service-accounts create|secrets create|secrets versions add|services enable|roles create|roles update|roles undelete|firewall-rules delete|users assign-roles/;
 /** Calls that move a service or run migrations — app-roll-only. */
 const APP_ROLL_WRITE =
-  /^run services update |^run services update-traffic|jobs execute caelo-migrate|^run jobs update caelo-production-audit /;
+  /^run services update |^run services update-traffic|jobs execute caelo-migrate|^run jobs update caelo-production-(audit|capture) /;
 /** Any gcloud call that changes something. */
 const ANY_WRITE =
   /\b(create|update|update-traffic|delete|add-iam-policy-binding|remove-iam-policy-binding|set-iam-policy|execute|enable|add|restore)\b/;
@@ -331,6 +331,39 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     ).toBe(false);
   });
 
+  it("sets up the capture job on the CURRENT admin image before the roll, then moves it with the admin (#1217)", async () => {
+    const events: string[] = [];
+    const { deps, lines } = upgradeDeps(events);
+    expect(await upgradeGcpInstall(TARGET, deps)).toBe(true);
+    const deploy = indexOf(events, /^gcloud run jobs deploy caelo-production-capture /);
+    const adminRoll = indexOf(events, new RegExp(`^gcloud run services update ${ADMIN} `));
+    const move = indexOf(events, /^gcloud run jobs update caelo-production-capture /);
+    const deep = indexOf(events, /^health deep/);
+    expect(events[deploy]).toContain(`--image=${OLD_ADMIN_IMAGE}`);
+    expect(deploy < adminRoll && adminRoll < move && move < deep).toBe(true);
+    expect(events[move]).toContain(`--image=${IMAGES.admin.imageRef}`);
+    expect(events[adminRoll]).toContain(
+      "CAELO_CAPTURE_JOB=projects/acme/locations/europe-west1/jobs/caelo-production-capture",
+    );
+    expect(lines).toContain("done: Capture job ready (screenshots run outside the admin)");
+  });
+
+  it("a failed capture-job setup leaves the converge incomplete and the admin's capture env untouched", async () => {
+    const events: string[] = [];
+    const { deps, recorded, lines } = upgradeDeps(events, {
+      overrides: [[/^run jobs deploy caelo-production-capture/, fail("PERMISSION_DENIED")]],
+    });
+    expect(await upgradeGcpInstall(TARGET, deps)).toBe(true);
+    expect(recorded.contract).toEqual([]);
+    expect(lines.some((l) => l.includes("Capture job not set up"))).toBe(true);
+    expect(
+      events.some((e) => /services update caelo-production-admin.*CAELO_CAPTURE_JOB=/.test(e)),
+    ).toBe(false);
+    expect(
+      events.some((e) => /services update caelo-production-admin.*CAELO_CAPTURE_BUCKET=/.test(e)),
+    ).toBe(false);
+  });
+
   it("an unreadable audit job is reported as an error, not as a missing job, and is not moved", async () => {
     const events: string[] = [];
     const { deps, lines } = upgradeDeps(events, {
@@ -465,6 +498,11 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
       .slice(deep)
       .filter((e) => e.startsWith("gcloud run jobs update caelo-production-audit "));
     expect(jobBack).toEqual([expect.stringContaining(`--image=${OLD_ADMIN_IMAGE}`)]);
+    // ... and so does the capture job (#1217).
+    const captureBack = events
+      .slice(deep)
+      .filter((e) => e.startsWith("gcloud run jobs update caelo-production-capture "));
+    expect(captureBack).toEqual([expect.stringContaining(`--image=${OLD_ADMIN_IMAGE}`)]);
     expect(recorded.digests).toEqual([]);
     expect(recorded.contract).toEqual([]);
     const restore = `gcloud sql backups restore ${BACKUP_ID} --restore-instance=${SQL} --project=acme`;

package/src/upgrader-iam-preflight.test.ts

@@ -85,6 +85,10 @@ function setupGrants(): Map<string, Set<string>> {
       `projects/${p}/serviceAccounts/caelo-production-audit@${p}.iam.gserviceaccount.com`,
       of("roles/iam.serviceAccountUser"),
     ],
+    [
+      `projects/${p}/serviceAccounts/caelo-production-capture@${p}.iam.gserviceaccount.com`,
+      of("roles/iam.serviceAccountUser"),
+    ],
     // The project-level caeloUpgraderRun reaches the job too.
     [`projects/${p}/locations/europe-west1/jobs/caelo-production-upgrader`, project],
     [`gs://${p}-caelo-ops`, bucketList],
@@ -133,6 +137,23 @@ describe("upgraderAccessChecks", () => {
     );
   });
 
+  it("#1217: the capture job's account is checked too, since every app-roll moves that job", async () => {
+    const grants = setupGrants();
+    grants.delete(
+      "projects/acme/serviceAccounts/caelo-production-capture@acme.iam.gserviceaccount.com",
+    );
+    const r = await runIamPreflight(upgraderAccessChecks(TARGET), tester(grants));
+    expect(r.kind).toBe("missing");
+    if (r.kind !== "missing") return;
+    expect(r.missing.map((m) => [resourceName(m.check.resource), m.missing])).toEqual([
+      [
+        "projects/acme/serviceAccounts/caelo-production-capture@acme.iam.gserviceaccount.com",
+        ["iam.serviceAccounts.actAs"],
+      ],
+    ]);
+    expect(preflightMissingReason(r.missing, UPGRADER_PREFLIGHT_VOICE)).toContain("capture job");
+  });
+
   it("never needs a permission only a forbidden role would give (no compute, no IAM admin)", () => {
     const all = upgraderAccessChecks(TARGET).flatMap((c) => c.permissions);
     for (const p of all) {

package/src/upgrader-iam-preflight.ts

@@ -52,6 +52,7 @@
 import { z } from "zod";
 import {
   auditServiceAccountEmail,
+  captureServiceAccountEmail,
   gatewayServiceAccountEmail,
   mcpIapServiceAccountEmail,
   runServiceAccountEmail,
@@ -187,7 +188,7 @@ export function upgraderAccessChecks(target: {
     },
     {
       // #875 — every app-roll moves the audit job onto the new admin image
-      // (upgrade/audit-job-roll.ts), and upgrader-setup.ts grants actAs on
+      // (upgrade/admin-image-jobs.ts), and upgrader-setup.ts grants actAs on
       // the job's account for exactly that.
       need: "move the quality-audit job onto the new admin image",
       resource: project,
@@ -198,6 +199,12 @@ export function upgraderAccessChecks(target: {
       resource: sa(auditServiceAccountEmail(projectId, env)),
       permissions: ["iam.serviceAccounts.actAs"],
     },
+    {
+      // #1217 — the capture job follows the admin's image the same way.
+      need: "run the capture job as its service account after moving it",
+      resource: sa(captureServiceAccountEmail(projectId, env)),
+      permissions: ["iam.serviceAccounts.actAs"],
+    },
     {
       need: "keep the upgrader job running as its own service account after it updates itself",
       resource: sa(upgraderServiceAccountEmail(projectId, env)),

package/src/upgrader-job.test.ts

@@ -427,6 +427,7 @@ describe("runUpgraderJob", () => {
         "iam projects/acme/locations/europe-west1/jobs/caelo-production-upgrader",
         "iam projects/acme/serviceAccounts/caelo-mcp@acme.iam.gserviceaccount.com",
         "iam projects/acme/serviceAccounts/caelo-production-audit@acme.iam.gserviceaccount.com",
+        "iam projects/acme/serviceAccounts/caelo-production-capture@acme.iam.gserviceaccount.com",
         "iam projects/acme/serviceAccounts/caelo-production-gateway-sa@acme.iam.gserviceaccount.com",
         "iam projects/acme/serviceAccounts/caelo-production-run-sa@acme.iam.gserviceaccount.com",
         "iam projects/acme/serviceAccounts/caelo-production-upgrader@acme.iam.gserviceaccount.com",

package/src/upgrader-setup.test.ts

@@ -84,6 +84,7 @@ describe("ensureUpgraderJob", () => {
         "iam service-accounts add-iam-policy-binding caelo-production-upgrader@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-mcp@acme.iam.gserviceaccount.com → roles/iam.serviceAccountTokenCreator",
         "iam service-accounts add-iam-policy-binding caelo-production-audit@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
+        "iam service-accounts add-iam-policy-binding caelo-production-capture@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "storage buckets add-iam-policy-binding gs://acme-caelo-ops → roles/storage.objectUser",
         "storage buckets add-iam-policy-binding gs://acme-caelo-ops → projects/acme/roles/caeloUpgraderOpsList",
       ].sort(),

package/src/upgrader-setup.ts

@@ -32,8 +32,9 @@
  *     setup is removed.
  *   - `roles/iam.serviceAccountUser` on exactly the admin's and the
  *     gateway's runtime service accounts (a revision runs as them), on
- *     itself (its own job) and on the quality-audit job's account (the
- *     app-roll moves that job's image, #875) — not on the project.
+ *     itself (its own job) and on the quality-audit and capture jobs'
+ *     accounts (the app-roll moves those jobs' images, #875, #1217) — not
+ *     on the project.
  *   - the custom role `caeloUpgraderSqlBackup`: create/read Cloud SQL
  *     backups and read the instance — no restore, no instance changes.
  *   - `roles/cloudsql.instanceUser` + a Cloud SQL IAM database user that
@@ -76,6 +77,7 @@ import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
 import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
 import {
   auditServiceAccountEmail,
+  captureServiceAccountEmail,
   gatewayServiceAccountEmail,
   mcpIapServiceAccountEmail,
   runServiceAccountEmail,
@@ -371,6 +373,11 @@ export async function ensureUpgraderJob(
       role: "roles/iam.serviceAccountUser",
       why: "the app-roll moves the quality-audit job, which runs as it, onto the new image",
     },
+    {
+      account: captureServiceAccountEmail(projectId, env),
+      role: "roles/iam.serviceAccountUser",
+      why: "the app-roll moves the capture job, which runs as it, onto the new image",
+    },
     {
       account: mcpIapServiceAccountEmail(projectId),
       role: "roles/iam.serviceAccountTokenCreator",

package/src/wizards/gcp-cost.ts

@@ -109,6 +109,12 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
       notes:
         "one container per Lighthouse run, all in parallel (up to 5 pages x 3 runs, ~90 s at 2 vCPU each): ~$0.05 per audited Stage, partly in the free tier; results bucket ~$0",
     },
+    {
+      name: "Screenshots (Cloud Run capture job)",
+      monthlyUsd: 1,
+      notes:
+        "one short container per server-side screenshot or page render (~20-40 s at 1 vCPU / 2 GiB): ~$0.001 each, a 50-page site import ~$0.05; mostly in the free tier; capture bucket ~$0",
+    },
     {
       name: "Cloud Run gateway",
       monthlyUsd: inputs.gatewayMinInstances === 0 ? 1 : 1 + inputs.gatewayMinInstances * 15,

package/src/wizards/gcp.ts

@@ -35,6 +35,7 @@ import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { checkAdcImpersonation } from "../adc-impersonation.js";
 import { type AdoptionCandidate, AdoptionError, formatAdopted } from "../adopt-existing.js";
 import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
+import { ensureCaptureJob } from "../capture-job-setup.js";
 import { CERT_WAIT_TIMEOUT_MS, lbCertProbe, waitForCert } from "../cert-wait.js";
 import { redactCredentials } from "../checkpoint-secrets.js";
 import { ensureConvergeJob } from "../converge-job-setup.js";
@@ -507,6 +508,10 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // Before the upgrader, which gets actAs on the job's service account.
   await stepAuditJob(projectId, region, provider);
 
+  // === 11.35. The capture job: server-side screenshots outside the admin (#1217) ===
+  // Before the upgrader as well, which gets actAs on its service account.
+  await stepCaptureJob(projectId, region, provider);
+
   // === 11.4. The upgrader job: Settings → Updates → Install update (#696) ===
   // Before operator access, which keeps the upgrader's caelo-mcp grant.
   const releaseVersion = await releaseVersionForDigest(gcloud, "admin", imageDigests.admin);
@@ -1149,6 +1154,37 @@ async function stepAuditJob(
   s.stop(green(`Quality-audit job ready (${r.done.length} steps)`));
 }
 
+/**
+ * Set up the capture job (capture-job-setup.ts) on the deployed admin's
+ * image. A failure stops the wizard: without the job every server-side
+ * screenshot fails. Idempotent, so it runs on every wizard pass.
+ */
+async function stepCaptureJob(
+  projectId: string,
+  region: string,
+  provider: "gcp" | "gcp-firebase",
+): Promise<void> {
+  const s = spinner();
+  s.start("Setting up the capture job (server-side screenshots outside the admin)...");
+  const image = await resolveAdminImage({ projectId, region, env: GCP_STACK_ENV });
+  const r = image.ok
+    ? await ensureCaptureJob({
+        provider,
+        projectId,
+        region,
+        env: GCP_STACK_ENV,
+        adminImageRef: image.imageRef,
+      })
+    : { ok: false as const, done: [], error: image.error };
+  if (!r.ok) {
+    s.stop(red(`Failed: ${r.error}`));
+    log.error("Re-run the wizard once the cause is fixed (this step is idempotent).");
+    cancel("Aborted.");
+    process.exit(1);
+  }
+  s.stop(green(`Capture job ready (${r.done.length} steps)`));
+}
+
 /**
  * Whether an upgrader set up by an earlier run exists, so a failed setup
  * this time still keeps its caelo-mcp signing grant (the operator-access

package/stacks/aws/index.ts

@@ -398,6 +398,15 @@ new aws.cloudwatch.LogDelivery(
 // (quality/lighthouse-runner-select.ts) instead of measuring on its own
 // shared CPU. Nothing is staged on AWS before #749 either.
 //
+// FIXME(issue #749): no capture task definition yet. On GCP every
+// server-side browser render (screenshots, external page renders, the
+// site-import crawl) runs in its own short-lived container (#1217,
+// src/capture-job-setup.ts) so the admin never starts Chromium; the AWS
+// equivalent is a Fargate task per render behind admin-core
+// capture/capture-client.ts `CaptureLauncher`. Until it exists the admin
+// refuses every server-side render with that gap
+// (capture/capture-backend.ts) instead of running a browser in its own task.
+//
 // FIXME(issue #696): no in-cloud upgrader or converge job (#819) yet. On
 // GCP Settings → Updates hands app-roll releases to the upgrader job and
 // cloud-setup releases to the converge job; on AWS the admin refuses a

package/stacks/azure/index.ts

@@ -361,6 +361,15 @@ const logWorkspace = new azure.operationalinsights.Workspace(`${namePrefix}-logs
 // instead of measuring on its own shared CPU. Nothing is staged on Azure
 // before #750 either.
 //
+// FIXME(issue #750): no capture Container Apps job yet. On GCP every
+// server-side browser render (screenshots, external page renders, the
+// site-import crawl) runs in its own short-lived container (#1217,
+// src/capture-job-setup.ts) so the admin never starts Chromium; the Azure
+// equivalent is a Container Apps job execution per render behind admin-core
+// capture/capture-client.ts `CaptureLauncher`. Until it exists the admin
+// refuses every server-side render with that gap
+// (capture/capture-backend.ts) instead of running a browser in its own app.
+//
 // FIXME(issue #696): no in-cloud upgrader or converge job (#819) yet. On
 // GCP Settings → Updates hands app-roll releases to the upgrader job and
 // cloud-setup releases to the converge job; on Azure the admin refuses a

package/stacks/gcp/index.ts

@@ -1057,6 +1057,19 @@ new gcp.iap.WebBackendServiceIamMember(
 // bucket or job both this program and `upgrade` created would collide on
 // the next wizard run. The app-roll moves the job's image with the admin's.
 
+// =========================================================================
+// Capture job — deliberately NOT here
+// =========================================================================
+//
+// #1217 — every server-side browser render (screenshots, rendered HTML of
+// external pages, the site-import crawl) runs in a short-lived Cloud Run job,
+// one execution per render, so no Chromium runs in the admin. Its service
+// account may only create results under `out/` of the capture bucket; it
+// reads its input and a preview's media through URLs the admin signs per
+// capture. The CLI owns the job, its account, the bucket and the grants
+// (packages/provisioning/src/capture-job-setup.ts), for the same reason as
+// the audit job above.
+
 // =========================================================================
 // Operator access — deliberately NOT here
 // =========================================================================

package/stacks/gcp-firebase/index.ts

@@ -964,6 +964,19 @@ new gcp.iap.WebCloudRunServiceIamMember(
 // bucket or job both this program and `upgrade` created would collide on
 // the next wizard run. The app-roll moves the job's image with the admin's.
 
+// =========================================================================
+// Capture job — deliberately NOT here
+// =========================================================================
+//
+// #1217 — every server-side browser render (screenshots, rendered HTML of
+// external pages, the site-import crawl) runs in a short-lived Cloud Run job,
+// one execution per render, so no Chromium runs in the admin. Its service
+// account may only create results under `out/` of the capture bucket; it
+// reads its input and a preview's media through URLs the admin signs per
+// capture. The CLI owns the job, its account, the bucket and the grants
+// (packages/provisioning/src/capture-job-setup.ts), for the same reason as
+// the audit job above.
+
 // =========================================================================
 // Operator access — deliberately NOT here
 // =========================================================================

package/dist/upgrade/audit-job-roll.d.ts

@@ -1,38 +0,0 @@
-/**
- * #875 — the quality-audit job runs the admin image (admin-core
- * quality/audit-task.ts) and refuses a batch from an admin on another
- * version. So every app-roll moves the job onto the admin's new image right
- * after the services rolled, and a rollback moves it back.
- *
- * `run jobs update --image` changes nothing else of the job (identity, env,
- * parallelism), so this stays inside the app-roll's rights: the upgrader's
- * `roles/run.developer` plus actAs on the job's service account
- * (upgrader-setup.ts).
- */
-import type { GcloudRunner } from "../gcloud-retry.js";
-/**
- * The job's image now; `image: null` only when the install has no audit job
- * yet. Any other gcloud failure (permissions, API, network) is an error, not
- * "no job", so the app-roll reports it instead of a misleading hint.
- */
-export declare function describeAuditJobImage(run: GcloudRunner, install: {
-    readonly projectId: string;
-    readonly region: string;
-    readonly env: string;
-}): Promise<{
-    readonly ok: true;
-    readonly image: string | null;
-} | {
-    readonly ok: false;
-    readonly error: string;
-}>;
-/** Point the audit job at `imageRef`. */
-export declare function setAuditJobImage(run: GcloudRunner, install: {
-    readonly projectId: string;
-    readonly region: string;
-    readonly env: string;
-}, imageRef: string): Promise<{
-    readonly ok: boolean;
-    readonly error?: string;
-}>;
-//# sourceMappingURL=audit-job-roll.d.ts.map

package/dist/upgrade/audit-job-roll.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-job-roll.d.ts","sourceRoot":"","sources":["../../src/upgrade/audit-job-roll.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrF,OAAO,CACN;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CACjD,CAsBA;AAED,yCAAyC;AACzC,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACtF,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAY5D"}

package/dist/upgrade/audit-job-roll.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-job-roll.js","sourceRoot":"","sources":["../../src/upgrade/audit-job-roll.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAiB,EACjB,OAAsF;IAKtF,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,MAAM;QACN,UAAU;QACV,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;QACzB,YAAY,OAAO,CAAC,MAAM,EAAE;QAC5B,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,sEAAsE;KACvE,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,wEAAwE;QACxE,0CAA0C;QAC1C,OAAO,qDAAqD,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YACzE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;YAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAiB,EACjB,OAAsF,EACtF,QAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC;QACzB,WAAW,QAAQ,EAAE;QACrB,YAAY,OAAO,CAAC,MAAM,EAAE;QAC5B,aAAa,OAAO,CAAC,SAAS,EAAE;QAChC,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC"}