@caelo-cms/provisioning 0.11.3 → 0.11.4

package/dist/agent-db.js

@@ -6698,7 +6698,8 @@ var SYSTEM_SOURCE_NAMES = [
   "children",
   "siblings",
   "page_terms",
-  "term_pages"
+  "term_pages",
+  "pagination"
 ];
 var queryOrderSchema = union([
   _enum(["published_desc", "published_asc", "title_asc"]),
@@ -6768,6 +6769,13 @@ var listItemInputSchema = lazy(() => object({
   query: record(string2(), unknown()).optional()
 }).strict());
 
+// ../shared/src/lists/pagination.ts
+var PAGINATION_FOLLOW_UPS = ["index", "noindex"];
+var listPaginationSchema = object({
+  per_page: number2().int().min(1).max(LIST_QUERY_MAX_LIMIT).optional(),
+  follow_ups: _enum(PAGINATION_FOLLOW_UPS).optional()
+}).strict();
+
 // ../shared/src/lists/refs.ts
 var LIST_REF_RE = /^caelo:list\/([0-9a-f-]{36})$/;
 
@@ -6872,6 +6880,7 @@ var moduleFieldListSchema = object({
   bind: _enum(["local", "shared", "source"]).optional(),
   list: string2().regex(LIST_REF_RE, "list must be caelo:list/<id>").optional(),
   source: sourceDefSchema.optional(),
+  paginate: listPaginationSchema.optional(),
   min: number2().int().nonnegative().optional(),
   max: number2().int().positive().max(LIST_MAX_ITEMS).optional(),
   default: union([
@@ -6908,8 +6917,26 @@ function listFieldIssues(f) {
   if (f.min !== undefined && f.max !== undefined && f.min > f.max) {
     issues.push(`list field "${f.name}": min is greater than max.`);
   }
+  if (f.paginate !== undefined)
+    issues.push(...paginateIssues(f));
   return issues;
 }
+function paginateIssues(f) {
+  const where = `list field "${f.name}"`;
+  const src = f.source;
+  const pageable = (f.bind ?? "local") === "source" && (src?.kind === "query" || src?.kind === "system" && src.name === "term_pages");
+  if (!pageable) {
+    return [
+      `${where}: paginate needs bind "source" with a query or the term_pages source \u2014 an overview of pages. Remove paginate, or bind the field to {kind:"query", \u2026}.`
+    ];
+  }
+  if (src?.kind === "query" && (src.defaults.limit !== undefined || src.editable.includes("limit"))) {
+    return [
+      `${where}: a paginated query takes its page size from paginate.per_page \u2014 remove "limit" from source.defaults and source.editable.`
+    ];
+  }
+  return [];
+}
 var moduleFieldSchema = discriminatedUnion("kind", [
   moduleFieldPrimitiveSchema,
   moduleFieldListSchema,
@@ -6959,6 +6986,13 @@ var moduleFieldsArray = array(moduleFieldSchema).max(64, "modules may declare at
       }
     }
   }
+  const paginated = arr.filter((f) => f.kind === "list" && f.paginate !== undefined);
+  if (paginated.length > 1) {
+    ctx.addIssue({
+      code: ZodIssueCode.custom,
+      message: `only one paginated list field per module (${paginated.map((f) => `"${f.name}"`).join(", ")}) \u2014 a page has one page sequence. Keep paginate on the overview's main list; give the others a limit.`
+    });
+  }
   for (const run of findNumberedScalarFanoutRuns(arr)) {
     ctx.addIssue({
       code: ZodIssueCode.custom,
@@ -18744,42 +18778,17 @@ async function provisionPluginSchemaInTx(tx, caller, opts) {
 // ../query-api/src/pool-guard.ts
 import { AsyncLocalStorage } from "async_hooks";
 var POOL_ACQUIRE_TIMEOUT_MS = 1e4;
-var ALLOWLIST = [
-  { holder: "deploy.promote", issue: 1225, nestedCheckouts: true, noSessionTimeouts: true },
-  {
-    holder: "quality_audits.publish_anyway",
-    issue: 1225,
-    nestedCheckouts: true,
-    noSessionTimeouts: true
-  },
-  {
-    holder: "quality_audits.execute_proposal",
-    issue: 1225,
-    nestedCheckouts: true,
-    noSessionTimeouts: true
-  },
-  {
-    holder: "deploy.execute_proposal",
-    issue: 1225,
-    nestedCheckouts: true,
-    noSessionTimeouts: true
-  },
-  {
-    holder: "deploy.build_plugin_data",
-    issue: 1220,
-    nestedCheckouts: true,
-    noSessionTimeouts: true
-  },
+var NESTED_CHECKOUTS = [
+  { holder: "plugins.render_hook", issue: 1220 }
+];
+var LONG_TRANSACTIONS = [
   {
-    holder: "plugins.activation_lock",
-    issue: 1220,
-    nestedCheckouts: true,
-    noSessionTimeouts: false
-  },
-  { holder: "static-generator.build", issue: 1220, nestedCheckouts: true, noSessionTimeouts: true },
-  { holder: "plugins.render_hook", issue: 1220, nestedCheckouts: true, noSessionTimeouts: false }
+    holder: "static-generator.build",
+    reason: "a static site build runs in one transaction for as long as the build takes, idle while plugins render and files are written."
+  }
 ];
-var NESTED_CHECKOUT_ALLOWLIST = new Map(ALLOWLIST.map((entry) => [entry.holder, entry]));
+var NESTED_CHECKOUT_ALLOWLIST = new Map(NESTED_CHECKOUTS.map((entry) => [entry.holder, entry]));
+var LONG_TRANSACTION_ALLOWLIST = new Map(LONG_TRANSACTIONS.map((entry) => [entry.holder, entry]));
 
 class NestedPoolCheckoutError extends Error {
   pool;
@@ -18820,7 +18829,7 @@ class PoolGuard {
     const outer = this.#stores[pool].getStore();
     if (outer === undefined || !outer.active)
       return null;
-    const allowedBy = outer.allowedBy ?? (NESTED_CHECKOUT_ALLOWLIST.get(outer.holder)?.nestedCheckouts ? outer.holder : null) ?? allowances.getStore() ?? null;
+    const allowedBy = outer.allowedBy ?? (NESTED_CHECKOUT_ALLOWLIST.has(outer.holder) ? outer.holder : null) ?? allowances.getStore() ?? null;
     if (allowedBy === null)
       throw new NestedPoolCheckoutError(pool, outer.holder, requester);
     return allowedBy;
@@ -18834,7 +18843,7 @@ class PoolGuard {
   }
 }
 function exemptFromSessionTimeouts(holder) {
-  return NESTED_CHECKOUT_ALLOWLIST.get(holder)?.noSessionTimeouts === true;
+  return LONG_TRANSACTION_ALLOWLIST.has(holder);
 }
 async function liftSessionTimeouts(tx) {
   await tx.execute(sql`SELECT set_config('statement_timeout', '0', true)`);

package/dist/audit-job-setup.js

@@ -47,7 +47,7 @@ import { gcloud as defaultGcloud } from "./gcloud.js";
 import { realSleep, runWithRetry } from "./gcloud-retry.js";
 import { auditJobName, auditServiceAccountEmail, auditServiceAccountId, gcpBucketName, runServiceAccountEmail, } from "./gcp-names.js";
 import { readAdminConfig } from "./migration-runner.js";
-import { describeAuditJobImage } from "./upgrade/audit-job-roll.js";
+import { describeJobImage } from "./upgrade/admin-image-jobs.js";
 /** Where the admin image ships the task's entry point. */
 export const AUDIT_TASK_SCRIPT = "/app/packages/admin-core/src/quality/audit-task.ts";
 /** How many audit tasks run at once by default: 5 pages x 3 runs. */
@@ -242,7 +242,7 @@ export async function ensureAuditJob(target, deps = {}) {
     //    cap; an existing job keeps its own.
     let parallelism = target.parallelism;
     if (parallelism === undefined) {
-        const existing = await describeAuditJobImage(run, { projectId, region, env });
+        const existing = await describeJobImage(run, { projectId, region, env }, job);
         if (!existing.ok)
             return { ok: false, done, error: `read job ${job}: ${existing.error}` };
         if (existing.image === null)

package/dist/audit-job-setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-job-setup.js","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAAoD,CAAC;AAEtF,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa;IACb,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,wBAAwB;IACxB,qBAAqB;IACrB,2BAA2B;IAC3B,0BAA0B;CAClB,CAAC;AAEX,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;CAC9D,CAAC;AAuBF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,QAAQ,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAkB,EAAE,CAAC,CAAC;QAC/D,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uDAAuD,MAAM,CAAC,aAAa,EAAE;SACrF,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,EAC5F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,6DAA6D,MAAM,CAAC,WAAW,EAAE;SACzF,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,qBAAqB,CAAC,GAAG,CAAC;YAC1B,oCAAoC;YACpC,iIAAiI;YACjI,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,+BAA+B,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC;SACE,IAAI,EAAE;SACN,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACtB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,cAAc,MAAM,EAAE;YACtB,kCAAkC;YAClC,+BAA+B;YAC/B,4BAA4B;YAC5B,0BAA0B;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI;gBACJ,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC/C,CAAC,CAAC,GAAG,UAAU,0CAA0C,SAAS,6DAA6D;oBAC/H,CAAC,CAAC,UAAU,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACzC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;YAC1B,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,oBAAoB,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,wBAAwB,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,UAAU,gCAAgC,CAAC,CAAC;IAEhE,uEAAuE;IACvE,8BAA8B;IAC9B,MAAM,YAAY,GAAoE;QACpF,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,qBAAqB,EAAE;QAC5F,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAE,CAAC,SAAS,EAAE,QAAQ,CAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxC,MAAM;gBACN,IAAI,EAAE,4BAA4B;gBAClC,GAAG,EAAE,+CAA+C;aACrD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QACP;YACE,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,4BAA4B;YAClC,GAAG,EAAE,6BAA6B;SACnC;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,SAAS;YACT,SAAS;YACT,wBAAwB;YACxB,QAAQ,CAAC,CAAC,MAAM,EAAE;YAClB,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,WAAW;IACX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;QACvB,UAAU;QACV,wBAAwB;QACxB,SAAS;QACT,YAAY,MAAM,EAAE;QACpB,gCAAgC;QAChC,kBAAkB;QAClB,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAE/D,qEAAqE;IACrE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1F,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;YAAE,WAAW,GAAG,yBAAyB,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG;QACd,kBAAkB,QAAQ,EAAE;QAC5B,8BAA8B,OAAO,EAAE;QACvC,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAC;gBACE,wBAAwB,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE;gBAClE,uBAAuB,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE;aACjE;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,GAAG;QACH,WAAW,MAAM,CAAC,aAAa,EAAE;QACjC,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,EAAE,EAAE;QACzB,eAAe;QACf,gBAAgB,iBAAiB,EAAE;QACnC,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,iBAAiB;QACjB,kBAAkB,YAAY,EAAE;QAChC,oEAAoE;QACpE,SAAS;QACT,cAAc;QACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAEjF,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,CAAC,qCAAqC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAmF,EACnF,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG;QACN,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mEAAmE;SAC3E,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"audit-job-setup.js","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAAoD,CAAC;AAEtF,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa;IACb,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,wBAAwB;IACxB,qBAAqB;IACrB,2BAA2B;IAC3B,0BAA0B;CAClB,CAAC;AAEX,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;CAC9D,CAAC;AAuBF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,QAAQ,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAkB,EAAE,CAAC,CAAC;QAC/D,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uDAAuD,MAAM,CAAC,aAAa,EAAE;SACrF,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,EAC5F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,6DAA6D,MAAM,CAAC,WAAW,EAAE;SACzF,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,qBAAqB,CAAC,GAAG,CAAC;YAC1B,oCAAoC;YACpC,iIAAiI;YACjI,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,+BAA+B,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC;SACE,IAAI,EAAE;SACN,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACtB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,cAAc,MAAM,EAAE;YACtB,kCAAkC;YAClC,+BAA+B;YAC/B,4BAA4B;YAC5B,0BAA0B;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI;gBACJ,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC/C,CAAC,CAAC,GAAG,UAAU,0CAA0C,SAAS,6DAA6D;oBAC/H,CAAC,CAAC,UAAU,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACzC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;YAC1B,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,oBAAoB,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,wBAAwB,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,UAAU,gCAAgC,CAAC,CAAC;IAEhE,uEAAuE;IACvE,8BAA8B;IAC9B,MAAM,YAAY,GAAoE;QACpF,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,qBAAqB,EAAE;QAC5F,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAE,CAAC,SAAS,EAAE,QAAQ,CAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxC,MAAM;gBACN,IAAI,EAAE,4BAA4B;gBAClC,GAAG,EAAE,+CAA+C;aACrD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QACP;YACE,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,4BAA4B;YAClC,GAAG,EAAE,6BAA6B;SACnC;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,SAAS;YACT,SAAS;YACT,wBAAwB;YACxB,QAAQ,CAAC,CAAC,MAAM,EAAE;YAClB,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,WAAW;IACX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;QACvB,UAAU;QACV,wBAAwB;QACxB,SAAS;QACT,YAAY,MAAM,EAAE;QACpB,gCAAgC;QAChC,kBAAkB;QAClB,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAE/D,qEAAqE;IACrE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1F,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;YAAE,WAAW,GAAG,yBAAyB,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG;QACd,kBAAkB,QAAQ,EAAE;QAC5B,8BAA8B,OAAO,EAAE;QACvC,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAC;gBACE,wBAAwB,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE;gBAClE,uBAAuB,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE;aACjE;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,GAAG;QACH,WAAW,MAAM,CAAC,aAAa,EAAE;QACjC,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,EAAE,EAAE;QACzB,eAAe;QACf,gBAAgB,iBAAiB,EAAE;QACnC,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,iBAAiB;QACjB,kBAAkB,YAAY,EAAE;QAChC,oEAAoE;QACpE,SAAS;QACT,cAAc;QACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAEjF,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,CAAC,qCAAqC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAmF,EACnF,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG;QACN,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mEAAmE;SAC3E,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC9C,CAAC"}

package/dist/capture-job-setup.d.ts

@@ -0,0 +1,46 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+import type { GcpProvider } from "./stack-contract.js";
+/** Where the admin image ships the task's entry point. */
+export declare const CAPTURE_TASK_SCRIPT = "/app/packages/admin-core/src/capture/capture-task.ts";
+/**
+ * Roles the capture job's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role). Unlike the audit job
+ * it reads nothing, so every storage read role is on the list too.
+ */
+export declare const CAPTURE_FORBIDDEN_ROLES: readonly ["roles/owner", "roles/editor", "roles/viewer", "roles/run.", "roles/iam.", "roles/iap.", "roles/secretmanager.", "roles/cloudsql.", "roles/compute.", "roles/resourcemanager.", "roles/storage.admin", "roles/storage.objectAdmin", "roles/storage.objectUser", "roles/storage.objectViewer", "roles/storage.legacy"];
+/** Inputs and results are deleted by the admin; the lifecycle catches leftovers. */
+export declare const CAPTURE_BUCKET_LIFECYCLE: {
+    rule: {
+        action: {
+            type: string;
+        };
+        condition: {
+            age: number;
+        };
+    }[];
+};
+/** The IAM condition that confines the job's create right to `out/`. */
+export declare function captureResultsCondition(bucket: string): string;
+export interface CaptureJobTarget {
+    readonly provider: GcpProvider;
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    /** The admin image the job runs, digest-pinned (`…/admin@sha256:…`). */
+    readonly adminImageRef: string;
+}
+export type CaptureJobResult = {
+    readonly ok: true;
+    readonly done: string[];
+} | {
+    readonly ok: false;
+    readonly done: string[];
+    readonly error: string;
+};
+/** Ensure the capture job and everything it needs. Never throws for a gcloud failure. */
+export declare function ensureCaptureJob(target: CaptureJobTarget, deps?: {
+    run?: GcloudRunner;
+    sleep?: Sleep;
+}): Promise<CaptureJobResult>;
+//# sourceMappingURL=capture-job-setup.d.ts.map

package/dist/capture-job-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-job-setup.d.ts","sourceRoot":"","sources":["../src/capture-job-setup.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAQ3F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,yDAAyD,CAAC;AAK1F;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,iUAgB1B,CAAC;AAEX,oFAAoF;AACpF,eAAO,MAAM,wBAAwB;;;;;;;;;CAEpC,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,yFAAyF;AACzF,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,gBAAgB,CAAC,CA8M3B"}

package/dist/capture-job-setup.js

@@ -0,0 +1,288 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #1217 — set up (and converge) the capture job on a Google Cloud install
+ * (`gcp`, `gcp-firebase`): the short-lived Cloud Run job that runs every
+ * server-side browser render (screenshot_page's server path, the external
+ * page tools, the site-import crawl), one execution per render. Run by the
+ * wizard after `pulumi up` and by `cms-provision upgrade`'s converge, both as
+ * the operator's own gcloud identity. App-roll moves the job's image with the
+ * admin's (upgrade/admin-image-jobs.ts), because the job runs the admin image
+ * (which bundles Chromium, #428).
+ *
+ * Why a separate job at all (CLAUDE.md §11.B Tier 5, second exception after
+ * the audit job): a headless Chromium costs 300–700 MB per render, and inside
+ * the 2 GiB admin it was the most plausible cause of the OOM kill of
+ * 2026-10-28 (#1209). In a job it costs the admin nothing.
+ *
+ * Why the CLI owns it and not the stacks: the same as audit-job-setup.ts —
+ * `upgrade` never runs Pulumi.
+ *
+ * Trust boundary. The job renders untrusted pages (third-party sites, module
+ * scripts in a preview), so its identity, `caelo-<env>-capture`, holds:
+ *
+ *   - `roles/storage.objectCreator` on the capture bucket, conditioned to the
+ *     `out/` prefix — create results only: it cannot read, overwrite or list
+ *     anything, nor write where the admin puts inputs;
+ *   - `roles/logging.logWriter`.
+ *
+ * Nothing else: no read right anywhere (its input and the preview's media
+ * arrive as V4 signed URLs the admin creates per capture, valid 5 minutes,
+ * deleted with the capture), no Secret Manager, no Cloud SQL, no VPC egress,
+ * and no IAP access to the admin — a browser exploit in the job reaches
+ * nothing but the internet it already renders.
+ *
+ * The admin's run SA may run the job WITH overrides (it passes the order),
+ * read its executions, use the capture bucket (`roles/storage.objectUser`:
+ * write inputs, read results, delete both) and sign URLs as itself
+ * (`roles/iam.serviceAccountTokenCreator` on its own account only: Cloud Run
+ * holds no key, so V4 signing goes through IAM signBlob; the admin can mint
+ * its own tokens through the metadata server already, so this widens
+ * nothing). {@link CAPTURE_FORBIDDEN_ROLES} names the job's line; the tests
+ * assert no grant crosses it.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { captureJobName, captureServiceAccountEmail, captureServiceAccountId, gcpBucketName, runServiceAccountEmail, } from "./gcp-names.js";
+/** Where the admin image ships the task's entry point. */
+export const CAPTURE_TASK_SCRIPT = "/app/packages/admin-core/src/capture/capture-task.ts";
+/** Per execution: container start, browser start and one render. */
+const TASK_TIMEOUT = "3m";
+/**
+ * Roles the capture job's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role). Unlike the audit job
+ * it reads nothing, so every storage read role is on the list too.
+ */
+export const CAPTURE_FORBIDDEN_ROLES = [
+    "roles/owner",
+    "roles/editor",
+    "roles/viewer",
+    "roles/run.",
+    "roles/iam.",
+    "roles/iap.",
+    "roles/secretmanager.",
+    "roles/cloudsql.",
+    "roles/compute.",
+    "roles/resourcemanager.",
+    "roles/storage.admin",
+    "roles/storage.objectAdmin",
+    "roles/storage.objectUser",
+    "roles/storage.objectViewer",
+    "roles/storage.legacy",
+];
+/** Inputs and results are deleted by the admin; the lifecycle catches leftovers. */
+export const CAPTURE_BUCKET_LIFECYCLE = {
+    rule: [{ action: { type: "Delete" }, condition: { age: 1 } }],
+};
+/** The IAM condition that confines the job's create right to `out/`. */
+export function captureResultsCondition(bucket) {
+    return `expression=resource.name.startsWith("projects/_/buckets/${bucket}/objects/out/"),title=capture-results-only,description=The capture job creates its results under out/ and nothing else`;
+}
+/** Ensure the capture job and everything it needs. Never throws for a gcloud failure. */
+export async function ensureCaptureJob(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const retry = (args) => runWithRetry(run, sleep, args);
+    const { projectId, region, env, provider } = target;
+    const project = `--project=${projectId}`;
+    const sa = captureServiceAccountEmail(projectId, env);
+    const member = `serviceAccount:${sa}`;
+    const runSa = runServiceAccountEmail(projectId, env);
+    const runSaMember = `serviceAccount:${runSa}`;
+    const job = captureJobName(env);
+    const bucket = gcpBucketName(projectId, env, "capture");
+    const bucketUrl = `gs://${bucket}`;
+    const done = [];
+    const fail = (step, r) => ({
+        ok: false,
+        done,
+        error: `${step}: ${r.stderr.trim()}`,
+    });
+    if (!/@sha256:[0-9a-f]{64}$/.test(target.adminImageRef)) {
+        return {
+            ok: false,
+            done,
+            error: `the capture job's image must be pinned by digest, got ${target.adminImageRef}`,
+        };
+    }
+    // 1. The job's own service account.
+    const describe = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        project,
+        "--format=value(email)",
+    ]);
+    if (!describe.ok) {
+        const create = await run([
+            "iam",
+            "service-accounts",
+            "create",
+            captureServiceAccountId(env),
+            "--display-name=Caelo capture",
+            "--description=Runs server-side browser renders (screenshots); creates capture results, nothing else.",
+            project,
+        ]);
+        if (!create.ok && !/already exists/i.test(create.stderr))
+            return fail(`create ${sa}`, create);
+    }
+    done.push(`service account ${sa}`);
+    // 2. The capture bucket: private, everything deleted after a day.
+    const owned = await run(["storage", "buckets", "list", project, "--format=value(name)"]);
+    if (!owned.ok)
+        return fail(`list the buckets of project ${projectId}`, owned);
+    const names = owned.stdout.split("\n").map((l) => l
+        .trim()
+        .replace(/^gs:\/\//, "")
+        .replace(/\/$/, ""));
+    if (!names.includes(bucket)) {
+        const created = await run([
+            "storage",
+            "buckets",
+            "create",
+            bucketUrl,
+            project,
+            `--location=${region}`,
+            "--default-storage-class=STANDARD",
+            "--uniform-bucket-level-access",
+            "--public-access-prevention",
+            "--soft-delete-duration=0",
+        ]);
+        if (!created.ok) {
+            return {
+                ok: false,
+                done,
+                error: /already exists|409/i.test(created.stderr)
+                    ? `${bucketUrl} exists but does not belong to project ${projectId}; delete or rename that bucket, this install needs the name`
+                    : `create ${bucketUrl}: ${created.stderr.trim()}`,
+            };
+        }
+    }
+    // A private directory (mkdtemp, mode 700): no other local user can swap
+    // the file between write and read.
+    const dir = mkdtempSync(join(tmpdir(), "caelo-capture-"));
+    try {
+        const file = join(dir, "lifecycle.json");
+        writeFileSync(file, JSON.stringify(CAPTURE_BUCKET_LIFECYCLE), { mode: 0o600 });
+        const lifecycle = await run([
+            "storage",
+            "buckets",
+            "update",
+            bucketUrl,
+            project,
+            `--lifecycle-file=${file}`,
+        ]);
+        if (!lifecycle.ok)
+            return fail(`set the lifecycle of ${bucketUrl}`, lifecycle);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    done.push(`bucket ${bucketUrl} (objects deleted after 1 day)`);
+    // 3. Bucket grants: the job creates results under out/; the admin writes
+    //    inputs, reads results and deletes both.
+    const bucketGrants = [
+        {
+            member,
+            role: "roles/storage.objectCreator",
+            condition: captureResultsCondition(bucket),
+            why: "the job writes its result under out/",
+        },
+        {
+            member: runSaMember,
+            role: "roles/storage.objectUser",
+            why: "the admin writes inputs, reads results and deletes both",
+        },
+    ];
+    for (const g of bucketGrants) {
+        const r = await retry([
+            "storage",
+            "buckets",
+            "add-iam-policy-binding",
+            bucketUrl,
+            `--member=${g.member}`,
+            `--role=${g.role}`,
+            ...(g.condition ? [`--condition=${g.condition}`] : []),
+            project,
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant ${g.role} on ${bucketUrl} (${g.why})`, r);
+        done.push(`${g.member === member ? "capture job" : "admin"}: ${g.role} on ${bucketUrl}${g.condition ? " (out/ only)" : ""}`);
+    }
+    // 4. Logs.
+    const logs = await retry([
+        "projects",
+        "add-iam-policy-binding",
+        projectId,
+        `--member=${member}`,
+        "--role=roles/logging.logWriter",
+        "--condition=None",
+        "--quiet",
+        "--format=none",
+    ]);
+    if (!logs.ok)
+        return fail("grant the capture job roles/logging.logWriter", logs);
+    done.push("capture job: roles/logging.logWriter on the project");
+    // 5. The admin signs the job's URLs as itself (IAM signBlob).
+    const signer = await retry([
+        "iam",
+        "service-accounts",
+        "add-iam-policy-binding",
+        runSa,
+        `--member=${runSaMember}`,
+        "--role=roles/iam.serviceAccountTokenCreator",
+        project,
+        "--quiet",
+        "--format=none",
+    ]);
+    if (!signer.ok)
+        return fail("let the admin sign URLs as itself", signer);
+    done.push(`admin: roles/iam.serviceAccountTokenCreator on ${runSa} (itself, signed URLs)`);
+    // 6. The job: the admin image, its own SA, no secrets, no VPC.
+    const deploy = await run([
+        "run",
+        "jobs",
+        "deploy",
+        job,
+        `--image=${target.adminImageRef}`,
+        `--region=${region}`,
+        project,
+        `--service-account=${sa}`,
+        "--command=bun",
+        `--args=--bun,${CAPTURE_TASK_SCRIPT}`,
+        `--set-env-vars=CAELO_PROVIDER=${provider},CAELO_CAPTURE_BUCKET=${bucket}`,
+        "--max-retries=0",
+        `--task-timeout=${TASK_TIMEOUT}`,
+        "--cpu=1",
+        "--memory=2Gi",
+        "--quiet",
+    ]);
+    if (!deploy.ok)
+        return fail(`deploy job ${job}`, deploy);
+    done.push(`job ${job} (${target.adminImageRef.split("@")[1]?.slice(0, 19)}...)`);
+    // 7. The admin may run it with its order and read its executions.
+    for (const role of ["roles/run.jobsExecutorWithOverrides", "roles/run.viewer"]) {
+        const r = await retry([
+            "run",
+            "jobs",
+            "add-iam-policy-binding",
+            job,
+            `--region=${region}`,
+            project,
+            `--member=${runSaMember}`,
+            `--role=${role}`,
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant the admin ${role} on ${job}`, r);
+        done.push(`admin: ${role} on ${job}`);
+    }
+    return { ok: true, done };
+}
+//# sourceMappingURL=capture-job-setup.js.map

package/dist/capture-job-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-job-setup.js","sourceRoot":"","sources":["../src/capture-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,uBAAuB,EACvB,aAAa,EACb,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,0DAA0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,sDAAsD,CAAC;AAE1F,oEAAoE;AACpE,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,aAAa;IACb,cAAc;IACd,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,wBAAwB;IACxB,qBAAqB;IACrB,2BAA2B;IAC3B,0BAA0B;IAC1B,4BAA4B;IAC5B,sBAAsB;CACd,CAAC;AAEX,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;CAC9D,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,2DAA2D,MAAM,wHAAwH,CAAC;AACnM,CAAC;AAgBD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAwB,EACxB,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,0BAA0B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,kBAAkB,KAAK,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,QAAQ,MAAM,EAAE,CAAC;IACnC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAoB,EAAE,CAAC,CAAC;QACjE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,yDAAyD,MAAM,CAAC,aAAa,EAAE;SACvF,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,uBAAuB,CAAC,GAAG,CAAC;YAC5B,8BAA8B;YAC9B,sGAAsG;YACtG,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,kEAAkE;IAClE,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,+BAA+B,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC;SACE,IAAI,EAAE;SACN,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACtB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,SAAS;YACT,SAAS;YACT,QAAQ;YACR,SAAS;YACT,OAAO;YACP,cAAc,MAAM,EAAE;YACtB,kCAAkC;YAClC,+BAA+B;YAC/B,4BAA4B;YAC5B,0BAA0B;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI;gBACJ,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC/C,CAAC,CAAC,GAAG,SAAS,0CAA0C,SAAS,6DAA6D;oBAC9H,CAAC,CAAC,UAAU,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACpD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACzC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;YAC1B,SAAS;YACT,SAAS;YACT,QAAQ;YACR,SAAS;YACT,OAAO;YACP,oBAAoB,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,wBAAwB,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;IACjF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,SAAS,gCAAgC,CAAC,CAAC;IAE/D,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM,YAAY,GAAwE;QACxF;YACE,MAAM;YACN,IAAI,EAAE,6BAA6B;YACnC,SAAS,EAAE,uBAAuB,CAAC,MAAM,CAAC;YAC1C,GAAG,EAAE,sCAAsC;SAC5C;QACD;YACE,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,0BAA0B;YAChC,GAAG,EAAE,yDAAyD;SAC/D;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,SAAS;YACT,SAAS;YACT,wBAAwB;YACxB,SAAS;YACT,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,OAAO,SAAS,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CACP,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAClH,CAAC;IACJ,CAAC;IAED,WAAW;IACX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;QACvB,UAAU;QACV,wBAAwB;QACxB,SAAS;QACT,YAAY,MAAM,EAAE;QACpB,gCAAgC;QAChC,kBAAkB;QAClB,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,+CAA+C,EAAE,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAEjE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,wBAAwB;QACxB,KAAK;QACL,YAAY,WAAW,EAAE;QACzB,6CAA6C;QAC7C,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,CAAC,kDAAkD,KAAK,wBAAwB,CAAC,CAAC;IAE3F,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,GAAG;QACH,WAAW,MAAM,CAAC,aAAa,EAAE;QACjC,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,EAAE,EAAE;QACzB,eAAe;QACf,gBAAgB,mBAAmB,EAAE;QACrC,iCAAiC,QAAQ,yBAAyB,MAAM,EAAE;QAC1E,iBAAiB;QACjB,kBAAkB,YAAY,EAAE;QAChC,SAAS;QACT,cAAc;QACd,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAEjF,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,CAAC,qCAAqC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC"}

package/dist/gcp-names.d.ts

@@ -39,7 +39,7 @@ export declare function gatewayServiceAccountEmail(projectId: string, env: strin
  */
 export declare function staticPublisherServiceAccountId(env: string): string;
 /** Globally unique GCS bucket name the stacks give each bucket. */
-export declare function gcpBucketName(projectId: string, env: string, bucket: "media" | "static" | "staging" | "audit-results"): string;
+export declare function gcpBucketName(projectId: string, env: string, bucket: "media" | "static" | "staging" | "audit-results" | "capture"): string;
 /** Secret Manager secret id for one of the stack's runtime secrets. */
 export declare function gcpSecretId(env: string, name: string): string;
 /** Cloud Run job that keeps Google IAP operator access in sync (operator-access.ts). */
@@ -86,6 +86,22 @@ export declare function auditJobResource(projectId: string, region: string, env:
 export declare function auditServiceAccountId(env: string): string;
 /** Email of the audit job's service account. */
 export declare function auditServiceAccountEmail(projectId: string, env: string): string;
+/**
+ * #1217 — Cloud Run job that runs every server-side browser render
+ * (screenshots, rendered HTML) of the install, one execution per render, so
+ * no Chromium runs in the admin (capture-job-setup.ts).
+ */
+export declare function captureJobName(env: string): string;
+/** Full resource name of the capture job, as the admin's env carries it. */
+export declare function captureJobResource(projectId: string, region: string, env: string): string;
+/**
+ * Account id of the capture job's own service account: creates capture
+ * results and writes logs — nothing else; it reads only through the signed
+ * URLs the admin hands it (capture-job-setup.ts).
+ */
+export declare function captureServiceAccountId(env: string): string;
+/** Email of the capture job's service account. */
+export declare function captureServiceAccountEmail(projectId: string, env: string): string;
 /**
  * Account id of the upgrader job's own service account: may roll the two
  * Cloud Run services, run the migration job and back up Cloud SQL, never

package/dist/gcp-names.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,GACvD,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,gDAAgD;AAChD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mDAAmD;AACnD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAO1D,CAAC"}
+{"version":3,"file":"gcp-names.d.ts","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,cAAc,CAAC;AAEtD,uDAAuD;AACvD,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wDAAwD;AACxD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,GACnE,MAAM,CAER;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,+CAA+C;AAC/C,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1F;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,gDAAgD;AAChD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,kDAAkD;AAClD,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,mDAAmD;AACnD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAO1D,CAAC"}

package/dist/gcp-names.js

@@ -132,6 +132,30 @@ export function auditServiceAccountId(env) {
 export function auditServiceAccountEmail(projectId, env) {
     return `${auditServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
 }
+/**
+ * #1217 — Cloud Run job that runs every server-side browser render
+ * (screenshots, rendered HTML) of the install, one execution per render, so
+ * no Chromium runs in the admin (capture-job-setup.ts).
+ */
+export function captureJobName(env) {
+    return `${gcpNamePrefix(env)}-capture`;
+}
+/** Full resource name of the capture job, as the admin's env carries it. */
+export function captureJobResource(projectId, region, env) {
+    return `projects/${projectId}/locations/${region}/jobs/${captureJobName(env)}`;
+}
+/**
+ * Account id of the capture job's own service account: creates capture
+ * results and writes logs — nothing else; it reads only through the signed
+ * URLs the admin hands it (capture-job-setup.ts).
+ */
+export function captureServiceAccountId(env) {
+    return `${gcpNamePrefix(env)}-capture`;
+}
+/** Email of the capture job's service account. */
+export function captureServiceAccountEmail(projectId, env) {
+    return `${captureServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
+}
 /**
  * Account id of the upgrader job's own service account: may roll the two
  * Cloud Run services, run the migration job and back up Cloud SQL, never

package/dist/gcp-names.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAwD;IAExD,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC7E,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,GAAW;IACrE,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,SAAS,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,kBAAkB,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,4BAA4B;IAC5B,6BAA6B;IAC7B,8BAA8B;CAC/B,CAAC"}
+{"version":3,"file":"gcp-names.js","sourceRoot":"","sources":["../src/gcp-names.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;AAEtD,uDAAuD;AACvD,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,GAAG,0BAA0B,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,GAAW;IACnE,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAChF,OAAO,SAAS,KAAK,YAAY,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,GAAW,EACX,MAAoE;IAEpE,OAAO,GAAG,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY;IACnD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACzC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC;AACtD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IACtF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,GAAW;IAC9E,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,yBAAyB,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAChF,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC7E,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;AACvC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,GAAW;IACrE,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,MAAc,EAAE,GAAW;IAC/E,OAAO,YAAY,SAAS,cAAc,MAAM,SAAS,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;AACzC,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;AAC1C,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,2BAA2B,CAAC,SAAiB,EAAE,GAAW;IACxE,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,IAAI,SAAS,0BAA0B,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,SAAS,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,kBAAkB,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAsB;IAC9D,sBAAsB;IACtB,qBAAqB;IACrB,wBAAwB;IACxB,4BAA4B;IAC5B,6BAA6B;IAC7B,8BAA8B;CAC/B,CAAC"}