@caelo-cms/provisioning 0.10.41 → 0.10.43

package/dist/default-firewall.js

@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: MPL-2.0
 /**
- * Delete the internet-open SSH/RDP firewall rules GCP auto-creates on a
- * project's `default` network ({@link ABSENT_DEFAULT_FIREWALL_RULES}).
+ * Delete the firewall rules GCP auto-creates on a project's `default` network
+ * (`default-allow-ssh`, `-rdp`, `-icmp`, `-internal`;
+ * {@link ABSENT_DEFAULT_FIREWALL_RULES}).
  *
  * Why gcloud and not Pulumi: the rules are created by GCP when Compute Engine
  * is enabled, not by our stacks, so Pulumi does not manage them. Pulumi can
@@ -17,53 +18,65 @@
  * same name but a different shape (narrowed source ranges, other ports,
  * target tags, another network) is a deliberate change by someone, so it is
  * reported with the next step instead of deleted.
+ *
+ * `default-allow-internal` carries traffic between VMs on the `default`
+ * network. Caelo puts nothing there (the stacks attach Cloud Run to their own
+ * VPC; default-firewall.test.ts pins that), but someone else may run VMs on
+ * it. So that rule is only deleted when the project is not a Shared VPC host
+ * (service projects' VMs could sit on its `default` network without showing
+ * up in this project) and `gcloud compute instances list` shows no instance
+ * on the `default` network; otherwise it is left in place and reported.
  */
 import { gcloud as defaultGcloud } from "./gcloud.js";
-import { ABSENT_DEFAULT_FIREWALL_RULES, GCP_DEFAULT_NETWORK, } from "./stack-contract.js";
+import { ABSENT_DEFAULT_FIREWALL_RULES, describeFirewallShape, GCP_DEFAULT_NETWORK, } from "./stack-contract.js";
 /**
  * gcloud's error when Compute Engine is not enabled on the project. Without
  * Compute Engine there is no `default` network, so there is nothing to remove.
  */
 const COMPUTE_DISABLED = /SERVICE_DISABLED|accessNotConfigured|has not been used in project|API \[compute\.googleapis\.com\] not enabled|compute\.googleapis\.com.*(?:disabled|not enabled)/i;
+/** gcloud's stderr when an aggregated list succeeded for only some zones. */
+const PARTIAL_LIST = /did not succeed|unreachable|did not respond|could not fetch/i;
 const empty = (xs) => (xs ?? []).length === 0;
 /** The last path segment of a network URL (`…/global/networks/default` → `default`). */
 function networkName(network) {
     return (network ?? "").split("/").pop() ?? "";
 }
+/** Order-insensitive identity of an `allowed` list: `["icmp", "tcp:0-65535", …]`. */
+function allowKeys(allowed) {
+    return allowed
+        .map((a) => `${a.IPProtocol.toLowerCase()}${a.ports?.length ? `:${a.ports.join(",")}` : ""}`)
+        .sort();
+}
+function sameSet(a, b) {
+    const sortedB = [...b].sort();
+    return a.length === b.length && [...a].sort().every((x, i) => x === sortedB[i]);
+}
 /**
  * Whether `live` is the rule exactly as GCP auto-creates it: ingress on the
- * `default` network, from `0.0.0.0/0` only, allowing only `protocol:port`,
- * applying to every instance. Priority, description, logging and the
- * disabled flag are ignored — changing those does not narrow who can connect.
+ * `default` network, from exactly the expected source ranges, allowing
+ * exactly the expected protocols and ports, applying to every instance.
+ * Priority, description, logging and the disabled flag are ignored —
+ * changing those does not narrow who can connect.
  */
 export function isStockDefaultRule(live, expected) {
-    const allowed = live.allowed ?? [];
     return (live.name === expected.name &&
         networkName(live.network) === GCP_DEFAULT_NETWORK &&
         (live.direction ?? "INGRESS") === "INGRESS" &&
-        (live.sourceRanges ?? []).length === 1 &&
-        live.sourceRanges?.[0] === "0.0.0.0/0" &&
+        sameSet(live.sourceRanges ?? [], expected.sourceRanges) &&
         empty(live.sourceTags) &&
         empty(live.sourceServiceAccounts) &&
         empty(live.targetTags) &&
         empty(live.targetServiceAccounts) &&
         empty(live.destinationRanges) &&
         empty(live.denied) &&
-        allowed.length === 1 &&
-        allowed[0]?.IPProtocol === expected.protocol &&
-        (allowed[0]?.ports ?? []).length === 1 &&
-        allowed[0]?.ports?.[0] === expected.port);
+        sameSet(allowKeys(live.allowed ?? []), allowKeys(expected.allowed)));
 }
 /** One-line description of a live rule, for the "left in place" report. */
 function describeRule(live) {
-    const allowed = (live.allowed ?? [])
-        .map((a) => `${a.IPProtocol}${a.ports?.length ? `:${a.ports.join(",")}` : ""}`)
-        .join(" ");
     const parts = [
         `network ${networkName(live.network) || "?"}`,
         `${live.direction ?? "INGRESS"}`,
-        `allow ${allowed || "(none)"}`,
-        `from ${(live.sourceRanges ?? []).join(",") || "(no ranges)"}`,
+        `allow ${describeFirewallShape(live.allowed ?? [], live.sourceRanges ?? [])}`,
     ];
     if (!empty(live.sourceTags))
         parts.push(`source tags ${live.sourceTags?.join(",")}`);
@@ -74,29 +87,90 @@ function describeRule(live) {
     }
     return parts.join(", ");
 }
+/**
+ * Whether the project is a Shared VPC host, from the Compute project's
+ * `xpnProjectStatus`. A host's networks can carry VMs of attached service
+ * projects that this project's instance list does not show.
+ */
+async function isSharedVpcHost(run, project) {
+    const r = await run([
+        "compute",
+        "project-info",
+        "describe",
+        project,
+        "--format=value(xpnProjectStatus)",
+    ]);
+    if (!r.ok)
+        return { ok: false, error: r.stderr.trim() };
+    return { ok: true, host: r.stdout.trim() === "HOST" };
+}
+/**
+ * The VM instances on the project's `default` network, as `zone/name`, or an
+ * error when they could not be listed. Compute Engine disabled means no VMs.
+ */
+async function instancesOnDefaultNetwork(run, project) {
+    const r = await run([
+        "compute",
+        "instances",
+        "list",
+        project,
+        "--format=json(name,zone,networkInterfaces[].network)",
+    ]);
+    if (!r.ok) {
+        if (COMPUTE_DISABLED.test(r.stderr))
+            return { ok: true, instances: [] };
+        return { ok: false, error: r.stderr.trim() };
+    }
+    // The list is aggregated across zones and may succeed with some zones
+    // missing (reported only as a stderr warning). An incomplete list cannot
+    // prove there are no VMs, so it counts as a failed check.
+    if (PARTIAL_LIST.test(r.stderr)) {
+        return { ok: false, error: `incomplete instance list: ${r.stderr.trim()}` };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(r.stdout || "[]");
+    }
+    catch {
+        parsed = null;
+    }
+    if (!Array.isArray(parsed)) {
+        return {
+            ok: false,
+            error: `unexpected output from gcloud compute instances list: ${r.stdout.slice(0, 200)}`,
+        };
+    }
+    const instances = parsed
+        .filter((i) => (i.networkInterfaces ?? []).some((n) => networkName(n.network) === GCP_DEFAULT_NETWORK))
+        .map((i) => `${networkName(i.zone) || "?"}/${i.name ?? "?"}`);
+    return { ok: true, instances };
+}
 /**
  * Delete each {@link ABSENT_DEFAULT_FIREWALL_RULES} rule present on the
  * project in its stock shape. Idempotent; never throws for a gcloud failure.
  * One outcome per rule: `present` = the rule is absent (nothing to do, also
  * when Compute Engine is disabled), `applied` = deleted now, `failed` = could
- * not be read or deleted, or exists in a customised shape and was left in
- * place. Every failure is `warn`: the rules open nothing Caelo runs, so they
- * never block an install or upgrade — but the report says what to do.
+ * not be read or deleted, exists in a customised shape, or (for
+ * `default-allow-internal`) VMs on the `default` network may still rely on
+ * it (VMs found, Shared VPC host, or either unknown) — and was left in place. Every failure is `warn`: the rules open nothing
+ * Caelo runs, so they never block an install or upgrade — but the report
+ * says what to do.
  *
  * @example
- *   const outcomes = await removeDefaultIngressRules("acme");
+ *   const outcomes = await removeDefaultFirewallRules("acme");
  *   // → [{ id: "firewall rule default-allow-ssh (tcp:22 from 0.0.0.0/0)",
- *   //      status: "applied", … }, { id: "… default-allow-rdp …", status: "present", … }]
+ *   //      status: "applied", … }, { id: "… default-allow-rdp …", status: "present", … }, …]
  */
-export async function removeDefaultIngressRules(projectId, deps = {}) {
+export async function removeDefaultFirewallRules(projectId, deps = {}) {
     const run = deps.run ?? defaultGcloud;
     const project = `--project=${projectId}`;
     const names = ABSENT_DEFAULT_FIREWALL_RULES.map((r) => r.name);
     const outcomeBase = (rule) => ({
-        id: `firewall rule ${rule.name} (${rule.protocol}:${rule.port} from 0.0.0.0/0)`,
+        id: `firewall rule ${rule.name} (${describeFirewallShape(rule.allowed, rule.sourceRanges)})`,
         onFailure: "warn",
         why: rule.why,
     });
+    const deleteCommand = (rule) => `gcloud compute firewall-rules delete ${rule.name} ${project}`;
     const list = await run([
         "compute",
         "firewall-rules",
@@ -129,7 +203,7 @@ export async function removeDefaultIngressRules(projectId, deps = {}) {
         return ABSENT_DEFAULT_FIREWALL_RULES.map((rule) => ({
             ...outcomeBase(rule),
             status: "failed",
-            error: `${error}\n    Could not check for the rule. Re-run once the cause is fixed, or delete it yourself: gcloud compute firewall-rules delete ${rule.name} ${project}`,
+            error: `${error}\n    Could not check for the rule. Re-run once the cause is fixed, or delete it yourself: ${deleteCommand(rule)}`,
         }));
     }
     const outcomes = [];
@@ -145,11 +219,49 @@ export async function removeDefaultIngressRules(projectId, deps = {}) {
                 ...base,
                 status: "failed",
                 error: `${rule.name} exists but is not GCP's auto-created rule (${describeRule(found)}), so Caelo left it in place.\n` +
-                    `    If nothing on this project needs it: gcloud compute firewall-rules delete ${rule.name} ${project}\n` +
+                    `    If nothing on this project needs it: ${deleteCommand(rule)}\n` +
                     "    If it is intentional, rename it (create a copy under another name, then delete this one) so upgrades stop reporting it.",
             });
             continue;
         }
+        if (rule.guardsInstanceTraffic) {
+            const xpn = await isSharedVpcHost(run, project);
+            if (!xpn.ok || xpn.host) {
+                outcomes.push({
+                    ...base,
+                    status: "failed",
+                    error: xpn.ok
+                        ? `This project is a Shared VPC host: VMs in attached service projects may use its default network and rely on ${rule.name}, so Caelo left it in place.\n` +
+                            `    Check the service projects (gcloud compute shared-vpc list-associated-resources ${projectId}). If none of their VMs use the default network: ${deleteCommand(rule)}`
+                        : `${xpn.error}\n    Could not check whether this project is a Shared VPC host, so Caelo left ${rule.name} in place.\n` +
+                            `    Re-run once the cause is fixed (needs compute.projects.get), or if no VM uses the default network: ${deleteCommand(rule)}`,
+                });
+                continue;
+            }
+            const vms = await instancesOnDefaultNetwork(run, project);
+            if (!vms.ok) {
+                outcomes.push({
+                    ...base,
+                    status: "failed",
+                    error: `${vms.error}\n    Could not check whether VMs on the default network still use ${rule.name}, so Caelo left it in place.\n` +
+                        `    Re-run once the cause is fixed (needs compute.instances.list), or if no VM uses the default network: ${deleteCommand(rule)}`,
+                });
+                continue;
+            }
+            if (vms.instances.length > 0) {
+                const shown = vms.instances.slice(0, 5).join(", ");
+                const more = vms.instances.length > 5 ? ` and ${vms.instances.length - 5} more` : "";
+                outcomes.push({
+                    ...base,
+                    status: "failed",
+                    error: `${vms.instances.length} VM instance(s) are on the default network (${shown}${more}); deleting ${rule.name} would cut the traffic between them, so Caelo left it in place.\n` +
+                        "    Caelo provisions nothing on the default network, so these belong to someone else on the project.\n" +
+                        `    If they do not need to talk to each other: ${deleteCommand(rule)}\n` +
+                        "    If they do, replace it with a narrower rule under another name (only the ports and target tags they need), then delete this one so upgrades stop reporting it.",
+                });
+                continue;
+            }
+        }
         const del = await run(["compute", "firewall-rules", "delete", rule.name, project, "--quiet"]);
         if (del.ok) {
             outcomes.push({ ...base, status: "applied" });
@@ -163,7 +275,7 @@ export async function removeDefaultIngressRules(projectId, deps = {}) {
         outcomes.push({
             ...base,
             status: "failed",
-            error: `${del.stderr.trim()}\n    Deleting needs compute.firewalls.delete on the project (roles/compute.securityAdmin). Re-run with an account that has it, or: gcloud compute firewall-rules delete ${rule.name} ${project}`,
+            error: `${del.stderr.trim()}\n    Deleting needs compute.firewalls.delete on the project (roles/compute.securityAdmin). Re-run with an account that has it, or: ${deleteCommand(rule)}`,
         });
     }
     return outcomes;

package/dist/default-firewall.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-firewall.js","sourceRoot":"","sources":["../src/default-firewall.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EACL,6BAA6B,EAE7B,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAkB7B;;;GAGG;AACH,MAAM,gBAAgB,GACpB,oKAAoK,CAAC;AAEvK,MAAM,KAAK,GAAG,CAAC,EAAkC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAE9E,wFAAwF;AACxF,SAAS,WAAW,CAAC,OAA2B;IAC9C,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAsB,EACtB,QAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAC3B,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,mBAAmB;QACjD,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,SAAS;QAC3C,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QACtC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,WAAW;QACtC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAClB,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,QAAQ,CAAC,QAAQ;QAC5C,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QACtC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,IAAI,CACzC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,IAAsB;IAC1C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC9E,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,KAAK,GAAG;QACZ,WAAW,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE;QAC7C,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE;QAChC,SAAS,OAAO,IAAI,QAAQ,EAAE;QAC9B,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,EAAE;KAC/D,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,CAAC,IAA+B,EAAE,EAAE,CAAC,CAAC;QACxD,EAAE,EAAE,iBAAiB,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,kBAAkB;QAC/E,SAAS,EAAE,MAAe;QAC1B,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,SAAS;QACT,gBAAgB;QAChB,MAAM;QACN,OAAO;QACP,kBAAkB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QACpC,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,GAAG,WAAW,CAAC,IAAI,CAAC;YACpB,MAAM,EAAE,SAAkB;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IACD,IAAI,IAAI,GAA8B,IAAI,CAAC;IAC3C,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,IAAI,GAAG,MAA4B,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE;YACnB,CAAC,CAAC,8DAA8D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAC3F,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,GAAG,WAAW,CAAC,IAAI,CAAC;YACpB,MAAM,EAAE,QAAiB;YACzB,KAAK,EAAE,GAAG,KAAK,mIAAmI,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE;SACzK,CAAC,CAAC,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,6BAA6B,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,IAAI;gBACP,MAAM,EAAE,QAAQ;gBAChB,KAAK,EACH,GAAG,IAAI,CAAC,IAAI,+CAA+C,YAAY,CAAC,KAAK,CAAC,iCAAiC;oBAC/G,iFAAiF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI;oBACzG,6HAA6H;aAChI,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9F,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,6EAA6E;QAC7E,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,IAAI;YACP,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,4KAA4K,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE;SAC9N,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"default-firewall.js","sourceRoot":"","sources":["../src/default-firewall.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EACL,6BAA6B,EAE7B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAyB7B;;;GAGG;AACH,MAAM,gBAAgB,GACpB,oKAAoK,CAAC;AAEvK,6EAA6E;AAC7E,MAAM,YAAY,GAAG,8DAA8D,CAAC;AAEpF,MAAM,KAAK,GAAG,CAAC,EAAkC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAE9E,wFAAwF;AACxF,SAAS,WAAW,CAAC,OAA2B;IAC9C,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAChB,OAAuF;IAEvF,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC5F,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,CAAoB,EAAE,CAAoB;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAsB,EACtB,QAAmC;IAEnC,OAAO,CACL,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QAC3B,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,mBAAmB;QACjD,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,SAAS;QAC3C,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAClB,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,IAAsB;IAC1C,MAAM,KAAK,GAAG;QACZ,WAAW,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE;QAC7C,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,EAAE;QAChC,SAAS,qBAAqB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE;KAC9E,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,GAAiB,EACjB,OAAe;IAEf,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,SAAS;QACT,cAAc;QACd,UAAU;QACV,OAAO;QACP,kCAAkC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CACtC,GAAiB,EACjB,OAAe;IAEf,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,SAAS;QACT,WAAW;QACX,MAAM;QACN,OAAO;QACP,sDAAsD;KACvD,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,yDAAyD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACzF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAI,MAAyB;SACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACZ,CAAC,CAAC,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,mBAAmB,CAAC,CACxF;SACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAiB,EACjB,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,CAAC,IAA+B,EAAE,EAAE,CAAC,CAAC;QACxD,EAAE,EAAE,iBAAiB,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG;QAC5F,SAAS,EAAE,MAAe;QAC1B,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,CAAC,IAA+B,EAAE,EAAE,CACxD,wCAAwC,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IAEjE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,SAAS;QACT,gBAAgB;QAChB,MAAM;QACN,OAAO;QACP,kBAAkB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QACpC,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,GAAG,WAAW,CAAC,IAAI,CAAC;YACpB,MAAM,EAAE,SAAkB;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IACD,IAAI,IAAI,GAA8B,IAAI,CAAC;IAC3C,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,IAAI,GAAG,MAA4B,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE;YACnB,CAAC,CAAC,8DAA8D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAC3F,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,GAAG,WAAW,CAAC,IAAI,CAAC;YACpB,MAAM,EAAE,QAAiB;YACzB,KAAK,EAAE,GAAG,KAAK,8FAA8F,aAAa,CAAC,IAAI,CAAC,EAAE;SACnI,CAAC,CAAC,CAAC;IACN,CAAC;IAED,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,6BAA6B,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,IAAI;gBACP,MAAM,EAAE,QAAQ;gBAChB,KAAK,EACH,GAAG,IAAI,CAAC,IAAI,+CAA+C,YAAY,CAAC,KAAK,CAAC,iCAAiC;oBAC/G,4CAA4C,aAAa,CAAC,IAAI,CAAC,IAAI;oBACnE,6HAA6H;aAChI,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC;oBACZ,GAAG,IAAI;oBACP,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,GAAG,CAAC,EAAE;wBACX,CAAC,CAAC,+GAA+G,IAAI,CAAC,IAAI,gCAAgC;4BACxJ,uFAAuF,SAAS,oDAAoD,aAAa,CAAC,IAAI,CAAC,EAAE;wBAC3K,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,kFAAkF,IAAI,CAAC,IAAI,cAAc;4BACrH,0GAA0G,aAAa,CAAC,IAAI,CAAC,EAAE;iBACpI,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,GAAG,IAAI;oBACP,MAAM,EAAE,QAAQ;oBAChB,KAAK,EACH,GAAG,GAAG,CAAC,KAAK,sEAAsE,IAAI,CAAC,IAAI,gCAAgC;wBAC3H,4GAA4G,aAAa,CAAC,IAAI,CAAC,EAAE;iBACpI,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,QAAQ,CAAC,IAAI,CAAC;oBACZ,GAAG,IAAI;oBACP,MAAM,EAAE,QAAQ;oBAChB,KAAK,EACH,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,+CAA+C,KAAK,GAAG,IAAI,eAAe,IAAI,CAAC,IAAI,mEAAmE;wBAC7K,wGAAwG;wBACxG,kDAAkD,aAAa,CAAC,IAAI,CAAC,IAAI;wBACzE,oKAAoK;iBACvK,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9F,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,6EAA6E;QAC7E,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,IAAI;YACP,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,uIAAuI,aAAa,CAAC,IAAI,CAAC,EAAE;SACxL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/gcloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud.d.ts","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAElF;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBjG;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK5D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBrE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAEjG;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,YAAY,CAAC,CAEvB;AA+BD,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,KAAK,GAAG,cAAsB,GACvC,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW/F;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAWvB;AA4DD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA4B1D;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED,eAAO,MAAM,iBAAiB,mBAAgB,CAAC;AAC/C,eAAO,MAAM,2BAA2B,mBAA0B,CAAC;AACnE,eAAO,MAAM,qBAAqB,mBAAoB,CAAC"}
+{"version":3,"file":"gcloud.d.ts","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAElF;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAkBjG;AAED;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAK5D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAiBrE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGvE;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAEjG;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAkCD,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,KAAK,GAAG,cAAsB,GACvC,OAAO,CAAC,YAAY,CAAC,CAIvB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAW/F;AAED,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,CAAC,CAWvB;AA4DD,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACL,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA4B1D;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CAUvB;AAED,eAAO,MAAM,iBAAiB,mBAAgB,CAAC;AAC/C,eAAO,MAAM,2BAA2B,mBAA0B,CAAC;AACnE,eAAO,MAAM,qBAAqB,mBAAoB,CAAC"}

package/dist/gcloud.js

@@ -106,6 +106,9 @@ const REQUIRED_APIS = [
     "serviceusage.googleapis.com",
     // Hourly run of the operator-access sync job (operator-access.ts).
     "cloudscheduler.googleapis.com",
+    // signJwt as caelo-mcp: how `staging-domain enable` passes the admin's
+    // IAP (staging-admin.ts, #678) — the same path the MCP shim takes.
+    "iamcredentials.googleapis.com",
 ];
 // v0.3.1 — gcp-firebase provider needs the Firebase Management +
 // Firebase Hosting APIs on top of the gcp baseline. Without these

package/dist/gcloud.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC7D,OAAO,EAAE,GAAG,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,OAA2B,EAAE;IACxE,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,aAAa,CAAC;YACZ,EAAE,EAAE,IAAI,KAAK,CAAC;YACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC;SACpB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAI9B,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IACxE,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,gBAAwB;IAExB,OAAO,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,aAAa,GAAsB;IACvC,wBAAwB;IACxB,yBAAyB;IACzB,oBAAoB;IACpB,8BAA8B;IAC9B,kCAAkC;IAClC,oBAAoB;IACpB,wBAAwB;IACxB,qCAAqC;IACrC,oBAAoB;IACpB,2BAA2B;IAC3B,iCAAiC;IACjC,yBAAyB;IACzB,oBAAoB;IACpB,oEAAoE;IACpE,qEAAqE;IACrE,6BAA6B;IAC7B,mEAAmE;IACnE,+BAA+B;CAChC,CAAC;AAEF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,MAAM,uBAAuB,GAAsB;IACjD,yBAAyB;IACzB,gCAAgC;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,WAAmC,KAAK;IAExC,MAAM,IAAI,GACR,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/F,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IAC3E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,OAAO;QACP,WAAW;QACX,SAAS;QACT,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;IAC5B,iBAAiB;IACjB,uCAAuC;IACvC,sCAAsC;IACtC,gCAAgC;IAChC,8BAA8B;IAC9B,6BAA6B;IAC7B,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,kEAAkE;IAClE,mEAAmE;IACnE,4BAA4B;IAC5B,qBAAqB;IACrB,iEAAiE;IACjE,4BAA4B;IAC5B,iEAAiE;IACjE,mDAAmD;IACnD,sCAAsC;IACtC,8DAA8D;IAC9D,qDAAqD;IACrD,gEAAgE;IAChE,0DAA0D;IAC1D,2DAA2D;IAC3D,0CAA0C;IAC1C,sBAAsB;IACtB,6BAA6B;IAC7B,4DAA4D;IAC5D,gEAAgE;IAChE,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GACvB,iFAAiF,CAAC;AAEpF,MAAM,qBAAqB,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAQ/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,OAII,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,qBAAqB,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG;YACX,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,UAAU;YACV,kBAAkB,OAAO,EAAE;YAC3B,QAAQ;YACR,IAAI;YACJ,kBAAkB;YAClB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACvD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,UAAkB;IAElB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,MAAM;QACN,QAAQ;QACR,UAAU;QACV,eAAe;QACf,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,+DAA+D;AAC/D,oDAAoD;AACpD,8DAA8D;AAC9D,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,gDAAgD"}
+{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../src/gcloud.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAS3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC7D,OAAO,EAAE,GAAG,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,OAA2B,EAAE;IACxE,OAAO,IAAI,OAAO,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,aAAa,CAAC;YACZ,EAAE,EAAE,IAAI,KAAK,CAAC;YACd,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,QAAQ,EAAE,IAAI,IAAI,CAAC;SACpB,CAAC,CACH,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,yBAAyB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAI9B,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,WAAmB;IACxE,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,gBAAwB;IAExB,OAAO,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,aAAa,GAAsB;IACvC,wBAAwB;IACxB,yBAAyB;IACzB,oBAAoB;IACpB,8BAA8B;IAC9B,kCAAkC;IAClC,oBAAoB;IACpB,wBAAwB;IACxB,qCAAqC;IACrC,oBAAoB;IACpB,2BAA2B;IAC3B,iCAAiC;IACjC,yBAAyB;IACzB,oBAAoB;IACpB,oEAAoE;IACpE,qEAAqE;IACrE,6BAA6B;IAC7B,mEAAmE;IACnE,+BAA+B;IAC/B,uEAAuE;IACvE,mEAAmE;IACnE,+BAA+B;CAChC,CAAC;AAEF,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,MAAM,uBAAuB,GAAsB;IACjD,yBAAyB;IACzB,gCAAgC;CACjC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAiB,EACjB,WAAmC,KAAK;IAExC,MAAM,IAAI,GACR,QAAQ,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/F,OAAO,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,OAAe;IAC3E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;QACrB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,OAAO;QACP,WAAW;QACX,SAAS;QACT,uBAAuB;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,SAAiB,EACjB,WAAmB;IAEnB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,QAAQ;QACR,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,iBAAiB;IACjB,sBAAsB;IACtB,qBAAqB;IACrB,2BAA2B;IAC3B,8BAA8B;IAC9B,4BAA4B;IAC5B,iBAAiB;IACjB,uCAAuC;IACvC,sCAAsC;IACtC,gCAAgC;IAChC,8BAA8B;IAC9B,6BAA6B;IAC7B,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;IACjB,kEAAkE;IAClE,mEAAmE;IACnE,4BAA4B;IAC5B,qBAAqB;IACrB,iEAAiE;IACjE,4BAA4B;IAC5B,iEAAiE;IACjE,mDAAmD;IACnD,sCAAsC;IACtC,8DAA8D;IAC9D,qDAAqD;IACrD,gEAAgE;IAChE,0DAA0D;IAC1D,2DAA2D;IAC3D,0CAA0C;IAC1C,sBAAsB;IACtB,6BAA6B;IAC7B,4DAA4D;IAC5D,gEAAgE;IAChE,4DAA4D;IAC5D,6DAA6D;IAC7D,wDAAwD;IACxD,4DAA4D;IAC5D,8DAA8D;IAC9D,gEAAgE;IAChE,uCAAuC;CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GACvB,iFAAiF,CAAC;AAEpF,MAAM,qBAAqB,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAQ/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,OAAe,EACf,OAII,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,qBAAqB,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG;YACX,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,UAAU;YACV,kBAAkB,OAAO,EAAE;YAC3B,QAAQ;YACR,IAAI;YACJ,kBAAkB;YAClB,SAAS;SACV,CAAC;QACF,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,MAAM;YACvD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,UAAkB;IAElB,OAAO,MAAM,CAAC;QACZ,KAAK;QACL,kBAAkB;QAClB,MAAM;QACN,QAAQ;QACR,UAAU;QACV,eAAe;QACf,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD,+DAA+D;AAC/D,oDAAoD;AACpD,8DAA8D;AAC9D,8DAA8D;AAC9D,iEAAiE;AACjE,+DAA+D;AAC/D,4DAA4D;AAC5D,gDAAgD"}

package/dist/internal-token.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Mint a token for `scope`.
+ *
+ * @param secret - the install's internal secret (≥32 chars; Secret Manager
+ *   `<prefix>-internal-secret` on cloud installs, never written to disk).
+ * @param now - ms since epoch; tests pin it.
+ */
+export declare function mintInternalToken(secret: string, scope: string, now?: number): Promise<string>;
+//# sourceMappingURL=internal-token.d.ts.map

package/dist/internal-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-token.d.ts","sourceRoot":"","sources":["../src/internal-token.ts"],"names":[],"mappings":"AAYA;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,MAAM,CAAC,CAWjB"}

package/dist/internal-token.js

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The CLI's side of the admin's /api/internal/* token
+ * (apps/admin/src/lib/server/internal-jwt.ts): HMAC-SHA256 over
+ * `"<iat>:<exp>:<scope>"` with the install's internal secret, valid for the
+ * admin's 5-minute replay window. One token per call.
+ */
+/** Replay window the admin enforces; tokens never outlive it. */
+const TOKEN_TTL_MS = 5 * 60 * 1000;
+/**
+ * Mint a token for `scope`.
+ *
+ * @param secret - the install's internal secret (≥32 chars; Secret Manager
+ *   `<prefix>-internal-secret` on cloud installs, never written to disk).
+ * @param now - ms since epoch; tests pin it.
+ */
+export async function mintInternalToken(secret, scope, now = Date.now()) {
+    const message = `${now}:${now + TOKEN_TTL_MS}:${scope}`;
+    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(message));
+    return `${Buffer.from(message).toString("base64url")}.${Buffer.from(sig).toString("base64url")}`;
+}
+//# sourceMappingURL=internal-token.js.map

package/dist/internal-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-token.js","sourceRoot":"","sources":["../src/internal-token.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,iEAAiE;AACjE,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,KAAa,EACb,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,YAAY,IAAI,KAAK,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACnG,CAAC"}

package/dist/lifecycle.js

@@ -617,7 +617,7 @@ async function upgradeInstall(installId, meta, opts) {
     // auto-created SSH/RDP-from-anywhere firewall rules (default-firewall.ts).
     // ────────────────────────────────────────────────────────────────
     const sInv = spinner();
-    sInv.start("Ensuring the IAM bindings + CDN settings the stack declares, removing default SSH/RDP firewall rules...");
+    sInv.start("Ensuring the IAM bindings + CDN settings the stack declares, removing the default network's pre-populated firewall rules...");
     const invariants = await ensureStackInvariants({
         provider: meta.provider,
         projectId: meta.projectId,
@@ -878,7 +878,7 @@ async function upgradeInstall(installId, meta, opts) {
         // #650 — staging builds now render the staging host; the gateway
         // serves it once it is mapped. The command is idempotent, so this
         // reminder is safe to repeat on every upgrade.
-        log.info(`Protected staging site: run ${bold("cms-provision staging-domain enable")} once to serve ${bold(installStagingHost(meta))} (it prints the DNS record). Host and access: admin → Security → Domains / Staging access.`);
+        log.info(`Protected staging site: run ${bold("cms-provision staging-domain enable")} once to serve the staging host (it maps the host the admin uses — ${bold(installStagingHost(meta))} unless changed there —, turns on password protection, prints the login and the DNS record). Host and access: admin → Security → Domains / Staging access.`);
     }
     // #613 — with both services on their new revisions, drop the bindings
     // nothing reads through any more: above all the gateway SA's access to