@caelo-cms/provisioning 0.10.55 → 0.10.57

package/dist/upgrader-setup.d.ts

@@ -7,16 +7,36 @@ export declare const UPGRADER_SQL_BACKUP_ROLE: CustomRoleSpec;
  * the file header). Names only — reads and writes stay on `install/`.
  */
 export declare const UPGRADER_OPS_LIST_ROLE: CustomRoleSpec;
-/** Project-level roles of the upgrader's service account. */
-export declare const UPGRADER_PROJECT_ROLES: readonly ["roles/run.developer", "roles/cloudsql.instanceUser", "roles/logging.logWriter"];
+/**
+ * What an app-roll does on Cloud Run (upgrade/app-roll.ts, migration-runner.ts,
+ * the self-update, the #815 lock lease) — `roles/run.developer` minus
+ * everything else, above all `run.jobs.runWithOverrides` (see the file
+ * header). Keep in step with upgrader-iam-preflight.ts.
+ */
+export declare const UPGRADER_RUN_ROLE: CustomRoleSpec;
+/** Project-level predefined roles of the upgrader's service account. */
+export declare const UPGRADER_PROJECT_ROLES: readonly ["roles/cloudsql.instanceUser", "roles/logging.logWriter"];
+/**
+ * Predefined roles that hold `run.jobs.runWithOverrides`. Neither the
+ * upgrader nor the admin may hold any of them anywhere: with it, either
+ * could run the converge or install job — which run as caelo-provisioner —
+ * with its own arguments or environment (#883 review).
+ */
+export declare const RUN_WITH_OVERRIDES_ROLES: readonly ["roles/owner", "roles/editor", "roles/run.admin", "roles/run.developer", "roles/run.invoker", "roles/run.jobsExecutorWithOverrides"];
 /**
  * Roles the upgrader must never hold anywhere — they would let it change
  * IAM, manage service accounts or secrets, or touch compute/projects.
  * Prefix matches (`roles/compute.` = every compute role).
  */
-export declare const UPGRADER_FORBIDDEN_ROLES: readonly ["roles/owner", "roles/editor", "roles/run.admin", "roles/iam.serviceAccountAdmin", "roles/iam.serviceAccountKeyAdmin", "roles/iam.securityAdmin", "roles/iam.roleAdmin", "roles/resourcemanager.", "roles/secretmanager.admin", "roles/secretmanager.secretVersionAdder", "roles/compute.", "roles/cloudsql.admin", "roles/cloudsql.editor", "roles/storage.admin", "roles/storage.objectAdmin"];
+export declare const UPGRADER_FORBIDDEN_ROLES: readonly ["roles/owner", "roles/editor", "roles/run.admin", "roles/run.developer", "roles/run.invoker", "roles/run.jobsExecutorWithOverrides", "roles/iam.serviceAccountAdmin", "roles/iam.serviceAccountKeyAdmin", "roles/iam.securityAdmin", "roles/iam.roleAdmin", "roles/resourcemanager.", "roles/secretmanager.admin", "roles/secretmanager.secretVersionAdder", "roles/compute.", "roles/cloudsql.admin", "roles/cloudsql.editor", "roles/storage.admin", "roles/storage.objectAdmin"];
 /** Database role migration 0267 creates for the job. */
 export declare const UPGRADER_DB_ROLE = "platform_updater";
+/**
+ * The job's task timeout in minutes: enough for a backup + roll; the job
+ * ends within it. It is also the lease on the state lock the job takes
+ * (#815, state-lock-lease.ts): after it, Cloud Run has killed the run.
+ */
+export declare const UPGRADER_TASK_TIMEOUT_MINUTES = 60;
 export interface UpgraderSetupTarget {
     readonly projectId: string;
     readonly region: string;
@@ -43,6 +63,8 @@ export declare function ensureUpgraderJob(target: UpgraderSetupTarget, deps?: {
     run?: GcloudRunner;
     sleep?: Sleep;
 }): Promise<UpgraderSetupResult>;
+/** Whether a gcloud IAM policy (JSON) grants `role` to `member`. */
+export declare function projectPolicyHas(policyJson: string, role: string, member: string): boolean;
 /**
  * {@link ensureUpgraderJob}'s target, with the VPC read from the deployed
  * admin service (the job reaches Cloud SQL's private IP the same way).

package/dist/upgrader-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrader-setup.d.ts","sourceRoot":"","sources":["../src/upgrader-setup.ts"],"names":[],"mappings":"AAoDA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAW3F,OAAO,EAAE,KAAK,cAAc,EAAoC,MAAM,sBAAsB,CAAC;AAG7F,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,EAAE,cAYtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAMpC,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,4FAIzB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,4YAgB3B,CAAC;AAEX,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAKnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CA2N9B;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,EACD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAUnF"}
+{"version":3,"file":"upgrader-setup.d.ts","sourceRoot":"","sources":["../src/upgrader-setup.ts"],"names":[],"mappings":"AA2EA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAW3F,OAAO,EAAE,KAAK,cAAc,EAAoC,MAAM,sBAAsB,CAAC;AAG7F,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,EAAE,cAYtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAMpC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,cA2B/B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,qEAGzB,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gJAO3B,CAAC;AAKX;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,+dAc3B,CAAC;AAEX,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAIhD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,0FAA0F;AAC1F,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAwP9B;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAM1F;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,EACD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAUnF"}

package/dist/upgrader-setup.js

@@ -16,9 +16,19 @@
  * The job's own service account, `caelo-<env>-upgrader`, may do exactly
  * what an app-roll needs (upgrade/app-roll.ts):
  *
- *   - `roles/run.developer` on the project: deploy admin/gateway revisions,
- *     move traffic, recreate the migration job, update its own job image.
- *     It includes no `*.setIamPolicy`.
+ *   - the custom role `caeloUpgraderRun` on the project
+ *     ({@link UPGRADER_RUN_ROLE}): deploy admin/gateway revisions, move
+ *     traffic, recreate and run the migration job, update its own job image.
+ *     NOT `roles/run.developer`: that role holds `run.jobs.runWithOverrides`
+ *     on every job of the project, including the converge job and the
+ *     install job, which run as `caelo-provisioner` — the upgrader could run
+ *     them with its own args (destroy, owner-reset) or env (CLOUDSDK_*,
+ *     PULUMI_*) and so act as the provisioner (#883 review). The custom role
+ *     has no `runWithOverrides` and no `*.setIamPolicy`. Updating another
+ *     job (the converge job's image, say) additionally needs `actAs` on its
+ *     service account, which the upgrader holds only on the admin, gateway
+ *     and its own. A grant of `roles/run.developer` left by an earlier
+ *     setup is removed.
  *   - `roles/iam.serviceAccountUser` on exactly the admin's and the
  *     gateway's runtime service accounts (a revision runs as them), on
  *     itself (its own job) and on the quality-audit job's account (the
@@ -45,6 +55,19 @@
  * is a converge, which only the operator runs ("Run in Cloud Shell").
  * {@link UPGRADER_FORBIDDEN_ROLES} names that line; the tests assert no
  * grant crosses it.
+ *
+ * Direct VPC egress (#818): the migration job and both services run with
+ * `--network/--subnet`. Google documents the compute permissions that needs
+ * (`compute.subnetworks.use`, `compute.addresses.createInternal`, …) on the
+ * Cloud Run service agent, which `roles/run.serviceAgent` already gives it
+ * (cloud.google.com/run/docs/configuring/vpc-direct-vpc), not on the
+ * principal that deploys. So the upgrader gets no compute role; the
+ * real-GCP upgrader smoke test (.github/workflows/upgrader-smoke.yml) shows
+ * it once a stable release was installed on the smoke install through
+ * Settings → Updates (the next tag cannot ship before). Every permission
+ * the job needs is checked by the job itself before it changes anything
+ * (upgrader-iam-preflight.ts);
+ * a grant added or removed here must keep that list in step.
  */
 import { ensureCloudSqlIamUser } from "./cloudsql-iam-user.js";
 import { gcloud as defaultGcloud } from "./gcloud.js";
@@ -76,21 +99,67 @@ export const UPGRADER_OPS_LIST_ROLE = {
     description: "Lets the Caelo upgrader job list object names in the install's ops bucket (gcloud storage cp needs it). Names only; object reads/writes stay limited to install/.",
     permissions: ["storage.objects.list"],
 };
-/** Project-level roles of the upgrader's service account. */
+/**
+ * What an app-roll does on Cloud Run (upgrade/app-roll.ts, migration-runner.ts,
+ * the self-update, the #815 lock lease) — `roles/run.developer` minus
+ * everything else, above all `run.jobs.runWithOverrides` (see the file
+ * header). Keep in step with upgrader-iam-preflight.ts.
+ */
+export const UPGRADER_RUN_ROLE = {
+    roleId: "caeloUpgraderRun",
+    title: "Caelo upgrader: roll Cloud Run",
+    description: "Lets the Caelo upgrader job deploy admin/gateway revisions, run the migration job and update its own image. Cannot start any job with changed arguments or env, cannot change IAM.",
+    permissions: [
+        "run.configurations.get",
+        "run.configurations.list",
+        "run.executions.get",
+        "run.executions.list",
+        "run.jobs.create",
+        "run.jobs.delete",
+        "run.jobs.get",
+        "run.jobs.list",
+        "run.jobs.run",
+        "run.jobs.update",
+        "run.operations.get",
+        "run.revisions.get",
+        "run.revisions.list",
+        "run.routes.get",
+        "run.routes.list",
+        "run.services.get",
+        "run.services.list",
+        "run.services.update",
+        "run.tasks.get",
+        "run.tasks.list",
+    ],
+};
+/** Project-level predefined roles of the upgrader's service account. */
 export const UPGRADER_PROJECT_ROLES = [
-    "roles/run.developer",
     "roles/cloudsql.instanceUser",
     "roles/logging.logWriter",
 ];
+/**
+ * Predefined roles that hold `run.jobs.runWithOverrides`. Neither the
+ * upgrader nor the admin may hold any of them anywhere: with it, either
+ * could run the converge or install job — which run as caelo-provisioner —
+ * with its own arguments or environment (#883 review).
+ */
+export const RUN_WITH_OVERRIDES_ROLES = [
+    "roles/owner",
+    "roles/editor",
+    "roles/run.admin",
+    "roles/run.developer",
+    "roles/run.invoker",
+    "roles/run.jobsExecutorWithOverrides",
+];
+/** A project-level grant an earlier setup gave the upgrader; removed on every setup. */
+const LEGACY_UPGRADER_PROJECT_ROLES = ["roles/run.developer"];
 /**
  * Roles the upgrader must never hold anywhere — they would let it change
  * IAM, manage service accounts or secrets, or touch compute/projects.
  * Prefix matches (`roles/compute.` = every compute role).
  */
 export const UPGRADER_FORBIDDEN_ROLES = [
-    "roles/owner",
-    "roles/editor",
-    "roles/run.admin",
+    ...RUN_WITH_OVERRIDES_ROLES,
     "roles/iam.serviceAccountAdmin",
     "roles/iam.serviceAccountKeyAdmin",
     "roles/iam.securityAdmin",
@@ -106,8 +175,13 @@ export const UPGRADER_FORBIDDEN_ROLES = [
 ];
 /** Database role migration 0267 creates for the job. */
 export const UPGRADER_DB_ROLE = "platform_updater";
-/** The job's resources: enough for a backup + roll; the job ends within it. */
-const JOB_TASK_TIMEOUT = "60m";
+/**
+ * The job's task timeout in minutes: enough for a backup + roll; the job
+ * ends within it. It is also the lease on the state lock the job takes
+ * (#815, state-lock-lease.ts): after it, Cloud Run has killed the run.
+ */
+export const UPGRADER_TASK_TIMEOUT_MINUTES = 60;
+const JOB_TASK_TIMEOUT = `${UPGRADER_TASK_TIMEOUT_MINUTES}m`;
 /** The ops bucket condition: install.json and progress.json, not the Pulumi state. */
 export function installStateCondition(bucket) {
     return `expression=resource.name.startsWith("projects/_/buckets/${bucket}/objects/${OPS_INSTALL_PREFIX}/"),title=caelo-upgrader-install-state,description=Only the install metadata under ${OPS_INSTALL_PREFIX}/`;
@@ -155,7 +229,7 @@ export async function ensureUpgraderJob(target, deps = {}) {
         };
     }
     // 1. The backup and ops-bucket-list roles.
-    for (const role of [UPGRADER_SQL_BACKUP_ROLE, UPGRADER_OPS_LIST_ROLE]) {
+    for (const role of [UPGRADER_RUN_ROLE, UPGRADER_SQL_BACKUP_ROLE, UPGRADER_OPS_LIST_ROLE]) {
         const roleError = await ensureCustomRole(run, projectId, role);
         if (roleError)
             return { ok: false, done, error: roleError };
@@ -187,6 +261,7 @@ export async function ensureUpgraderJob(target, deps = {}) {
     // 3. Project-level roles.
     for (const role of [
         ...UPGRADER_PROJECT_ROLES,
+        customRoleName(projectId, UPGRADER_RUN_ROLE.roleId),
         customRoleName(projectId, UPGRADER_SQL_BACKUP_ROLE.roleId),
     ]) {
         const r = await retry([
@@ -203,6 +278,37 @@ export async function ensureUpgraderJob(target, deps = {}) {
             return fail(`grant the upgrader ${role}`, r);
         done.push(`upgrader: ${role} on the project`);
     }
+    // 3b. The project-wide roles/run.developer an earlier setup granted holds
+    //     run.jobs.runWithOverrides on the provisioner's jobs: take it away.
+    //     Only after the custom role above is bound, so a running upgrade
+    //     never loses its Cloud Run rights in between.
+    const policy = await run(["projects", "get-iam-policy", projectId, "--format=json"]);
+    if (!policy.ok)
+        return fail("read the project's IAM policy", policy);
+    for (const role of LEGACY_UPGRADER_PROJECT_ROLES) {
+        let held;
+        try {
+            held = projectPolicyHas(policy.stdout, role, member);
+        }
+        catch (e) {
+            return { ok: false, done, error: `read the project's IAM policy: ${String(e)}` };
+        }
+        if (!held)
+            continue;
+        const r = await retry([
+            "projects",
+            "remove-iam-policy-binding",
+            projectId,
+            `--member=${member}`,
+            `--role=${role}`,
+            "--all",
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`remove the upgrader's ${role}`, r);
+        done.push(`upgrader: removed ${role} on the project`);
+    }
     // 4. Resource-level grants on single service accounts.
     const onAccounts = [
         {
@@ -330,6 +436,12 @@ export async function ensureUpgraderJob(target, deps = {}) {
     }
     return { ok: true, done };
 }
+/** Whether a gcloud IAM policy (JSON) grants `role` to `member`. */
+export function projectPolicyHas(policyJson, role, member) {
+    // Throws on unreadable JSON: the caller reports it, never guesses "absent".
+    const policy = JSON.parse(policyJson.trim() || "{}");
+    return (policy.bindings ?? []).some((b) => b.role === role && (b.members ?? []).includes(member));
+}
 /**
  * {@link ensureUpgraderJob}'s target, with the VPC read from the deployed
  * admin service (the job reaches Cloud SQL's private IP the same way).

package/dist/upgrader-setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"upgrader-setup.js","sourceRoot":"","sources":["../src/upgrader-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,eAAe,EACf,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAuB,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvE,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,MAAM,EAAE,wBAAwB;IAChC,KAAK,EAAE,mCAAmC;IAC1C,WAAW,EACT,0HAA0H;IAC5H,WAAW,EAAE;QACX,4BAA4B;QAC5B,yBAAyB;QACzB,0BAA0B;QAC1B,wBAAwB;QACxB,yBAAyB;KAC1B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,MAAM,EAAE,sBAAsB;IAC9B,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EACT,mKAAmK;IACrK,WAAW,EAAE,CAAC,sBAAsB,CAAC;CACtC,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,qBAAqB;IACrB,6BAA6B;IAC7B,yBAAyB;CACjB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,+BAA+B;IAC/B,kCAAkC;IAClC,yBAAyB;IACzB,qBAAqB;IACrB,wBAAwB;IACxB,2BAA2B;IAC3B,wCAAwC;IACxC,gBAAgB;IAChB,sBAAsB;IACtB,uBAAuB;IACvB,qBAAqB;IACrB,2BAA2B;CACnB,CAAC;AAEX,wDAAwD;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAkB/B,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,2DAA2D,MAAM,YAAY,kBAAkB,sFAAsF,kBAAkB,GAAG,CAAC;AACpN,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,2BAA2B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAuB,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,oDAAoD,MAAM,CAAC,WAAW,EAAE;SAChF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC;QAC5B,SAAS;QACT,SAAS;QACT,UAAU;QACV,QAAQ,MAAM,EAAE;QAChB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uBAAuB,MAAM,kBAAkB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,qFAAqF;SACrK,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,wBAAwB,CAAC,GAAG,CAAC;YAC7B,+BAA+B;YAC/B,qIAAqI;YACrI,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,0BAA0B;IAC1B,KAAK,MAAM,IAAI,IAAI;QACjB,GAAG,sBAAsB;QACzB,cAAc,CAAC,SAAS,EAAE,wBAAwB,CAAC,MAAM,CAAC;KAC3D,EAAE,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,sBAAsB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC;IAChD,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAqD;QACnE;YACE,OAAO,EAAE,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC;YAC/C,IAAI,EAAE,8BAA8B;YACpC,GAAG,EAAE,+CAA+C;SACrD;QACD;YACE,OAAO,EAAE,0BAA0B,CAAC,SAAS,EAAE,GAAG,CAAC;YACnD,IAAI,EAAE,8BAA8B;YACpC,GAAG,EAAE,6BAA6B;SACnC;QACD,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,+BAA+B,EAAE;QAC3F;YACE,OAAO,EAAE,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC;YACjD,IAAI,EAAE,8BAA8B;YACpC,GAAG,EAAE,gFAAgF;SACtF;QACD;YACE,OAAO,EAAE,yBAAyB,CAAC,SAAS,CAAC;YAC7C,IAAI,EAAE,sCAAsC;YAC5C,GAAG,EAAE,wDAAwD;SAC9D;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,kBAAkB;YAClB,wBAAwB;YACxB,CAAC,CAAC,OAAO;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,kBAAkB;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC;QAC9B,SAAS;QACT,SAAS;QACT,wBAAwB;QACxB,QAAQ,MAAM,EAAE;QAChB,YAAY,MAAM,EAAE;QACpB,iCAAiC;QACjC,eAAe,qBAAqB,CAAC,MAAM,CAAC,EAAE;QAC9C,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE;QACjB,OAAO,IAAI,CAAC,2CAA2C,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,CAAC,8CAA8C,MAAM,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAEzF,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC;QAC5B,SAAS;QACT,SAAS;QACT,wBAAwB;QACxB,QAAQ,MAAM,EAAE;QAChB,YAAY,MAAM,EAAE;QACpB,UAAU,QAAQ,EAAE;QACpB,kBAAkB;QAClB,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,6CAA6C,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;IACjG,IAAI,CAAC,IAAI,CAAC,aAAa,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC;IAErD,kEAAkE;IAClE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,EAAE;QACvB,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,GAAG;QACH,WAAW,MAAM,CAAC,WAAW,EAAE;QAC/B,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,EAAE,EAAE;QACzB,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,kBAAkB,gBAAgB,EAAE;QACpC,cAAc;QACd,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAE/E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAKC,EACD,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;KAClF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"upgrader-setup.js","sourceRoot":"","sources":["../src/upgrader-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,eAAe,EACf,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAuB,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEvE,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,MAAM,EAAE,wBAAwB;IAChC,KAAK,EAAE,mCAAmC;IAC1C,WAAW,EACT,0HAA0H;IAC5H,WAAW,EAAE;QACX,4BAA4B;QAC5B,yBAAyB;QACzB,0BAA0B;QAC1B,wBAAwB;QACxB,yBAAyB;KAC1B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,MAAM,EAAE,sBAAsB;IAC9B,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EACT,mKAAmK;IACrK,WAAW,EAAE,CAAC,sBAAsB,CAAC;CACtC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAmB;IAC/C,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,gCAAgC;IACvC,WAAW,EACT,oLAAoL;IACtL,WAAW,EAAE;QACX,wBAAwB;QACxB,yBAAyB;QACzB,oBAAoB;QACpB,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,cAAc;QACd,eAAe;QACf,cAAc;QACd,iBAAiB;QACjB,oBAAoB;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,gBAAgB;QAChB,iBAAiB;QACjB,kBAAkB;QAClB,mBAAmB;QACnB,qBAAqB;QACrB,eAAe;QACf,gBAAgB;KACjB;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,6BAA6B;IAC7B,yBAAyB;CACjB,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,qBAAqB;IACrB,mBAAmB;IACnB,qCAAqC;CAC7B,CAAC;AAEX,wFAAwF;AACxF,MAAM,6BAA6B,GAAG,CAAC,qBAAqB,CAAU,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,GAAG,wBAAwB;IAC3B,+BAA+B;IAC/B,kCAAkC;IAClC,yBAAyB;IACzB,qBAAqB;IACrB,wBAAwB;IACxB,2BAA2B;IAC3B,wCAAwC;IACxC,gBAAgB;IAChB,sBAAsB;IACtB,uBAAuB;IACvB,qBAAqB;IACrB,2BAA2B;CACnB,CAAC;AAEX,wDAAwD;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,MAAM,gBAAgB,GAAG,GAAG,6BAA6B,GAAG,CAAC;AAkB7D,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,OAAO,2DAA2D,MAAM,YAAY,kBAAkB,sFAAsF,kBAAkB,GAAG,CAAC;AACpN,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,2BAA2B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAuB,EAAE,CAAC,CAAC;QACpE,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,oDAAoD,MAAM,CAAC,WAAW,EAAE;SAChF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC;QAC5B,SAAS;QACT,SAAS;QACT,UAAU;QACV,QAAQ,MAAM,EAAE;QAChB,OAAO;QACP,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uBAAuB,MAAM,kBAAkB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,qFAAqF;SACrK,CAAC;IACJ,CAAC;IAED,2CAA2C;IAC3C,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE,wBAAwB,EAAE,sBAAsB,CAAC,EAAE,CAAC;QACzF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,wBAAwB,CAAC,GAAG,CAAC;YAC7B,+BAA+B;YAC/B,qIAAqI;YACrI,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,0BAA0B;IAC1B,KAAK,MAAM,IAAI,IAAI;QACjB,GAAG,sBAAsB;QACzB,cAAc,CAAC,SAAS,EAAE,iBAAiB,CAAC,MAAM,CAAC;QACnD,cAAc,CAAC,SAAS,EAAE,wBAAwB,CAAC,MAAM,CAAC;KAC3D,EAAE,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,wBAAwB;YACxB,SAAS;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,IAAI,EAAE;YAChB,kBAAkB;YAClB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,sBAAsB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC;IAChD,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,6BAA6B,EAAE,CAAC;QACjD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,UAAU;YACV,2BAA2B;YAC3B,SAAS;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,IAAI,EAAE;YAChB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,yBAAyB,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,qBAAqB,IAAI,iBAAiB,CAAC,CAAC;IACxD,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAqD;QACnE;YACE,OAAO,EAAE,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC;YAC/C,IAAI,EAAE,8BAA8B;YACpC,GAAG,EAAE,+CAA+C;SACrD;QACD;YACE,OAAO,EAAE,0BAA0B,CAAC,SAAS,EAAE,GAAG,CAAC;YACnD,IAAI,EAAE,8BAA8B;YACpC,GAAG,EAAE,6BAA6B;SACnC;QACD,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,+BAA+B,EAAE;QAC3F;YACE,OAAO,EAAE,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC;YACjD,IAAI,EAAE,8BAA8B;YACpC,GAAG,EAAE,gFAAgF;SACtF;QACD;YACE,OAAO,EAAE,yBAAyB,CAAC,SAAS,CAAC;YAC7C,IAAI,EAAE,sCAAsC;YAC5C,GAAG,EAAE,wDAAwD;SAC9D;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,kBAAkB;YAClB,wBAAwB;YACxB,CAAC,CAAC,OAAO;YACT,YAAY,MAAM,EAAE;YACpB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,kBAAkB;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,8DAA8D;IAC9D,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC;QAC9B,SAAS;QACT,SAAS;QACT,wBAAwB;QACxB,QAAQ,MAAM,EAAE;QAChB,YAAY,MAAM,EAAE;QACpB,iCAAiC;QACjC,eAAe,qBAAqB,CAAC,MAAM,CAAC,EAAE;QAC9C,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,CAAC,EAAE;QACjB,OAAO,IAAI,CAAC,2CAA2C,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,CAAC,8CAA8C,MAAM,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAEzF,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC;QAC5B,SAAS;QACT,SAAS;QACT,wBAAwB;QACxB,QAAQ,MAAM,EAAE;QAChB,YAAY,MAAM,EAAE;QACpB,UAAU,QAAQ,EAAE;QACpB,kBAAkB;QAClB,OAAO;QACP,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,6CAA6C,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;IACjG,IAAI,CAAC,IAAI,CAAC,aAAa,QAAQ,YAAY,MAAM,EAAE,CAAC,CAAC;IAErD,kEAAkE;IAClE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE;QAC/C,SAAS;QACT,GAAG;QACH,mBAAmB,EAAE,EAAE;QACvB,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAElE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,GAAG;QACH,WAAW,MAAM,CAAC,WAAW,EAAE;QAC/B,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,EAAE,EAAE;QACzB,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,kCAAkC;QAClC,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,kBAAkB,gBAAgB,EAAE;QACpC,cAAc;QACd,SAAS;QACT,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAE/E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,IAAY,EAAE,MAAc;IAC/E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,CAElD,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACpG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAKC,EACD,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;KAClF,CAAC;AACJ,CAAC"}

package/dist/wizards/gcp-cost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-cost.d.ts","sourceRoot":"","sources":["../../src/wizards/gcp-cost.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC;IAClC,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,wBAAgB,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG;IAC3D,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;CACpB,CAwHA"}
+{"version":3,"file":"gcp-cost.d.ts","sourceRoot":"","sources":["../../src/wizards/gcp-cost.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC;IAClC,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,wBAAgB,eAAe,CAAC,MAAM,EAAE,kBAAkB,GAAG;IAC3D,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;CACpB,CAiIA"}

package/dist/wizards/gcp-cost.js

@@ -92,6 +92,14 @@ export function estimateGcpCost(inputs) {
                         ? "Adaptive protection (ML-based bot mitigation)"
                         : "Free tier — rate limit + OWASP basic rules",
                 },
+                {
+                    // #806 — the remote-MCP throttle (src/remote-mcp-edge.ts) is one
+                    // more rule on the gateway's policy; Cloud Armor Standard bills
+                    // each rule at about $1/mo.
+                    name: "Cloud Armor rule: remote MCP throttle",
+                    monthlyUsd: 1,
+                    notes: "Per-IP throttle for /api/mcp/* (remote MCP clients)",
+                },
             ]
             : [
                 {
@@ -108,9 +116,9 @@ export function estimateGcpCost(inputs) {
             notes: "~5 GB storage + low egress; growth roughly $0.02/GB",
         },
         {
-            name: "Secret Manager (5 secrets)",
-            monthlyUsd: 0,
-            notes: "Free tier",
+            name: "Secret Manager (runtime secrets)",
+            monthlyUsd: 0.2,
+            notes: "6 active versions free, then ~$0.06 each; remote MCP (#806) adds the OAuth client and its seal key",
         },
         {
             name: "BigQuery edge log sink",

package/dist/wizards/gcp-cost.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-cost.js","sourceRoot":"","sources":["../../src/wizards/gcp-cost.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;GASG;AAEH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAgC/E,uDAAuD;AACvD,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,MAAM,YAAY,GAA2B;IAC3C,+CAA+C;IAC/C,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,EAAE;IACjB,qCAAqC;IACrC,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,GAAG;IAC5B,kCAAkC;IAClC,kBAAkB,EAAE,EAAE;IACtB,kBAAkB,EAAE,EAAE;IACtB,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAA0B;IAMxD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,aAAa,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IACjC,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IAE/D,MAAM,KAAK,GAAe;QACxB;YACE,IAAI,EAAE,uBAAuB,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,MAAM,CAAC,UAAU;gBACtB,CAAC,CAAC,6CAA6C;gBAC/C,CAAC,CAAC,wCAAwC;SAC7C;QACD;YACE,IAAI,EAAE,oBAAoB,WAAW,GAAG;YACxC,UAAU,EACR,MAAM,CAAC,iBAAiB,KAAK,CAAC;gBAC5B,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;YAClE,KAAK,EACH,MAAM,CAAC,iBAAiB,KAAK,CAAC;gBAC5B,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,gBAAgB,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB;SAC3G;QACD;YACE,IAAI,EAAE,sCAAsC;YAC5C,UAAU,EAAE,CAAC;YACb,KAAK,EACH,yKAAyK;SAC5K;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,MAAM,CAAC,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,GAAG,EAAE;YACtF,KAAK,EACH,MAAM,CAAC,mBAAmB,KAAK,CAAC;gBAC9B,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,gBAAgB,MAAM,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SAC/F;QACD,gEAAgE;QAChE,+DAA+D;QAC/D,6DAA6D;QAC7D,4DAA4D;QAC5D,8CAA8C;QAC9C,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAE;gBACC;oBACE,IAAI,EAAE,kCAAkC;oBACxC,UAAU,EAAE,EAAE;oBACd,KAAK,EAAE,yCAAyC;iBACjD;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,gCAAgC;iBACxC;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,UAAU,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAChD,KAAK,EAAE,MAAM,CAAC,qBAAqB;wBACjC,CAAC,CAAC,+CAA+C;wBACjD,CAAC,CAAC,4CAA4C;iBACjD;aACoB;YACzB,CAAC,CAAE;gBACC;oBACE,IAAI,EAAE,kBAAkB;oBACxB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,8CAA8C;iBACtD;aACoB,CAAC;QAC5B;YACE,IAAI,EACF,QAAQ,KAAK,KAAK;gBAChB,CAAC,CAAC,gCAAgC;gBAClC,CAAC,CAAC,uDAAuD;YAC7D,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,qDAAqD;SAC7D;QACD;YACE,IAAI,EAAE,4BAA4B;YAClC,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,WAAW;SACnB;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,wCAAwC;SAChD;QACD;YACE,IAAI,EAAE,4CAA4C;YAClD,UAAU,EAAE,IAAI;YAChB,KAAK,EACH,+FAA+F;SAClG;QACD;YACE,IAAI,EAAE,wDAAwD;YAC9D,UAAU,EAAE,CAAC;YACb,KAAK,EACH,0HAA0H;SAC7H;KACF,CAAC;IAEF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACzF,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,aAAa;QAC7B,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,wBAAwB;QAClD,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,6CAA6C,aAAa,gBAAgB,MAAM,CAAC,MAAM,mBAAmB,CAAC;IACzI,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"gcp-cost.js","sourceRoot":"","sources":["../../src/wizards/gcp-cost.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;GASG;AAEH,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAgC/E,uDAAuD;AACvD,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,MAAM,YAAY,GAA2B;IAC3C,+CAA+C;IAC/C,aAAa,EAAE,GAAG;IAClB,aAAa,EAAE,EAAE;IACjB,qCAAqC;IACrC,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,EAAE;IAC3B,uBAAuB,EAAE,GAAG;IAC5B,kCAAkC;IAClC,kBAAkB,EAAE,EAAE;IACtB,kBAAkB,EAAE,EAAE;IACtB,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAA0B;IAMxD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,aAAa,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAC/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAC;IACjC,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IAE/D,MAAM,KAAK,GAAe;QACxB;YACE,IAAI,EAAE,uBAAuB,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG;YACrF,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,MAAM,CAAC,UAAU;gBACtB,CAAC,CAAC,6CAA6C;gBAC/C,CAAC,CAAC,wCAAwC;SAC7C;QACD;YACE,IAAI,EAAE,oBAAoB,WAAW,GAAG;YACxC,UAAU,EACR,MAAM,CAAC,iBAAiB,KAAK,CAAC;gBAC5B,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;YAClE,KAAK,EACH,MAAM,CAAC,iBAAiB,KAAK,CAAC;gBAC5B,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,GAAG,MAAM,CAAC,iBAAiB,gBAAgB,MAAM,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB;SAC3G;QACD;YACE,IAAI,EAAE,sCAAsC;YAC5C,UAAU,EAAE,CAAC;YACb,KAAK,EACH,yKAAyK;SAC5K;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,MAAM,CAAC,mBAAmB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,GAAG,EAAE;YACtF,KAAK,EACH,MAAM,CAAC,mBAAmB,KAAK,CAAC;gBAC9B,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,gBAAgB,MAAM,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;SAC/F;QACD,gEAAgE;QAChE,+DAA+D;QAC/D,6DAA6D;QAC7D,4DAA4D;QAC5D,8CAA8C;QAC9C,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAE;gBACC;oBACE,IAAI,EAAE,kCAAkC;oBACxC,UAAU,EAAE,EAAE;oBACd,KAAK,EAAE,yCAAyC;iBACjD;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,gCAAgC;iBACxC;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,UAAU,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAChD,KAAK,EAAE,MAAM,CAAC,qBAAqB;wBACjC,CAAC,CAAC,+CAA+C;wBACjD,CAAC,CAAC,4CAA4C;iBACjD;gBACD;oBACE,iEAAiE;oBACjE,gEAAgE;oBAChE,4BAA4B;oBAC5B,IAAI,EAAE,uCAAuC;oBAC7C,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,qDAAqD;iBAC7D;aACoB;YACzB,CAAC,CAAE;gBACC;oBACE,IAAI,EAAE,kBAAkB;oBACxB,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,8CAA8C;iBACtD;aACoB,CAAC;QAC5B;YACE,IAAI,EACF,QAAQ,KAAK,KAAK;gBAChB,CAAC,CAAC,gCAAgC;gBAClC,CAAC,CAAC,uDAAuD;YAC7D,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,qDAAqD;SAC7D;QACD;YACE,IAAI,EAAE,kCAAkC;YACxC,UAAU,EAAE,GAAG;YACf,KAAK,EACH,oGAAoG;SACvG;QACD;YACE,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,wCAAwC;SAChD;QACD;YACE,IAAI,EAAE,4CAA4C;YAClD,UAAU,EAAE,IAAI;YAChB,KAAK,EACH,+FAA+F;SAClG;QACD;YACE,IAAI,EAAE,wDAAwD;YAC9D,UAAU,EAAE,CAAC;YACb,KAAK,EACH,0HAA0H;SAC7H;KACF,CAAC;IAEF,uEAAuE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACzF,MAAM,UAAU,GACd,MAAM,CAAC,MAAM,KAAK,aAAa;QAC7B,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,wBAAwB;QAClD,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,6CAA6C,aAAa,gBAAgB,MAAM,CAAC,MAAM,mBAAmB,CAAC;IACzI,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC"}

package/dist/wizards/gcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/wizards/gcp.ts"],"names":[],"mappings":"AAuGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAOL,KAAK,eAAe,EAErB,MAAM,qBAAqB,CAAC;AAa7B,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC;IAClC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA2HrE;AAKD,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAwMzE"}
+{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/wizards/gcp.ts"],"names":[],"mappings":"AAyGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAOL,KAAK,eAAe,EAErB,MAAM,qBAAqB,CAAC;AAc7B,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC;IAClC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA2HrE;AAKD,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiNzE"}

package/dist/wizards/gcp.js

@@ -34,6 +34,7 @@ import { checkAdcImpersonation } from "../adc-impersonation.js";
 import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
 import { CERT_WAIT_TIMEOUT_MS, lbCertProbe, waitForCert } from "../cert-wait.js";
 import { redactCredentials } from "../checkpoint-secrets.js";
+import { ensureConvergeJob } from "../converge-job-setup.js";
 import { removeDefaultFirewallRules } from "../default-firewall.js";
 import { checkDeployedRuntimeEnv, chooseImageDigests, readDeployedImageDigests, readDeployedRegion, } from "../deployed-release.js";
 import { formatDnsRecordGroups, groupDnsRecords } from "../dns/groups.js";
@@ -48,10 +49,12 @@ import { ensureOpsBackend } from "../ops-backend.js";
 import { convergeKeylessProvisioner, PROVISIONER_ACCOUNT_ID, provisionerServiceAccountEmail, } from "../provisioner-identity.js";
 import { revokePublicRoleMemberships } from "../public-role-isolation.js";
 import { decideRegion, detectCliRegion, installableRegions, suggestRegion } from "../regions.js";
+import { ensureRemoteMcpEdge, ensureRemoteMcpIdentityEnv } from "../remote-mcp.js";
 import { selfCommand } from "../self-command.js";
 import { ABSENT_DEFAULT_FIREWALL_RULES } from "../stack-contract.js";
 import { chooseInstallBackend, describeBackend, gcsBackendRecord, hasLocalPulumiState, installBackend, parseStateBackend, resolveBackend, } from "../state-backend.js";
 import { acquireStateLock, GcsStateStore } from "../state-store.js";
+import { resolveGcpResourceName } from "../upgrade/gcp-lookup.js";
 import { releaseVersionForDigest, resolveOpsImageRef, verifyCosignAll, } from "../upgrade/release-images.js";
 import { ensureUpgraderJob, resolveUpgraderTarget } from "../upgrader-setup.js";
 import { ensureUrlMapRedirectsAccess } from "../url-map-redirects-access.js";
@@ -318,13 +321,21 @@ export async function runGcpConverge(opts) {
     const releaseVersion = await releaseVersionForDigest(gcloud, "admin", imageDigests.admin);
     const upgraderReady = await stepUpgraderJob(projectId, region, releaseVersion);
     const keepSigner = upgraderReady || (await upgraderExists(projectId));
+    // === 11.45. The converge job: releases that change the cloud setup (#819) ===
+    const convergeReady = await stepConvergeJob(projectId, region, releaseVersion);
     // === 11.5. Operator access: IAP follows the Caelo user list ===
     await stepOperatorAccessSync(projectId, region, provider, ownerEmail, keepSigner ? [`serviceAccount:${upgraderServiceAccountEmail(projectId, GCP_STACK_ENV)}`] : []);
+    // === 11.6. Remote MCP (#806): LB rules (gcp) + the identity env ===
+    // After `pulumi up` on every pass: the identity env names services Pulumi
+    // generated, so the stack cannot declare it, and an `up` that changed a
+    // service's template dropped it (remote-mcp.ts).
+    const remoteMcpReady = await stepRemoteMcp(projectId, region, provider, domain);
     // A fresh install ran every converge step above, so it is at this CLI's
-    // infrastructure contract — recorded only when the upgrader is in place
-    // (the last step a contract bump added). With the release version, the
-    // admin can install the next update itself.
-    if (upgraderReady) {
+    // infrastructure contract — recorded only when the upgrader and the
+    // converge job are in place (the steps contract bumps 2 and 9 added) and
+    // remote MCP's steps (#806, bump 10) succeeded. With the release version,
+    // the admin can install the next update itself.
+    if (upgraderReady && convergeReady && remoteMcpReady) {
         const version = releaseVersion;
         recordImageDigests(installId, imageDigests, version);
         recordInfraContractVersion(installId, INFRA_CONTRACT_VERSION);
@@ -749,6 +760,52 @@ async function stepUpgraderJob(projectId, region, releaseVersion) {
     s.stop(green(`Upgrader job ready (${r.done.length} steps)`));
     return true;
 }
+/**
+ * Set up the converge job (converge-job-setup.ts, #819): what the admin's
+ * "Install update" starts for a release that changes the cloud setup. Same
+ * shape as {@link stepUpgraderJob}: after migrations (its database login
+ * gets migration 0267's role), only a verified ops image, and a failure
+ * only warns — such releases then install from a terminal until a later
+ * `upgrade` sets the job up. Idempotent.
+ *
+ * @returns whether the job is ready
+ */
+async function stepConvergeJob(projectId, region, releaseVersion) {
+    const opsImageRef = releaseVersion ? await resolveOpsImageRef(releaseVersion) : null;
+    const digest = opsImageRef ? /@(sha256:[0-9a-f]{64})$/.exec(opsImageRef)?.[1] : undefined;
+    // The job runs as the provisioner: only a verified image, ever.
+    if (digest && !(await verifyCosignAll([{ slug: "ops", digest }]))) {
+        log.warn(`The converge job is not set up: its image's signature did not verify. The install works; ${bold(selfCommand("upgrade"))} sets it up later.`);
+        return false;
+    }
+    const s = spinner();
+    s.start("Setting up the converge job (cloud-setup updates from the admin)...");
+    const resolved = opsImageRef
+        ? await resolveUpgraderTarget({ projectId, region, env: GCP_STACK_ENV, opsImageRef })
+        : {
+            ok: false,
+            error: releaseVersion
+                ? `release ${releaseVersion} has no caelo-ops image in the registry`
+                : "the release this install runs could not be told from its images",
+        };
+    const r = resolved.ok
+        ? await ensureConvergeJob(resolved.target)
+        : { ok: false, done: [], error: resolved.error };
+    if (!r.ok && r.reason === "no-provisioner") {
+        // #883 review — not needed for the contract: such an install installs
+        // cloud-setup releases from a terminal, and its admin says so.
+        s.stop(yellow("No converge job: this install has no caelo-provisioner to run it as"));
+        log.info("Releases that change the cloud setup install from a terminal; Settings → Updates says so when one comes.");
+        return true;
+    }
+    if (!r.ok) {
+        s.stop(yellow(`Converge job not set up: ${r.error}`));
+        log.warn(`The install works; releases that change the cloud setup install from a terminal until ${bold(selfCommand("upgrade"))} sets the job up.`);
+        return false;
+    }
+    s.stop(green(`Converge job ready (${r.done.length} steps)`));
+    return true;
+}
 /**
  * Set up the quality-audit job (audit-job-setup.ts) on the deployed admin's
  * image. A failure stops the wizard: without the job every Stage audit
@@ -819,6 +876,44 @@ async function stepOperatorAccessSync(projectId, region, provider, ownerEmail, m
     }
     s.stop(green(`Operator-access sync job ready (${r.done.length} steps)`));
 }
+/**
+ * #806 — the CLI's part of remote MCP (remote-mcp.ts): on `gcp` the load
+ * balancer's discovery routes and Cloud Armor rule, on both providers the
+ * env vars naming the admin URL, the broker's public URL and the IAP
+ * audience. Remote MCP stays off until the Owner sets it up under Settings →
+ * MCP, so a failure does not stop the install: it warns, and the next pass
+ * or `upgrade` retries. Idempotent.
+ *
+ * @returns whether every part is in place
+ */
+async function stepRemoteMcp(projectId, region, provider, domain) {
+    const s = spinner();
+    s.start("Preparing remote MCP (ChatGPT / claude.ai connectors; off until the Owner enables it)...");
+    const name = (slug) => resolveGcpResourceName(gcloud, "run-service", `caelo-${GCP_STACK_ENV}-${slug}`, projectId, region);
+    const [admin, gateway] = [await name("admin"), await name("gateway")];
+    const failed = (error) => {
+        s.stop(yellow(`Remote MCP not prepared: ${error}`));
+        log.warn(`The install works; Settings → MCP reports remote MCP as unavailable until ${bold(selfCommand("upgrade"))} prepares it.`);
+        return false;
+    };
+    if (!admin || !gateway)
+        return failed("the admin or gateway Cloud Run service was not found");
+    const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
+    if (!edge.ok)
+        return failed(edge.error);
+    const env = await ensureRemoteMcpIdentityEnv({
+        provider,
+        projectId,
+        region,
+        env: GCP_STACK_ENV,
+        domain,
+        services: { admin, gateway },
+    });
+    if (!env.ok)
+        return failed(env.error);
+    s.stop(green(`Remote MCP prepared (${env.identity.mcpPublicUrl})`));
+    return true;
+}
 /**
  * Delete the firewall rules GCP pre-populates on the `default` network
  * (SSH, RDP, ICMP, internal; default-firewall.ts). A customised rule of the