@caelo-cms/provisioning 0.11.9 → 0.11.11

package/src/upgrader-job.ts

@@ -56,15 +56,21 @@ import type {
   StoredUpdatePolicy,
 } from "@caelo-cms/shared";
 import type { GcloudRunner, Sleep } from "./gcloud-retry.js";
-import { gcpNamePrefix, upgraderJobName } from "./gcp-names.js";
+import { upgraderJobName } from "./gcp-names.js";
 import type { InstallMetadata } from "./install-state.js";
-import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
+import {
+  manifestServiceImages,
+  type ReleaseManifest,
+  type ReleaseManifestResult,
+} from "./release-manifest.js";
+import { cloudRunServicePrefix } from "./stack-contract.js";
 import { StateLockHeldError } from "./state-store.js";
 import {
   type AppRollPlan,
   executeAppRoll,
   planAppRoll,
   type ReleaseImage,
+  ROLL_ORDER,
   type RollSlug,
 } from "./upgrade/app-roll.js";
 import { restoreCommand, takeSqlBackup } from "./upgrade/backup.js";
@@ -389,7 +395,7 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
     // install.json must describe what actually serves: if a previous run
     // rolled but could not record it, the recorded version is stale and
     // the downgrade / minFromVersion checks would judge against it.
-    const serving = await servingDigests(deps);
+    const serving = await servingDigests(deps, meta.provider);
     if (!serving.ok) {
       return stopWith("failed", ["lookup"], `Nothing was changed: ${serving.error}.`);
     }
@@ -424,6 +430,9 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
         imageDigests: {
           admin: found.manifest.digests.admin,
           gateway: found.manifest.digests.gateway,
+          ...(found.manifest.digests["mcp-auth-proxy"]
+            ? { "mcp-auth-proxy": found.manifest.digests["mcp-auth-proxy"] }
+            : {}),
         },
         ...(found.platformDigests ? { platformDigests: found.platformDigests } : {}),
         releaseVersion: found.manifest.version,
@@ -500,13 +509,10 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
     r.info("The upgrader has every permission this update needs.");
 
     const m = decision.manifest;
-    const images: Record<RollSlug, ReleaseImage> = {
-      admin: { digest: m.digests.admin, imageRef: releaseImageRef("admin", m.digests.admin) },
-      gateway: {
-        digest: m.digests.gateway,
-        imageRef: releaseImageRef("gateway", m.digests.gateway),
-      },
-    };
+    const resolved = manifestServiceImages(m);
+    if (!resolved.ok)
+      return stopWith("failed", ["manifest"], `Nothing was changed: ${resolved.error}.`);
+    const images: Record<RollSlug, ReleaseImage> = resolved.images;
     const planned = await planAppRoll(
       {
         provider: meta.provider,
@@ -694,7 +700,10 @@ export async function recordUpdateEnd(
 }
 
 /** Every digest the revisions serving traffic are known by, per service. */
-async function servingDigests(deps: UpgraderJobDeps): Promise<
+async function servingDigests(
+  deps: UpgraderJobDeps,
+  provider: InstallMetadata["provider"],
+): Promise<
   | {
       ok: true;
       digests: ServingDigests;
@@ -705,8 +714,12 @@ async function servingDigests(deps: UpgraderJobDeps): Promise<
 > {
   const digests: Partial<Record<RollSlug, readonly string[]>> = {};
   const services: Partial<Record<RollSlug, string>> = {};
-  for (const slug of ["admin", "gateway"] as const) {
-    const prefix = `${gcpNamePrefix(deps.env)}-${slug}`;
+  if (provider !== "gcp" && provider !== "gcp-firebase") {
+    return { ok: false, error: `the upgrader runs on Google Cloud installs only, not ${provider}` };
+  }
+  for (const slug of ROLL_ORDER) {
+    // #1328 — which service plays which role differs per provider.
+    const prefix = cloudRunServicePrefix(provider, deps.env, slug);
     const service = await resolveGcpResourceName(
       deps.run,
       "run-service",
@@ -739,7 +752,7 @@ async function templateDigests(
   services: Readonly<Record<RollSlug, string>>,
 ): Promise<ServingDigests> {
   const out: Partial<Record<RollSlug, readonly string[]>> = {};
-  for (const slug of ["admin", "gateway"] as const) {
+  for (const slug of ROLL_ORDER) {
     const d = await findTemplateImageDigest(deps.run, deps.projectId, deps.region, services[slug]);
     out[slug] = d ? [d] : [];
   }

package/src/upgrader-records.test.ts

@@ -29,13 +29,21 @@ import {
 } from "./upgrader-records.js";
 
 const D = (c: string) => `sha256:${c.repeat(64)}`;
+// #1328 — the MCP-Auth-Proxy's index; serving revisions name it as is here,
+// so it matches without a registry lookup.
+const PROXY_INDEX = `sha256:${"e".repeat(64)}`;
 const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
 
 const V064: ReleaseManifest = {
   manifestVersion: 1,
   version: "0.10.64",
   channel: "stable",
-  digests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX, ops: D("c") },
+  digests: {
+    admin: ADMIN_INDEX,
+    gateway: GATEWAY_INDEX,
+    ops: D("c"),
+    "mcp-auth-proxy": PROXY_INDEX,
+  },
   minFromVersion: "0.10.0",
   infraContractVersion: 13,
   migrations: { contract: false, lastContractVersion: null, head: "0338_x" },
@@ -51,13 +59,17 @@ const META: InstallMetadata = {
   ownerEmail: "owner@acme.com",
   region: "europe-west1",
   createdAt: "2026-01-01T00:00:00Z",
-  imageDigests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX },
+  imageDigests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX, "mcp-auth-proxy": PROXY_INDEX },
   releaseVersion: "0.10.64",
   infraContractVersion: 13,
 };
 
 /** What the serving revisions read back as on searchviu-website (spec = status). */
-const LIVE_SERVING: ServingDigests = { admin: [ADMIN_AMD64], gateway: [GATEWAY_AMD64] };
+const LIVE_SERVING: ServingDigests = {
+  admin: [ADMIN_AMD64],
+  gateway: [GATEWAY_AMD64],
+  "mcp-auth-proxy": [PROXY_INDEX],
+};
 
 function deps(
   opts: {
@@ -112,16 +124,38 @@ describe("recordMatchesServing", () => {
     const both = { ...META, platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 } };
     expect(recordMatchesServing(both, LIVE_SERVING)).toBe(true);
     // Still by the index when a revision names it.
-    expect(recordMatchesServing(META, { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX] })).toBe(
-      true,
-    );
+    expect(
+      recordMatchesServing(META, {
+        admin: [ADMIN_INDEX],
+        gateway: [GATEWAY_INDEX],
+        "mcp-auth-proxy": [PROXY_INDEX],
+      }),
+    ).toBe(true);
   });
 
   it("both services must match, and no record never matches", () => {
     const both = { ...META, platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 } };
-    expect(recordMatchesServing(both, { admin: [ADMIN_AMD64], gateway: [D("6")] })).toBe(false);
+    expect(
+      recordMatchesServing(both, {
+        admin: [ADMIN_AMD64],
+        gateway: [D("6")],
+        "mcp-auth-proxy": [PROXY_INDEX],
+      }),
+    ).toBe(false);
     expect(recordMatchesServing({}, LIVE_SERVING)).toBe(false);
   });
+
+  it("#1328: an install.json from before the MCP-Auth-Proxy (no proxy digest) never matches", () => {
+    const { "mcp-auth-proxy": _none, ...old } = META.imageDigests as NonNullable<
+      InstallMetadata["imageDigests"]
+    >;
+    const both = {
+      ...META,
+      imageDigests: old,
+      platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 },
+    };
+    expect(recordMatchesServing(both, LIVE_SERVING)).toBe(false);
+  });
 });
 
 describe("findServingRelease", () => {
@@ -141,12 +175,12 @@ describe("findServingRelease", () => {
   it("an attestation manifest of the index is not a serving image of the release", async () => {
     const r = await findServingRelease(
       META,
-      { admin: [ADMIN_ATTESTATION], gateway: [GATEWAY_AMD64] },
+      { admin: [ADMIN_ATTESTATION], gateway: [GATEWAY_AMD64], "mcp-auth-proxy": [PROXY_INDEX] },
       deps(),
     );
     expect(r.ok).toBe(false);
     expect(r.ok ? "" : r.reason).toContain(
-      "The gateway serves v0.10.64's image, the admin does not.",
+      "The gateway and the MCP-Auth-Proxy serve v0.10.64's image, the admin does not.",
     );
   });
 
@@ -166,7 +200,11 @@ describe("findServingRelease", () => {
   });
 
   it("a digest in no signed index is still refused with the current message", async () => {
-    const r = await findServingRelease(META, { admin: [D("7")], gateway: [D("6")] }, deps());
+    const r = await findServingRelease(
+      META,
+      { admin: [D("7")], gateway: [D("6")], "mcp-auth-proxy": [PROXY_INDEX] },
+      deps(),
+    );
     expect(r).toMatchObject({ ok: false, retryable: false });
     expect(r.ok ? "" : r.reason).toContain(
       "are not the ones install.json names, and they do not belong to one signed Caelo release",
@@ -190,13 +228,60 @@ describe("findServingRelease", () => {
 
   it("finds the release by the template's index when install.json names none", async () => {
     const { releaseVersion: _none, ...unversioned } = META;
-    const meta = { ...unversioned, imageDigests: { admin: D("9"), gateway: D("8") } };
+    const meta = {
+      ...unversioned,
+      imageDigests: { admin: D("9"), gateway: D("8"), "mcp-auth-proxy": D("5") },
+    };
     const d = deps({
       tags: { admin: { "0.10.64": ADMIN_INDEX } },
-      hints: { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX] },
+      hints: { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX], "mcp-auth-proxy": [PROXY_INDEX] },
     });
     const r = await findServingRelease(meta, LIVE_SERVING, d);
     expect(r.ok && r.manifest.version).toBe("0.10.64");
     expect(d.fetched).toEqual(["0.10.64"]);
   });
 });
+
+describe("findServingRelease — the MCP-Auth-Proxy (#1328)", () => {
+  it("records the proxy's signed platform form with the others", async () => {
+    const PROXY_AMD64 = `sha256:${"f".repeat(64)}`;
+    const signed: ReleaseManifest = {
+      ...V064,
+      platformDigests: {
+        admin: ADMIN_AMD64,
+        gateway: GATEWAY_AMD64,
+        ops: D("3"),
+        "mcp-auth-proxy": PROXY_AMD64,
+      },
+    };
+    const r = await findServingRelease(
+      META,
+      { ...LIVE_SERVING, "mcp-auth-proxy": [PROXY_AMD64] },
+      deps({ manifests: { "0.10.64": signed } }),
+    );
+    expect(r).toMatchObject({
+      ok: true,
+      platformDigests: {
+        admin: ADMIN_AMD64,
+        gateway: GATEWAY_AMD64,
+        "mcp-auth-proxy": PROXY_AMD64,
+      },
+    });
+  });
+
+  it("a release from before the proxy cannot be what serves (its manifest names no proxy)", async () => {
+    const { "mcp-auth-proxy": _none, ...digests } = V064.digests;
+    const old: ReleaseManifest = { ...V064, digests };
+    const r = await findServingRelease(META, LIVE_SERVING, deps({ manifests: { "0.10.64": old } }));
+    expect(r.ok).toBe(false);
+  });
+
+  it("a proxy of another release is refused", async () => {
+    const r = await findServingRelease(
+      META,
+      { ...LIVE_SERVING, "mcp-auth-proxy": [D("4")] },
+      deps(),
+    );
+    expect(r.ok).toBe(false);
+  });
+});

package/src/upgrader-records.ts

@@ -30,14 +30,16 @@
 import type { GcloudRunner } from "./gcloud-retry.js";
 import type { ImageDigests, InstallMetadata } from "./install-state.js";
 import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
-import type { RollSlug } from "./upgrade/app-roll.js";
+import { ROLL_ORDER, type RollSlug } from "./upgrade/app-roll.js";
 import type { ReleaseImageForms } from "./upgrade/image-forms.js";
 import { releaseVersionForDigest } from "./upgrade/release-images.js";
 
 /** Every digest each serving image is known by (gcp-lookup.ts servingImageDigests). */
 export type ServingDigests = Readonly<Record<RollSlug, readonly string[]>>;
 
-const SLUGS: readonly RollSlug[] = ["admin", "gateway"];
+// #1328 — the MCP-Auth-Proxy serves on every install this code runs on (the
+// upgrader runs only on installs converged to its contract).
+const SLUGS: readonly RollSlug[] = ROLL_ORDER;
 
 /**
  * Whether install.json names the images that serve: per service, the
@@ -50,11 +52,14 @@ export function recordMatchesServing(
 ): boolean {
   const { imageDigests, platformDigests } = recorded;
   if (!imageDigests) return false;
-  return SLUGS.every(
-    (slug) =>
-      serving[slug].includes(imageDigests[slug]) ||
-      (platformDigests !== undefined && serving[slug].includes(platformDigests[slug])),
-  );
+  return SLUGS.every((slug) => {
+    const index = imageDigests[slug];
+    const platform = platformDigests?.[slug];
+    return (
+      (index !== undefined && serving[slug].includes(index)) ||
+      (platform !== undefined && serving[slug].includes(platform))
+    );
+  });
 }
 
 /** What {@link findServingRelease} learned. */
@@ -139,7 +144,7 @@ export async function findServingRelease(
     if (judged.matching.length > 0) {
       const other = SLUGS.filter((s) => !judged.matching.includes(s));
       partial.push(
-        `the ${judged.matching.join(", ")} serves v${m.version}'s image, the ${other.join(", ")} does not`,
+        `${serviceList(judged.matching)} ${judged.matching.length > 1 ? "serve" : "serves"} v${m.version}'s image, ${serviceList(other)} ${other.length > 1 ? "do" : "does"} not`,
       );
     }
   }
@@ -162,7 +167,7 @@ export async function findServingRelease(
       ...(unverified.length > 0
         ? [`These release records could not be verified: ${unverified.join("; ")}.`]
         : []),
-      "Nothing was changed. Check who deployed these images (the Cloud Run revision history of both services); an upgrade with Cloud Shell puts a signed release back.",
+      "Nothing was changed. Check who deployed these images (the Cloud Run revision history of the services); an upgrade with Cloud Shell puts a signed release back.",
     ].join(" "),
   };
 }
@@ -189,7 +194,10 @@ async function judgeRelease(
   const matching: RollSlug[] = [];
   const platform: Partial<Record<RollSlug, string>> = {};
   for (const slug of SLUGS) {
-    if (serving[slug].includes(m.digests[slug])) {
+    const index = m.digests[slug];
+    // #1328 — a release from before the proxy cannot be what serves here.
+    if (!index) continue;
+    if (serving[slug].includes(index)) {
       matching.push(slug);
       const signed = m.platformDigests?.[slug];
       if (signed) platform[slug] = signed;
@@ -205,10 +213,12 @@ async function judgeRelease(
     }
   }
   const { admin, gateway } = platform;
+  const proxy = platform["mcp-auth-proxy"];
   return {
     kind: "judged",
     matching,
-    platformDigests: admin && gateway ? { admin, gateway } : null,
+    platformDigests:
+      admin && gateway ? { admin, gateway, ...(proxy ? { "mcp-auth-proxy": proxy } : {}) } : null,
   };
 }
 
@@ -245,3 +255,10 @@ async function* candidateVersions(
 function capitalize(s: string): string {
   return s.charAt(0).toUpperCase() + s.slice(1);
 }
+
+/** `the admin`, `the gateway and the MCP-Auth-Proxy`, … for the refusal text. */
+function serviceList(slugs: readonly RollSlug[]): string {
+  const names = slugs.map((s) => (s === "mcp-auth-proxy" ? "the MCP-Auth-Proxy" : `the ${s}`));
+  if (names.length <= 1) return names[0] ?? "";
+  return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}

package/src/upgrader-setup.test.ts

@@ -81,6 +81,8 @@ describe("ensureUpgraderJob", () => {
         "projects add-iam-policy-binding acme → projects/acme/roles/caeloUpgraderSqlBackup",
         "iam service-accounts add-iam-policy-binding caelo-production-run-sa@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-production-gateway-sa@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
+        // #1328 — the MCP-Auth-Proxy's revisions run as its own account.
+        "iam service-accounts add-iam-policy-binding caelo-production-mcp-proxy-sa@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-production-upgrader@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-mcp@acme.iam.gserviceaccount.com → roles/iam.serviceAccountTokenCreator",
         "iam service-accounts add-iam-policy-binding caelo-production-audit@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",

package/src/upgrader-setup.ts

@@ -27,11 +27,11 @@
  *     PULUMI_*) and so act as the provisioner (#883 review). The custom role
  *     has no `runWithOverrides` and no `*.setIamPolicy`. Updating another
  *     job (the converge job's image, say) additionally needs `actAs` on its
- *     service account, which the upgrader holds only on the admin, gateway
- *     and its own. A grant of `roles/run.developer` left by an earlier
+ *     service account, which the upgrader holds only on the admin, gateway,
+ *     MCP-Auth-Proxy and its own. A grant of `roles/run.developer` left by an earlier
  *     setup is removed.
- *   - `roles/iam.serviceAccountUser` on exactly the admin's and the
- *     gateway's runtime service accounts (a revision runs as them), on
+ *   - `roles/iam.serviceAccountUser` on exactly the admin's, the
+ *     gateway's and the MCP-Auth-Proxy's (#1328) runtime service accounts (a revision runs as them), on
  *     itself (its own job) and on the quality-audit and capture jobs'
  *     accounts (the app-roll moves those jobs' images, #875, #1217) — not
  *     on the project.
@@ -79,6 +79,7 @@ import {
   auditServiceAccountEmail,
   captureServiceAccountEmail,
   gatewayServiceAccountEmail,
+  mcpAuthProxyServiceAccountEmail,
   mcpIapServiceAccountEmail,
   runServiceAccountEmail,
   upgraderJobName,
@@ -367,6 +368,11 @@ export async function ensureUpgraderJob(
       role: "roles/iam.serviceAccountUser",
       why: "gateway revisions run as it",
     },
+    {
+      account: mcpAuthProxyServiceAccountEmail(projectId, env),
+      role: "roles/iam.serviceAccountUser",
+      why: "MCP-Auth-Proxy revisions run as it (#1328)",
+    },
     { account: sa, role: "roles/iam.serviceAccountUser", why: "the job updates its own image" },
     {
       account: auditServiceAccountEmail(projectId, env),

package/src/wizard.ts

@@ -72,6 +72,13 @@ export interface WizardOptions {
    * install a different value is refused.
    */
   region?: string;
+  /**
+   * #1140 — `--scheduler-interval-minutes` (1–15, already validated): how
+   * often the scheduler tick calls the admin. Recorded in install.json, so
+   * every later `upgrade` keeps it; omitted keeps what is recorded (or the
+   * default, 5).
+   */
+  schedulerIntervalMinutes?: number;
   /**
    * #696 — where `pulumi up` and the rest of a GCP install run
    * (run-mode.ts): `job` (default in Cloud Shell) or `local`.
@@ -192,6 +199,18 @@ export async function runWizard(opts: WizardOptions = {}): Promise<void> {
     }
   }
 
+  // #1140 — the scheduler knob, on a new install and on a resumed one alike
+  // (every later `upgrade` reads it from install.json).
+  if (opts.schedulerIntervalMinutes !== undefined) {
+    const recorded = readMetadata(installId);
+    if (recorded) {
+      writeMetadata(installId, {
+        ...recorded,
+        schedulerIntervalMinutes: opts.schedulerIntervalMinutes,
+      });
+    }
+  }
+
   // 3.5. #656 — a re-run of an install an earlier CLI set up: drop the
   // secrets that CLI checkpointed (database passwords, the setup link)
   // before any step writes progress.json again, and say what to rotate.

package/src/wizards/gcp-cost.test.ts

@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1328 — the pre-flight cost table shows the MCP-Auth-Proxy on both GCP
+ * variants, its own Cloud Armor policy on `gcp`, and the gcp-firebase data
+ * gateway (CLAUDE.md §11.C: every billable resource has a cost line).
+ */
+
+import { describe, expect, it } from "bun:test";
+import { SERVICE_CPU_IDLE } from "../stack-contract.js";
+import {
+  adminKeptWarmByTicks,
+  alwaysOnAdminInstanceUsd,
+  type CostEstimateInputs,
+  estimateGcpCost,
+  schedulerTickMonthlyUsd,
+} from "./gcp-cost.js";
+
+const inputs: CostEstimateInputs = {
+  cloudSqlTier: "db-f1-micro",
+  cloudSqlHa: false,
+  adminMinInstances: 0,
+  gatewayMinInstances: 0,
+  wafAdaptiveProtection: false,
+  region: "europe-west1",
+};
+
+function names(provider: "gcp" | "gcp-firebase"): string[] {
+  return estimateGcpCost({ ...inputs, provider }).lines.map((l) => l.name);
+}
+
+describe("cost table: MCP-Auth-Proxy (#1328)", () => {
+  it("lists the proxy's Cloud Run service at $0 idle on both variants", () => {
+    for (const provider of ["gcp", "gcp-firebase"] as const) {
+      const line = estimateGcpCost({ ...inputs, provider }).lines.find(
+        (l) => l.name === "Cloud Run MCP-Auth-Proxy",
+      );
+      expect(line?.monthlyUsd).toBe(0);
+      expect(line?.notes).toContain("scale-to-zero");
+    }
+  });
+
+  it("prices the proxy's own Cloud Armor policy on gcp only (policy + 2 rules)", () => {
+    const gcp = estimateGcpCost({ ...inputs, provider: "gcp" }).lines.find((l) =>
+      l.name.startsWith("MCP-Auth-Proxy backend"),
+    );
+    expect(gcp?.monthlyUsd).toBe(7);
+    expect(names("gcp-firebase").some((n) => n.startsWith("MCP-Auth-Proxy backend"))).toBe(false);
+    // The throttle moved off the gateway's policy: no separate rule line.
+    expect(names("gcp")).not.toContain("Cloud Armor rule: remote MCP throttle");
+  });
+
+  it("names the gcp-firebase visitor gateway as the data gateway", () => {
+    expect(names("gcp-firebase")).toContain("Cloud Run data gateway");
+    expect(names("gcp")).toContain("Cloud Run gateway");
+  });
+});
+
+describe("cost table: scheduler tick (#1140)", () => {
+  it("lists the tick at the default 5 minutes: well under a dollar", () => {
+    const line = estimateGcpCost(inputs).lines.find((l) => l.name.startsWith("Scheduler tick"));
+    expect(line?.name).toBe("Scheduler tick (Cloud Scheduler + Workflows, every 5 min)");
+    // 8,640 ticks: 25,920 internal steps (20,920 billed) + 8,640 external
+    // (6,640 billed) + the scheduler job.
+    expect(line?.monthlyUsd).toBe(0.48);
+  });
+
+  it("follows the knob: one minute stays a few dollars, fifteen little more than the job", () => {
+    expect(schedulerTickMonthlyUsd(1)).toBe(2.38);
+    expect(schedulerTickMonthlyUsd(15)).toBe(0.16);
+    const fast = estimateGcpCost({ ...inputs, schedulerIntervalMinutes: 1 }).lines.find((l) =>
+      l.name.startsWith("Scheduler tick"),
+    );
+    expect(fast?.name).toContain("every 1 min");
+  });
+
+  it("prices the admin kept up around the clock while its CPU is always allocated (#1361)", () => {
+    // The tick (at most every 15 minutes) beats Cloud Run's 15-minute idle
+    // shutdown, so a scale-to-zero admin never stops.
+    expect(SERVICE_CPU_IDLE.admin).toBe(false);
+    expect(adminKeptWarmByTicks(0)).toBe(true);
+    // 2,592,000 s x (1 vCPU x $0.000018 + 2 GiB x $0.000002).
+    expect(alwaysOnAdminInstanceUsd(2)).toBe(57);
+    const admin = estimateGcpCost(inputs).lines.find((l) => l.name.startsWith("Cloud Run admin"));
+    expect(admin?.monthlyUsd).toBe(57);
+    expect(admin?.notes).toContain("around the clock");
+    expect(admin?.notes).toContain("#1361");
+  });
+
+  it("adds nothing on the admin with a min instance, which is up anyway", () => {
+    expect(adminKeptWarmByTicks(1)).toBe(false);
+    const admin = estimateGcpCost({ ...inputs, adminMinInstances: 1 }).lines.find((l) =>
+      l.name.startsWith("Cloud Run admin"),
+    );
+    expect(admin?.notes).toContain("the scheduler tick adds nothing");
+  });
+
+  it("refuses an interval outside 1-15 minutes", () => {
+    expect(() => estimateGcpCost({ ...inputs, schedulerIntervalMinutes: 20 })).toThrow(
+      "between 1 and 15",
+    );
+  });
+});