@causa/workspace-google 0.18.0-beta.2 → 0.18.0-beta.4

package/dist/functions/event-topic/index.d.ts

@@ -2,9 +2,11 @@ export { EventTopicBrokerCreateTopicForPubSub } from './broker-create-topic-pubs
 export { EventTopicBrokerCreateTriggerForCloudRun } from './broker-create-trigger-cloud-run.js';
 export { EventTopicBrokerDeleteTopicForPubSub } from './broker-delete-topic-pubsub.js';
 export { EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole } from './broker-delete-trigger-resource-cloud-run-invoker-role.js';
+export { EventTopicBrokerDeleteTriggerResourceForCloudRunService } from './broker-delete-trigger-resource-cloud-run-service.js';
 export { EventTopicBrokerDeleteTriggerResourceForPubSubSubscription } from './broker-delete-trigger-resource-pubsub-subscription.js';
 export { EventTopicBrokerDeleteTriggerResourceForServiceAccount } from './broker-delete-trigger-resource-service-account.js';
 export { EventTopicBrokerGetTopicIdForPubSub } from './broker-get-topic-id-pubsub.js';
 export { EventTopicBrokerPublishEventsForGoogle } from './broker-publish-events-google.js';
+export { EventTopicBrokerWaitForProcessingForPubSub } from './broker-wait-for-processing-pubsub.js';
 export { EventTopicCreateBackfillSourceForBigQuery } from './create-backfill-source-bigquery.js';
 export { EventTopicQueryEventsForBigQuery } from './query-events-bigquery.js';

package/dist/functions/event-topic/index.js

@@ -2,9 +2,11 @@ export { EventTopicBrokerCreateTopicForPubSub } from './broker-create-topic-pubs
 export { EventTopicBrokerCreateTriggerForCloudRun } from './broker-create-trigger-cloud-run.js';
 export { EventTopicBrokerDeleteTopicForPubSub } from './broker-delete-topic-pubsub.js';
 export { EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole } from './broker-delete-trigger-resource-cloud-run-invoker-role.js';
+export { EventTopicBrokerDeleteTriggerResourceForCloudRunService } from './broker-delete-trigger-resource-cloud-run-service.js';
 export { EventTopicBrokerDeleteTriggerResourceForPubSubSubscription } from './broker-delete-trigger-resource-pubsub-subscription.js';
 export { EventTopicBrokerDeleteTriggerResourceForServiceAccount } from './broker-delete-trigger-resource-service-account.js';
 export { EventTopicBrokerGetTopicIdForPubSub } from './broker-get-topic-id-pubsub.js';
 export { EventTopicBrokerPublishEventsForGoogle } from './broker-publish-events-google.js';
+export { EventTopicBrokerWaitForProcessingForPubSub } from './broker-wait-for-processing-pubsub.js';
 export { EventTopicCreateBackfillSourceForBigQuery } from './create-backfill-source-bigquery.js';
 export { EventTopicQueryEventsForBigQuery } from './query-events-bigquery.js';

package/dist/functions/index.js

@@ -1,6 +1,6 @@
 import { CausaListConfigurationSchemasForGoogle } from './causa/index.js';
 import { EmulatorStartForFirebaseStorage, EmulatorStartForFirestore, EmulatorStartForIdentityPlatform, EmulatorStartForPubSub, EmulatorStartForSpanner, EmulatorStopForFirebaseStorage, EmulatorStopForFirestore, EmulatorStopForIdentityPlatform, EmulatorStopForPubSub, EmulatorStopForSpanner, } from './emulator/index.js';
-import { EventTopicBrokerCreateTopicForPubSub, EventTopicBrokerCreateTriggerForCloudRun, EventTopicBrokerDeleteTopicForPubSub, EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole, EventTopicBrokerDeleteTriggerResourceForPubSubSubscription, EventTopicBrokerDeleteTriggerResourceForServiceAccount, EventTopicBrokerGetTopicIdForPubSub, EventTopicBrokerPublishEventsForGoogle, EventTopicCreateBackfillSourceForBigQuery, EventTopicQueryEventsForBigQuery, } from './event-topic/index.js';
+import { EventTopicBrokerCreateTopicForPubSub, EventTopicBrokerCreateTriggerForCloudRun, EventTopicBrokerDeleteTopicForPubSub, EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole, EventTopicBrokerDeleteTriggerResourceForCloudRunService, EventTopicBrokerDeleteTriggerResourceForPubSubSubscription, EventTopicBrokerDeleteTriggerResourceForServiceAccount, EventTopicBrokerGetTopicIdForPubSub, EventTopicBrokerPublishEventsForGoogle, EventTopicBrokerWaitForProcessingForPubSub, EventTopicCreateBackfillSourceForBigQuery, EventTopicQueryEventsForBigQuery, } from './event-topic/index.js';
 import { GoogleAppCheckGenerateToken } from './google-app-check/index.js';
 import { GoogleFirebaseStorageMergeRules } from './google-firebase-storage/index.js';
 import { DatabaseQueryRecordsForFirestore, GoogleFirestoreMergeRules, ModelGenerateTypeScriptDecoratorsForGoogleFirestore, ModelSchemaExtractDatabaseForGoogleFirestore, } from './google-firestore/index.js';
@@ -12,5 +12,5 @@ import { ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDesti
 import { SecretFetchForGoogleAccessToken, SecretFetchForGoogleSecretManager, } from './secret/index.js';
 import { ServiceContainerQueryLogsForCloudRun } from './service-container/index.js';
 export function registerFunctions(context) {
-    context.registerFunctionImplementations(CausaListConfigurationSchemasForGoogle, DatabaseQueryRecordsForFirestore, DatabaseQueryRecordsForSpanner, EmulatorStartForFirebaseStorage, EmulatorStartForFirestore, EmulatorStartForIdentityPlatform, EmulatorStartForPubSub, EmulatorStartForSpanner, EmulatorStopForFirebaseStorage, EmulatorStopForFirestore, EmulatorStopForIdentityPlatform, EmulatorStopForPubSub, EmulatorStopForSpanner, EventTopicBrokerCreateTopicForPubSub, EventTopicBrokerCreateTriggerForCloudRun, EventTopicBrokerDeleteTopicForPubSub, EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole, EventTopicBrokerDeleteTriggerResourceForPubSubSubscription, EventTopicBrokerDeleteTriggerResourceForServiceAccount, EventTopicBrokerGetTopicIdForPubSub, EventTopicBrokerPublishEventsForGoogle, EventTopicCreateBackfillSourceForBigQuery, EventTopicQueryEventsForBigQuery, GoogleAppCheckGenerateToken, GoogleFirebaseStorageMergeRules, GoogleFirestoreMergeRules, GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenerateToken, GooglePubSubWriteTopics, GoogleServicesEnable, GoogleSpannerListDatabases, GoogleSpannerWriteDatabases, ModelGenerateTypeScriptDecoratorsForGoogleFirestore, ModelGenerateTypeScriptDecoratorsForGoogleSpanner, ModelSchemaExtractDatabaseForGoogleFirestore, ModelSchemaExtractDatabaseForGoogleSpanner, ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, SecretFetchForGoogleAccessToken, SecretFetchForGoogleSecretManager, ServiceContainerQueryLogsForCloudRun);
+    context.registerFunctionImplementations(CausaListConfigurationSchemasForGoogle, DatabaseQueryRecordsForFirestore, DatabaseQueryRecordsForSpanner, EmulatorStartForFirebaseStorage, EmulatorStartForFirestore, EmulatorStartForIdentityPlatform, EmulatorStartForPubSub, EmulatorStartForSpanner, EmulatorStopForFirebaseStorage, EmulatorStopForFirestore, EmulatorStopForIdentityPlatform, EmulatorStopForPubSub, EmulatorStopForSpanner, EventTopicBrokerCreateTopicForPubSub, EventTopicBrokerCreateTriggerForCloudRun, EventTopicBrokerDeleteTopicForPubSub, EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole, EventTopicBrokerDeleteTriggerResourceForCloudRunService, EventTopicBrokerDeleteTriggerResourceForPubSubSubscription, EventTopicBrokerDeleteTriggerResourceForServiceAccount, EventTopicBrokerGetTopicIdForPubSub, EventTopicBrokerPublishEventsForGoogle, EventTopicBrokerWaitForProcessingForPubSub, EventTopicCreateBackfillSourceForBigQuery, EventTopicQueryEventsForBigQuery, GoogleAppCheckGenerateToken, GoogleFirebaseStorageMergeRules, GoogleFirestoreMergeRules, GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenerateToken, GooglePubSubWriteTopics, GoogleServicesEnable, GoogleSpannerListDatabases, GoogleSpannerWriteDatabases, ModelGenerateTypeScriptDecoratorsForGoogleFirestore, ModelGenerateTypeScriptDecoratorsForGoogleSpanner, ModelSchemaExtractDatabaseForGoogleFirestore, ModelSchemaExtractDatabaseForGoogleSpanner, ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, SecretFetchForGoogleAccessToken, SecretFetchForGoogleSecretManager, ServiceContainerQueryLogsForCloudRun);
 }

package/dist/services/cloud-monitoring.d.ts

@@ -0,0 +1,44 @@
+import { WorkspaceContext } from '@causa/workspace';
+import { MetricServiceClient } from '@google-cloud/monitoring';
+/**
+ * A single metric point with its server-side end timestamp (as milliseconds since epoch) and numeric value.
+ */
+export type MetricPoint = {
+    /**
+     * The end timestamp of the point's interval, as milliseconds since epoch.
+     */
+    readonly timestamp: number;
+    /**
+     * The numeric value of the point.
+     */
+    readonly value: number;
+};
+/**
+ * A service exposing a thin wrapper around the Cloud Monitoring API.
+ */
+export declare class CloudMonitoringService {
+    /**
+     * The underlying Cloud Monitoring client.
+     */
+    readonly client: MetricServiceClient;
+    /**
+     * The ID of the GCP project from which metrics are read.
+     */
+    readonly projectId: string;
+    constructor(context: WorkspaceContext);
+    /**
+     * Fetches the data points for a single time series over the given time interval.
+     * Returns the points sorted in ascending timestamp order. Each point's timestamp is the end of the corresponding
+     * interval, in milliseconds since epoch. An empty array is returned when no series matches the filter.
+     *
+     * @param filter The Cloud Monitoring metric filter expression (e.g. `metric.type = "..."`).
+     * @param start The inclusive lower bound of the interval to fetch.
+     * @param end The exclusive upper bound of the interval to fetch.
+     * @param options Optional aggregation options.
+     * @returns The list of points, ordered by ascending timestamp.
+     */
+    listPoints(filter: string, start: Date, end: Date, options?: {
+        readonly alignmentPeriod?: number;
+        readonly aligner?: 'ALIGN_NONE' | 'ALIGN_DELTA' | 'ALIGN_RATE' | 'ALIGN_MEAN' | 'ALIGN_MAX';
+    }): Promise<MetricPoint[]>;
+}

package/dist/services/cloud-monitoring.js

@@ -0,0 +1,61 @@
+import { WorkspaceContext } from '@causa/workspace';
+import { MetricServiceClient } from '@google-cloud/monitoring';
+/**
+ * A service exposing a thin wrapper around the Cloud Monitoring API.
+ */
+export class CloudMonitoringService {
+    /**
+     * The underlying Cloud Monitoring client.
+     */
+    client;
+    /**
+     * The ID of the GCP project from which metrics are read.
+     */
+    projectId;
+    constructor(context) {
+        this.projectId = context
+            .asConfiguration()
+            .getOrThrow('google.project');
+        this.client = new MetricServiceClient();
+    }
+    /**
+     * Fetches the data points for a single time series over the given time interval.
+     * Returns the points sorted in ascending timestamp order. Each point's timestamp is the end of the corresponding
+     * interval, in milliseconds since epoch. An empty array is returned when no series matches the filter.
+     *
+     * @param filter The Cloud Monitoring metric filter expression (e.g. `metric.type = "..."`).
+     * @param start The inclusive lower bound of the interval to fetch.
+     * @param end The exclusive upper bound of the interval to fetch.
+     * @param options Optional aggregation options.
+     * @returns The list of points, ordered by ascending timestamp.
+     */
+    async listPoints(filter, start, end, options = {}) {
+        const aggregation = options.aligner && options.alignmentPeriod
+            ? {
+                alignmentPeriod: { seconds: options.alignmentPeriod },
+                perSeriesAligner: options.aligner,
+            }
+            : undefined;
+        const [series] = await this.client.listTimeSeries({
+            name: `projects/${this.projectId}`,
+            filter,
+            interval: {
+                startTime: { seconds: Math.floor(start.getTime() / 1000) },
+                endTime: { seconds: Math.floor(end.getTime() / 1000) },
+            },
+            aggregation,
+        });
+        return (series.at(0)?.points ?? [])
+            .map(({ interval, value: rawValue }) => {
+            const endSeconds = Number(interval?.endTime?.seconds ?? 0);
+            const endNanos = interval?.endTime?.nanos ?? 0;
+            const timestamp = endSeconds * 1000 + Math.floor(endNanos / 1e6);
+            const value = Number(rawValue?.int64Value ??
+                rawValue?.doubleValue ??
+                rawValue?.distributionValue?.count ??
+                0);
+            return { timestamp, value };
+        })
+            .sort((a, b) => a.timestamp - b.timestamp);
+    }
+}

package/dist/services/cloud-run-pubsub-trigger.d.ts

@@ -1,4 +1,5 @@
 import { WorkspaceContext } from '@causa/workspace';
+import { type CloudRunServiceOverrides } from './cloud-run.js';
 /**
  * A service that manages (creates) Pub/Sub triggers pointing to Cloud Run services.
  * This is used for backfilling operations. The reason it is a service is to persist temporary service accounts and IAM
@@ -82,6 +83,15 @@ export declare class CloudRunPubSubTriggerService {
      *   as part of the backfill cleaning.
      */
     private createSubscription;
+    /**
+     * Creates a temporary copy of a Cloud Run service to receive backfill traffic in isolation.
+     *
+     * @param backfillId The ID of the backfilling operation.
+     * @param sourceService The ID of the Cloud Run service to copy.
+     * @param overrides The overrides to apply to the copy.
+     * @returns The ID of the created service copy.
+     */
+    private createServiceCopy;
     /**
      * Creates a Pub/Sub trigger (push subscription) pointing to a Cloud Run service.
      * This requires several resources, such as:
@@ -90,12 +100,23 @@ export declare class CloudRunPubSubTriggerService {
      * - A Pub/Sub subscription that will push messages to the Cloud Run service.
      * The IDs of these resources are returned, and should be deleted as part of the backfill cleaning.
      *
+     * When `options.clone` is set, a temporary copy of the Cloud Run service is created and used as the trigger target
+     * instead of the live service. This isolates the backfill load (in particular its scaling) from production. The copy
+     * is added to the list of resources to clean up. The invoker IAM binding is not tracked separately because deleting
+     * the service removes it.
+     *
      * @param backfillId The ID of the backfilling operation.
      * @param topicId The ID of the Pub/Sub topic to subscribe to.
      * @param serviceId The ID of the Cloud Run service to invoke.
      * @param path The HTTP endpoint of the Cloud Run service to invoke.
+     * @param options Options for the trigger creation.
      * @returns The IDs of the resources that were created. They should be added to the list of resources to delete as
      *   part of the backfill cleaning.
      */
-    create(backfillId: string, topicId: string, serviceId: string, path: string): Promise<string[]>;
+    create(backfillId: string, topicId: string, serviceId: string, path: string, options?: {
+        /**
+         * When set, a temporary copy of the service is created with these overrides and used as the trigger target.
+         */
+        clone?: CloudRunServiceOverrides;
+    }): Promise<string[]>;
 }

package/dist/services/cloud-run-pubsub-trigger.js

@@ -3,7 +3,7 @@ import { EventTopicTriggerCreationError } from '@causa/workspace-core';
 import { Subscription } from '@google-cloud/pubsub';
 import { randomBytes } from 'crypto';
 import { grpc } from 'google-gax';
-import { CloudRunService } from './cloud-run.js';
+import { CloudRunService, IngressTraffic, shortServiceId, } from './cloud-run.js';
 import { IamService } from './iam.js';
 import { PubSubService } from './pubsub.js';
 /**
@@ -143,6 +143,32 @@ export class CloudRunPubSubTriggerService {
         });
         return subscriptionId;
     }
+    /**
+     * Creates a temporary copy of a Cloud Run service to receive backfill traffic in isolation.
+     *
+     * @param backfillId The ID of the backfilling operation.
+     * @param sourceService The ID of the Cloud Run service to copy.
+     * @param overrides The overrides to apply to the copy.
+     * @returns The ID of the created service copy.
+     */
+    async createServiceCopy(backfillId, sourceService, overrides) {
+        const sourceName = shortServiceId(sourceService);
+        const suffix = randomBytes(3).toString('hex');
+        const maxSourceNameLength = 63 - `backfill-${backfillId}--${suffix}`.length;
+        const truncatedSourceName = sourceName
+            .slice(0, maxSourceNameLength)
+            .replace(/-+$/, '');
+        const name = `backfill-${backfillId}-${truncatedSourceName}-${suffix}`;
+        this.logger.info(`🚀 Creating temporary Cloud Run service '${name}' as a copy of '${sourceService}' for the backfill.`);
+        const service = await this.cloudRunService.copy(sourceService, name, {
+            overrides: {
+                ...overrides,
+                ingress: IngressTraffic.INGRESS_TRAFFIC_INTERNAL_ONLY,
+                labels: { 'causa-backfill-id': backfillId },
+            },
+        });
+        return service.name ?? '';
+    }
     /**
      * Creates a Pub/Sub trigger (push subscription) pointing to a Cloud Run service.
      * This requires several resources, such as:
@@ -151,26 +177,39 @@ export class CloudRunPubSubTriggerService {
      * - A Pub/Sub subscription that will push messages to the Cloud Run service.
      * The IDs of these resources are returned, and should be deleted as part of the backfill cleaning.
      *
+     * When `options.clone` is set, a temporary copy of the Cloud Run service is created and used as the trigger target
+     * instead of the live service. This isolates the backfill load (in particular its scaling) from production. The copy
+     * is added to the list of resources to clean up. The invoker IAM binding is not tracked separately because deleting
+     * the service removes it.
+     *
      * @param backfillId The ID of the backfilling operation.
      * @param topicId The ID of the Pub/Sub topic to subscribe to.
      * @param serviceId The ID of the Cloud Run service to invoke.
      * @param path The HTTP endpoint of the Cloud Run service to invoke.
+     * @param options Options for the trigger creation.
      * @returns The IDs of the resources that were created. They should be added to the list of resources to delete as
      *   part of the backfill cleaning.
      */
-    async create(backfillId, topicId, serviceId, path) {
+    async create(backfillId, topicId, serviceId, path, options = {}) {
+        const { clone } = options;
         const resourceIds = [];
         try {
+            let targetServiceId = serviceId;
+            if (clone) {
+                targetServiceId = await this.createServiceCopy(backfillId, serviceId, clone);
+                resourceIds.push(targetServiceId);
+            }
             const pubSubInvokerServiceAccount = await this.getBackfillInvokerServiceAccount(backfillId);
             if (pubSubInvokerServiceAccount.resourceId) {
                 resourceIds.push(pubSubInvokerServiceAccount.resourceId);
             }
             const { serviceAccountEmail } = pubSubInvokerServiceAccount;
-            const iamResourceId = await this.grantPubSubInvokerRole(serviceId, serviceAccountEmail);
-            if (iamResourceId) {
+            const iamResourceId = await this.grantPubSubInvokerRole(targetServiceId, serviceAccountEmail);
+            // For a temporary service copy, deleting the service removes the binding along with it.
+            if (iamResourceId && !clone) {
                 resourceIds.push(iamResourceId);
             }
-            const subscriptionId = await this.createSubscription(backfillId, topicId, serviceId, path, serviceAccountEmail);
+            const subscriptionId = await this.createSubscription(backfillId, topicId, targetServiceId, path, serviceAccountEmail);
             resourceIds.push(subscriptionId);
             return resourceIds;
         }

package/dist/services/cloud-run.d.ts

@@ -1,4 +1,34 @@
-import { ServicesClient } from '@google-cloud/run';
+import { ServicesClient, protos } from '@google-cloud/run';
+export { CLOUD_RUN_SERVICE_ID_REGEX, shortServiceId, } from './cloud-run.utils.js';
+/**
+ * The possible ingress settings for a Cloud Run service.
+ */
+export declare const IngressTraffic: typeof protos.google.cloud.run.v2.IngressTraffic;
+/**
+ * Overrides that can be applied to a Cloud Run service copy.
+ */
+export type CloudRunServiceOverrides = {
+    /**
+     * The minimum number of instances for the service.
+     */
+    minInstanceCount?: number;
+    /**
+     * The maximum number of instances for the service.
+     */
+    maxInstanceCount?: number;
+    /**
+     * The maximum number of concurrent requests per instance.
+     */
+    requestConcurrency?: number;
+    /**
+     * The ingress setting for the copy. Defaults to the source service's ingress when not set.
+     */
+    ingress?: protos.google.cloud.run.v2.IngressTraffic;
+    /**
+     * Labels to set on the copy, merged on top of the source service's labels.
+     */
+    labels?: Record<string, string>;
+};
 /**
  * A service to manage Cloud Run services.
  */
@@ -16,6 +46,31 @@ export declare class CloudRunService {
      * @returns The URI at which the service is available.
      */
     getServiceUri(serviceId: string): Promise<string>;
+    /**
+     * Creates a copy of an existing Cloud Run service.
+     * The copy reuses the source service's revision template (image, environment, runtime service account, etc.), ingress,
+     * and labels, unless overridden through the options.
+     *
+     * @param sourceService The ID of the Cloud Run service to copy.
+     *   This should be in the format `projects/<projectId>/locations/<location>/services/<name>`.
+     * @param name The name of the service copy to create.
+     * @param options Options for the copy.
+     * @returns The created service copy.
+     */
+    copy(sourceService: string, name: string, options?: {
+        /**
+         * Overrides to apply to the copy. Unset scaling properties are inherited from the source service.
+         */
+        overrides?: CloudRunServiceOverrides;
+    }): Promise<protos.google.cloud.run.v2.IService>;
+    /**
+     * Deletes a Cloud Run service.
+     * This tolerates the service not existing (e.g. when it was already deleted).
+     *
+     * @param name The ID of the Cloud Run service to delete.
+     *   This should be in the format `projects/<projectId>/locations/<location>/services/<name>`.
+     */
+    delete(name: string): Promise<void>;
     /**
      * Allows a service account to call a Cloud Run service by editing the IAM policy bindings.
      *

package/dist/services/cloud-run.js

@@ -1,5 +1,11 @@
-import { ServicesClient } from '@google-cloud/run';
+import { ServicesClient, protos } from '@google-cloud/run';
 import { grpc } from 'google-gax';
+import { CLOUD_RUN_SERVICE_ID_REGEX } from './cloud-run.utils.js';
+export { CLOUD_RUN_SERVICE_ID_REGEX, shortServiceId, } from './cloud-run.utils.js';
+/**
+ * The possible ingress settings for a Cloud Run service.
+ */
+export const IngressTraffic = protos.google.cloud.run.v2.IngressTraffic;
 /**
  * The role used to allow a service account to call a Cloud Run service.
  */
@@ -26,6 +32,70 @@ export class CloudRunService {
         const [service] = await this.servicesClient.getService({ name: serviceId });
         return service.uri ?? '';
     }
+    /**
+     * Creates a copy of an existing Cloud Run service.
+     * The copy reuses the source service's revision template (image, environment, runtime service account, etc.), ingress,
+     * and labels, unless overridden through the options.
+     *
+     * @param sourceService The ID of the Cloud Run service to copy.
+     *   This should be in the format `projects/<projectId>/locations/<location>/services/<name>`.
+     * @param name The name of the service copy to create.
+     * @param options Options for the copy.
+     * @returns The created service copy.
+     */
+    async copy(sourceService, name, options = {}) {
+        const match = sourceService.match(CLOUD_RUN_SERVICE_ID_REGEX);
+        if (!match?.groups) {
+            throw new Error(`Invalid Cloud Run service ID '${sourceService}'.`);
+        }
+        const { parent } = match.groups;
+        const [source] = await this.servicesClient.getService({
+            name: sourceService,
+        });
+        const { revision, ...template } = { ...source.template };
+        const { minInstanceCount, maxInstanceCount, requestConcurrency, ingress, labels, } = options.overrides ?? {};
+        if (minInstanceCount !== undefined || maxInstanceCount !== undefined) {
+            template.scaling = {
+                ...template.scaling,
+                ...(minInstanceCount !== undefined ? { minInstanceCount } : {}),
+                ...(maxInstanceCount !== undefined ? { maxInstanceCount } : {}),
+            };
+        }
+        if (requestConcurrency !== undefined) {
+            template.maxInstanceRequestConcurrency = requestConcurrency;
+        }
+        const service = {
+            template,
+            ingress: ingress ?? source.ingress,
+            labels: { ...source.labels, ...labels },
+        };
+        const [operation] = await this.servicesClient.createService({
+            parent,
+            serviceId: name,
+            service,
+        });
+        const [created] = await operation.promise();
+        return created;
+    }
+    /**
+     * Deletes a Cloud Run service.
+     * This tolerates the service not existing (e.g. when it was already deleted).
+     *
+     * @param name The ID of the Cloud Run service to delete.
+     *   This should be in the format `projects/<projectId>/locations/<location>/services/<name>`.
+     */
+    async delete(name) {
+        try {
+            const [operation] = await this.servicesClient.deleteService({ name });
+            await operation.promise();
+        }
+        catch (error) {
+            if (error.code === grpc.status.NOT_FOUND) {
+                return;
+            }
+            throw error;
+        }
+    }
     /**
      * Allows a service account to call a Cloud Run service by editing the IAM policy bindings.
      *

package/dist/services/cloud-run.utils.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The regular expression matching a Cloud Run service resource ID
+ * (e.g. `projects/<projectId>/locations/<location>/services/<name>`).
+ * The `parent` and `name` named groups respectively capture the parent location resource and the short service name.
+ */
+export declare const CLOUD_RUN_SERVICE_ID_REGEX: RegExp;
+/**
+ * Returns the short service ID (the last path segment) for a full service resource name.
+ */
+export declare function shortServiceId(id: string): string;

package/dist/services/cloud-run.utils.js

@@ -0,0 +1,12 @@
+/**
+ * The regular expression matching a Cloud Run service resource ID
+ * (e.g. `projects/<projectId>/locations/<location>/services/<name>`).
+ * The `parent` and `name` named groups respectively capture the parent location resource and the short service name.
+ */
+export const CLOUD_RUN_SERVICE_ID_REGEX = /^(?<parent>projects\/[\w-]+\/locations\/[\w-]+)\/services\/(?<name>[\w-]+)$/;
+/**
+ * Returns the short service ID (the last path segment) for a full service resource name.
+ */
+export function shortServiceId(id) {
+    return id.split('/').at(-1) ?? id;
+}

package/dist/services/google-apis.d.ts

@@ -1,7 +1,10 @@
 import { WorkspaceContext } from '@causa/workspace';
-import { AuthClient } from 'google-auth-library';
-import { GoogleApis } from 'googleapis';
+import { Common, GoogleApis } from 'googleapis';
 import type { ApiClient, OptionsOfApiClient } from './google-apis.types.js';
+/**
+ * The type of authentication client returned by `googleapis`.
+ */
+type AnyAuthClient = Awaited<ReturnType<Common.GoogleAuth['getClient']>>;
 /**
  * A service that exposes the lowest level of Google API clients, from `googleapis`.
  * Those might be needed in last resort, when no higher level client exists for an API.
@@ -21,7 +24,7 @@ export declare class GoogleApisService {
      *
      * @returns The auth client.
      */
-    getAuthClient(): Promise<AuthClient>;
+    getAuthClient(): Promise<AnyAuthClient>;
     /**
      * Creates a new client for one of Google's APIs.
      * Authentication is automatically configured.
@@ -33,3 +36,4 @@ export declare class GoogleApisService {
      */
     getClient<const T extends keyof GoogleApis, const V extends string>(api: T, version: V, arg: Omit<OptionsOfApiClient<T, V>, 'auth' | 'version'>): Promise<ApiClient<T, V>>;
 }
+export {};

package/dist/services/google-apis.js

@@ -1,6 +1,5 @@
 import { WorkspaceContext } from '@causa/workspace';
-import { AuthClient } from 'google-auth-library';
-import { GoogleApis, google } from 'googleapis';
+import { Common, GoogleApis, google } from 'googleapis';
 /**
  * A service that exposes the lowest level of Google API clients, from `googleapis`.
  * Those might be needed in last resort, when no higher level client exists for an API.

package/dist/services/index.d.ts

@@ -1,6 +1,7 @@
 export { BigQueryService } from './bigquery.js';
+export { CloudMonitoringService, type MetricPoint, } from './cloud-monitoring.js';
 export { CloudRunPubSubTriggerService } from './cloud-run-pubsub-trigger.js';
-export { CloudRunService } from './cloud-run.js';
+export { CLOUD_RUN_SERVICE_ID_REGEX, CloudRunService, IngressTraffic, shortServiceId, type CloudRunServiceOverrides, } from './cloud-run.js';
 export * from './firebase-app.errors.js';
 export { FirebaseAppService } from './firebase-app.js';
 export type { FirebaseAppType } from './firebase-app.js';
@@ -9,7 +10,7 @@ export { GcloudEmulatorService } from './gcloud-emulator.js';
 export { GoogleApisService } from './google-apis.js';
 export { IamService } from './iam.js';
 export { LoggingService } from './logging.js';
-export { PubSubService } from './pubsub.js';
+export { PUBSUB_SUBSCRIPTION_ID_REGEX, PubSubService, shortSubscriptionId, } from './pubsub.js';
 export { ResourceManagerService } from './resource-manager.js';
 export { GoogleSecretManagerService } from './secret-manager.js';
 export * from './storage.errors.js';

package/dist/services/index.js

@@ -1,6 +1,7 @@
 export { BigQueryService } from './bigquery.js';
+export { CloudMonitoringService, } from './cloud-monitoring.js';
 export { CloudRunPubSubTriggerService } from './cloud-run-pubsub-trigger.js';
-export { CloudRunService } from './cloud-run.js';
+export { CLOUD_RUN_SERVICE_ID_REGEX, CloudRunService, IngressTraffic, shortServiceId, } from './cloud-run.js';
 export * from './firebase-app.errors.js';
 export { FirebaseAppService } from './firebase-app.js';
 export { FirebaseEmulatorService } from './firebase-emulator.js';
@@ -8,7 +9,7 @@ export { GcloudEmulatorService } from './gcloud-emulator.js';
 export { GoogleApisService } from './google-apis.js';
 export { IamService } from './iam.js';
 export { LoggingService } from './logging.js';
-export { PubSubService } from './pubsub.js';
+export { PUBSUB_SUBSCRIPTION_ID_REGEX, PubSubService, shortSubscriptionId, } from './pubsub.js';
 export { ResourceManagerService } from './resource-manager.js';
 export { GoogleSecretManagerService } from './secret-manager.js';
 export * from './storage.errors.js';

package/dist/services/pubsub.d.ts

@@ -1,6 +1,7 @@
 import { WorkspaceContext } from '@causa/workspace';
 import { PubSub } from '@google-cloud/pubsub';
 import { iam_v1 } from 'googleapis';
+export { PUBSUB_SUBSCRIPTION_ID_REGEX, shortSubscriptionId, } from './pubsub.utils.js';
 /**
  * A service for managing Pub/Sub resources
  */

package/dist/services/pubsub.js

@@ -2,6 +2,7 @@ import { WorkspaceContext } from '@causa/workspace';
 import { PubSub } from '@google-cloud/pubsub';
 import { iam_v1 } from 'googleapis';
 import { ResourceManagerService } from './resource-manager.js';
+export { PUBSUB_SUBSCRIPTION_ID_REGEX, shortSubscriptionId, } from './pubsub.utils.js';
 /**
  * A service for managing Pub/Sub resources
  */

package/dist/services/pubsub.utils.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The regular expression matching a Pub/Sub subscription resource ID
+ * (e.g. `projects/<projectId>/subscriptions/<name>`).
+ */
+export declare const PUBSUB_SUBSCRIPTION_ID_REGEX: RegExp;
+/**
+ * Returns the short subscription ID (the last path segment) for a full subscription resource name.
+ */
+export declare function shortSubscriptionId(id: string): string;

package/dist/services/pubsub.utils.js

@@ -0,0 +1,11 @@
+/**
+ * The regular expression matching a Pub/Sub subscription resource ID
+ * (e.g. `projects/<projectId>/subscriptions/<name>`).
+ */
+export const PUBSUB_SUBSCRIPTION_ID_REGEX = /^projects\/[\w-]+\/subscriptions\/[\w-]+$/;
+/**
+ * Returns the short subscription ID (the last path segment) for a full subscription resource name.
+ */
+export function shortSubscriptionId(id) {
+    return id.split('/').at(-1) ?? id;
+}