@causa/workspace-google 1.3.0 → 1.4.0-beta.1

package/README.md

@@ -74,6 +74,15 @@ This module implements the `DatabaseQueryRecords`, `ServiceContainerQueryLogs`,
 - `ServiceContainerQueryLogs` is supported when `serviceContainer.platform` is `google.cloudRun`. It queries Cloud Logging for log entries emitted by the service's Cloud Run revisions. By default, only the last hour of logs and up to 1 000 entries are returned.
 - `EventTopicQueryEvents` is supported when `events.broker` is `google.pubSub`, `events.format` is `json`, and `google.pubSub.bigQueryStorage.rawEventsDatasetId` is set. It reads events from the topic's BigQuery raw events table. Same defaults as for log queries: last hour and up to 1 000 events.
 
+### Architecture graph
+
+This module contributes to the architecture graph extracted by `cs graph extract` (see the core module):
+
+- Some rules read the workspace configuration and model: the Firestore database and the collections schemas bind to (`firestoreFromConfiguration`), the triggers of type `google.pubSub` and the entities projects access through the databases and collections listed in `serviceContainer.outputs` (`googleServiceContainerFromConfiguration`), and the triggers of type `google.task(s)`.
+- Other rules mirror the resources created by the Causa Terraform modules for Google Cloud, one rule per module (Cloud Run services, event topics, Spanner databases, and API router), by joining the arguments of their blocks with the configuration the modules read. Each resource is linked by a `deploys` edge from the projects applying the block.
+
+Infrastructure nodes carry the Google Cloud resource they stand for in `data.resource`: its `type` (e.g. `pubsub.googleapis.com/Topic`), its `id`, i.e. its full resource name (or `idPrefix` when the full name is not known), and the `scope`, i.e. the project whose configuration should be used to render the identifier.
+
 ### Secrets backend
 
 This module implements the `google.secretManager` secret backend, allowing fetching secrets from the Google Secret Manager service. Here are some example of how secrets with the `google.secretManager` backend should be defined:

package/dist/configurations/generated.d.ts

@@ -70,9 +70,9 @@ export declare class GoogleCloudRunEventBackfillServiceCloneConfig {
  * See https://cloud.google.com/run/docs/securing/ingress#settings for more details.
  */
 export declare enum GoogleCloudRunIngress {
-    All = "all",
-    Internal = "internal",
-    InternalAndCloudLoadBalancing = "internal-and-cloud-load-balancing"
+    IngressTrafficAll = "INGRESS_TRAFFIC_ALL",
+    IngressTrafficInternalOnly = "INGRESS_TRAFFIC_INTERNAL_ONLY",
+    IngressTrafficInternalLoadBalancer = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"
 }
 /**
  * Google Cloud Run platform.

package/dist/configurations/generated.js

@@ -127,9 +127,9 @@ __decorate([
  */
 export var GoogleCloudRunIngress;
 (function (GoogleCloudRunIngress) {
-    GoogleCloudRunIngress["All"] = "all";
-    GoogleCloudRunIngress["Internal"] = "internal";
-    GoogleCloudRunIngress["InternalAndCloudLoadBalancing"] = "internal-and-cloud-load-balancing";
+    GoogleCloudRunIngress["IngressTrafficAll"] = "INGRESS_TRAFFIC_ALL";
+    GoogleCloudRunIngress["IngressTrafficInternalOnly"] = "INGRESS_TRAFFIC_INTERNAL_ONLY";
+    GoogleCloudRunIngress["IngressTrafficInternalLoadBalancer"] = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER";
 })(GoogleCloudRunIngress || (GoogleCloudRunIngress = {}));
 /**
  * Google Cloud Run platform.
@@ -1685,7 +1685,11 @@ __decorate([
 ], GoogleCloudRun.prototype, "requestConcurrency", void 0);
 __decorate([
     AllowMissing(),
-    IsIn(['all', 'internal', 'internal-and-cloud-load-balancing']),
+    IsIn([
+        'INGRESS_TRAFFIC_ALL',
+        'INGRESS_TRAFFIC_INTERNAL_ONLY',
+        'INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER',
+    ]),
     __metadata("design:type", String)
 ], GoogleCloudRun.prototype, "ingress", void 0);
 __decorate([

package/dist/configurations/schemas/google.yaml

@@ -469,9 +469,9 @@ properties:
             title: GoogleCloudRunIngress
             type: string
             enum:
-              - all
-              - internal
-              - internal-and-cloud-load-balancing
+              - INGRESS_TRAFFIC_ALL
+              - INGRESS_TRAFFIC_INTERNAL_ONLY
+              - INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER
             description: >-
               The type of allowed ingress that can reach the container.
 

package/dist/functions/event-topic/create-backfill-source-bigquery.call.js

@@ -1,4 +1,5 @@
 import { BigQueryService } from '../../services/index.js';
+import { rawEventsTableName } from '../google-pubsub/index.js';
 import { BIGQUERY_SOURCE_REGEX, } from './create-backfill-source-bigquery.js';
 /**
  * Resolves the full BigQuery table ID from the function arguments and configuration.
@@ -18,8 +19,7 @@ function resolveTableId(self, context) {
     const googleConf = context.asConfiguration();
     const projectId = googleConf.getOrThrow('google.project');
     const rawEventsDatasetId = googleConf.getOrThrow('google.pubSub.bigQueryStorage.rawEventsDatasetId');
-    const tableName = self.eventTopic.replace(/[-\.]/g, '_');
-    return `${projectId}.${rawEventsDatasetId}.${tableName}`;
+    return `${projectId}.${rawEventsDatasetId}.${rawEventsTableName(self.eventTopic)}`;
 }
 export default async function call() {
     const tableId = resolveTableId(this, this._context);

package/dist/functions/event-topic/query-events-bigquery.call.js

@@ -1,4 +1,5 @@
 import { BigQueryService } from '../../services/index.js';
+import { rawEventsTableName } from '../google-pubsub/index.js';
 /**
  * The default duration applied to `from` when it is not set, in milliseconds.
  */
@@ -13,8 +14,7 @@ export default async function call() {
     const googleConf = this._context.asConfiguration();
     const projectId = googleConf.getOrThrow('google.project');
     const rawEventsDatasetId = googleConf.getOrThrow('google.pubSub.bigQueryStorage.rawEventsDatasetId');
-    const tableName = this.topic.replace(/[-\.]/g, '_');
-    const tableId = `${projectId}.${rawEventsDatasetId}.${tableName}`;
+    const tableId = `${projectId}.${rawEventsDatasetId}.${rawEventsTableName(this.topic)}`;
     const conditions = [`publish_time >= @from`];
     const params = { from: from.toISOString() };
     if (this.to) {

package/dist/functions/google-firestore/generate-typescript-decorators.js

@@ -1,3 +1,4 @@
+import { splitSchemaPath } from '@causa/workspace-core/jsonschema';
 import { ModelGenerateTypeScriptDecorators } from '@causa/workspace-typescript';
 import { addDecoratorToList, } from '@causa/workspace-typescript/code-generation';
 import micromatch from 'micromatch';
@@ -32,7 +33,7 @@ export class ModelGenerateTypeScriptDecoratorsForGoogleFirestore extends ModelGe
         if (Array.isArray(globs)) {
             const projectPath = this._context.getProjectPathOrThrow();
             const absoluteGlobs = globs.map((g) => join(projectPath, g));
-            const schemaPath = this.schema.path.split('#')[0];
+            const { file: schemaPath } = splitSchemaPath(this.schema.path);
             if (!micromatch.isMatch(schemaPath, absoluteGlobs)) {
                 return [];
             }

package/dist/functions/google-pubsub/index.d.ts

@@ -1 +1 @@
-export { GooglePubSubWriteTopics } from './write-topics.js';
+export { GooglePubSubWriteTopics, rawEventsTableName } from './write-topics.js';

package/dist/functions/google-pubsub/index.js

@@ -1 +1 @@
-export { GooglePubSubWriteTopics } from './write-topics.js';
+export { GooglePubSubWriteTopics, rawEventsTableName } from './write-topics.js';

package/dist/functions/google-pubsub/write-topics.d.ts

@@ -1,5 +1,12 @@
 import { type ProcessorResult, WorkspaceFunction } from '@causa/workspace';
 import { type InfrastructureProcessor } from '@causa/workspace-core';
+/**
+ * Returns the name of the BigQuery table storing the raw events of a topic.
+ *
+ * @param topic The ID of the topic.
+ * @returns The name of the BigQuery table.
+ */
+export declare function rawEventsTableName(topic: string): string;
 /**
  * A function that uses {@link EventTopicList} to find all the topics in the workspace, and writes their configurations
  * to a directory.

package/dist/functions/google-pubsub/write-topics.js

@@ -18,6 +18,15 @@ import { join } from 'path';
  * The default directory where Pub/Sub topic configurations are written, relative to the workspace root.
  */
 const DEFAULT_TOPIC_CONFIGURATIONS_DIRECTORY = join(CAUSA_FOLDER, 'pubsub-topics');
+/**
+ * Returns the name of the BigQuery table storing the raw events of a topic.
+ *
+ * @param topic The ID of the topic.
+ * @returns The name of the BigQuery table.
+ */
+export function rawEventsTableName(topic) {
+    return topic.replace(/[-.]/g, '_');
+}
 /**
  * A function that uses {@link EventTopicList} to find all the topics in the workspace, and writes their configurations
  * to a directory.
@@ -56,7 +65,7 @@ export class GooglePubSubWriteTopics extends WorkspaceFunction {
         await Promise.all(topics.map(async (topic) => {
             const topicConfiguration = {
                 ...topic,
-                bigQueryTableName: topic.id.replace(/[-\.]/g, '_'),
+                bigQueryTableName: rawEventsTableName(topic.id),
             };
             const topicFile = join(absoluteDir, `${topic.id}.json`);
             await writeFile(topicFile, JSON.stringify(topicConfiguration));

package/dist/functions/google-spanner/generate-typescript-decorators.js

@@ -1,3 +1,4 @@
+import { splitSchemaPath } from '@causa/workspace-core/jsonschema';
 import { ModelGenerateTypeScriptDecorators } from '@causa/workspace-typescript';
 import { addDecoratorToList, } from '@causa/workspace-typescript/code-generation';
 import micromatch from 'micromatch';
@@ -41,7 +42,7 @@ export class ModelGenerateTypeScriptDecoratorsForGoogleSpanner extends ModelGene
         if (Array.isArray(globs)) {
             const projectPath = this._context.getProjectPathOrThrow();
             const absoluteGlobs = globs.map((g) => join(projectPath, g));
-            const schemaPath = this.schema.path.split('#')[0];
+            const { file: schemaPath } = splitSchemaPath(this.schema.path);
             if (!micromatch.isMatch(schemaPath, absoluteGlobs)) {
                 return [];
             }

package/dist/functions/google-spanner/list-databases.d.ts

@@ -8,7 +8,7 @@ export type SpannerDatabase = {
      */
     id: string;
     /**
-     * The paths (relative to the workspace root) containing DDL statements for this database.
+     * The absolute paths of the files containing DDL statements for this database.
      */
     ddlFiles: string[];
     /**

package/dist/functions/graph/index.d.ts

@@ -0,0 +1 @@
+export { GraphListRulesForGoogle } from './list-rules.js';

package/dist/functions/graph/index.js

@@ -0,0 +1 @@
+export { GraphListRulesForGoogle } from './list-rules.js';

package/dist/functions/graph/list-rules.d.ts

@@ -0,0 +1,11 @@
+import { GraphListRules, type GraphRule } from '@causa/workspace-core';
+/**
+ * Implements {@link GraphListRules} for Google Cloud.
+ * The rules read the Google-specific parts of the workspace configuration and model (Firestore collections, the
+ * entities projects access through their `google.*` outputs, triggers of Google-specific types), and mirror the
+ * resources created by the Causa Terraform modules for Google Cloud.
+ */
+export declare class GraphListRulesForGoogle extends GraphListRules {
+    _call(): GraphRule[];
+    _supports(): boolean;
+}

package/dist/functions/graph/list-rules.js

@@ -0,0 +1,16 @@
+import { GraphListRules } from '@causa/workspace-core';
+import { GOOGLE_GRAPH_RULES, GOOGLE_TERRAFORM_GRAPH_RULES, } from '../../graph/index.js';
+/**
+ * Implements {@link GraphListRules} for Google Cloud.
+ * The rules read the Google-specific parts of the workspace configuration and model (Firestore collections, the
+ * entities projects access through their `google.*` outputs, triggers of Google-specific types), and mirror the
+ * resources created by the Causa Terraform modules for Google Cloud.
+ */
+export class GraphListRulesForGoogle extends GraphListRules {
+    _call() {
+        return [...GOOGLE_GRAPH_RULES, ...GOOGLE_TERRAFORM_GRAPH_RULES];
+    }
+    _supports() {
+        return true;
+    }
+}

package/dist/functions/index.js

@@ -8,10 +8,11 @@ import { GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenera
 import { GooglePubSubWriteTopics } from './google-pubsub/index.js';
 import { GoogleServicesEnable } from './google-services/index.js';
 import { DatabaseQueryRecordsForSpanner, GoogleSpannerListDatabases, GoogleSpannerWriteDatabases, ModelGenerateTypeScriptDecoratorsForGoogleSpanner, ModelSchemaExtractDatabaseForGoogleSpanner, } from './google-spanner/index.js';
+import { GraphListRulesForGoogle } from './graph/index.js';
 import { ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, } from './project/index.js';
 import { SecretFetchForGoogleAccessToken, SecretFetchForGoogleSecretManager, } from './secret/index.js';
 import { ServiceContainerQueryLogsForCloudRun } from './service-container/index.js';
 import { ModelGenerateTypeScriptTriggerDecoratorsForGoogle } from './typescript/index.js';
 export function registerFunctions(context) {
-    context.registerFunctionImplementations(CausaListConfigurationSchemasForGoogle, DatabaseQueryRecordsForFirestore, DatabaseQueryRecordsForSpanner, EmulatorStartForFirebaseStorage, EmulatorStartForFirestore, EmulatorStartForIdentityPlatform, EmulatorStartForPubSub, EmulatorStartForSpanner, EmulatorStopForFirebaseStorage, EmulatorStopForFirestore, EmulatorStopForIdentityPlatform, EmulatorStopForPubSub, EmulatorStopForSpanner, EventTopicBrokerCreateTopicForPubSub, EventTopicBrokerCreateTriggerForCloudRun, EventTopicBrokerDeleteTopicForPubSub, EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole, EventTopicBrokerDeleteTriggerResourceForCloudRunService, EventTopicBrokerDeleteTriggerResourceForPubSubSubscription, EventTopicBrokerDeleteTriggerResourceForServiceAccount, EventTopicBrokerGetTopicIdForPubSub, EventTopicBrokerPublishEventsForGoogle, EventTopicBrokerWaitForProcessingForPubSub, EventTopicCreateBackfillSourceForBigQuery, EventTopicQueryEventsForBigQuery, GoogleAppCheckGenerateToken, GoogleFirebaseStorageMergeRules, GoogleFirestoreMergeRules, GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenerateToken, GooglePubSubWriteTopics, GoogleServicesEnable, GoogleSpannerListDatabases, GoogleSpannerWriteDatabases, ModelGenerateTypeScriptDecoratorsForGoogleFirestore, ModelGenerateTypeScriptDecoratorsForGoogleSpanner, ModelGenerateTypeScriptTriggerDecoratorsForGoogle, ModelSchemaExtractDatabaseForGoogleFirestore, ModelSchemaExtractDatabaseForGoogleSpanner, ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, SecretFetchForGoogleAccessToken, SecretFetchForGoogleSecretManager, ServiceContainerQueryLogsForCloudRun);
+    context.registerFunctionImplementations(CausaListConfigurationSchemasForGoogle, DatabaseQueryRecordsForFirestore, DatabaseQueryRecordsForSpanner, EmulatorStartForFirebaseStorage, EmulatorStartForFirestore, EmulatorStartForIdentityPlatform, EmulatorStartForPubSub, EmulatorStartForSpanner, EmulatorStopForFirebaseStorage, EmulatorStopForFirestore, EmulatorStopForIdentityPlatform, EmulatorStopForPubSub, EmulatorStopForSpanner, EventTopicBrokerCreateTopicForPubSub, EventTopicBrokerCreateTriggerForCloudRun, EventTopicBrokerDeleteTopicForPubSub, EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole, EventTopicBrokerDeleteTriggerResourceForCloudRunService, EventTopicBrokerDeleteTriggerResourceForPubSubSubscription, EventTopicBrokerDeleteTriggerResourceForServiceAccount, EventTopicBrokerGetTopicIdForPubSub, EventTopicBrokerPublishEventsForGoogle, EventTopicBrokerWaitForProcessingForPubSub, EventTopicCreateBackfillSourceForBigQuery, EventTopicQueryEventsForBigQuery, GoogleAppCheckGenerateToken, GoogleFirebaseStorageMergeRules, GoogleFirestoreMergeRules, GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenerateToken, GooglePubSubWriteTopics, GoogleServicesEnable, GoogleSpannerListDatabases, GoogleSpannerWriteDatabases, GraphListRulesForGoogle, ModelGenerateTypeScriptDecoratorsForGoogleFirestore, ModelGenerateTypeScriptDecoratorsForGoogleSpanner, ModelGenerateTypeScriptTriggerDecoratorsForGoogle, ModelSchemaExtractDatabaseForGoogleFirestore, ModelSchemaExtractDatabaseForGoogleSpanner, ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, SecretFetchForGoogleAccessToken, SecretFetchForGoogleSecretManager, ServiceContainerQueryLogsForCloudRun);
 }

package/dist/graph/cloud-run.d.ts

@@ -0,0 +1,98 @@
+import type { ServiceContainerConfiguration } from '@causa/workspace-core';
+import { GraphFact, type GraphContext, type GraphFactOutput, type GraphTemplatePart, type WorkspaceProject } from '@causa/workspace-core/graph';
+import { type TerraformModuleBlock } from '@causa/workspace-terraform';
+/**
+ * A trigger defined in the `serviceContainer.triggers` configuration.
+ */
+type ServiceContainerTrigger = NonNullable<NonNullable<ServiceContainerConfiguration['serviceContainer']>['triggers']>[string];
+/**
+ * The source of the Causa Terraform module deploying a service container to Cloud Run.
+ */
+export declare const CLOUD_RUN_MODULE_SOURCE = "causa-io/service-container-cloud-run/google";
+/**
+ * A block of the Cloud Run module, i.e. a deployed service, with the module's logic evaluated from the block's
+ * arguments and the project's configuration.
+ */
+export type CloudRunService = {
+    /**
+     * The Terraform module block defining the Cloud Run service.
+     */
+    readonly block: TerraformModuleBlock;
+    /**
+     * The project whose configuration file the block reads.
+     */
+    readonly project: WorkspaceProject;
+    /**
+     * The name of the service, `coalesce(var.name, project.name)`.
+     */
+    readonly name: string;
+    /**
+     * The ID of the `service` node.
+     */
+    readonly id: string;
+    /**
+     * Whether the service's HTTP endpoints are exposed through the API router (`enable_public_http_endpoints`, `false` by
+     * default).
+     */
+    readonly enablePublicHttpEndpoints: boolean;
+    /**
+     * Whether the block grants the publisher role on the project's `outputs.eventTopics` (`set_pubsub_permissions`,
+     * defaulting to `set_iam_permissions`).
+     */
+    readonly setPubsubPermissions: boolean;
+    /**
+     * Whether the block grants access to the Spanner databases of the project's outputs (`set_spanner_permissions`,
+     * defaulting to `set_iam_permissions`).
+     */
+    readonly setSpannerPermissions: boolean;
+    /**
+     * Whether the block grants access to the Firestore database for the collections of the project's outputs
+     * (`set_firestore_permissions`, defaulting to `set_iam_permissions`).
+     */
+    readonly setFirestorePermissions: boolean;
+    /**
+     * Whether the block grants the enqueuer role on the queues of the project's task triggers (`set_tasks_permissions`,
+     * defaulting to `set_iam_permissions`).
+     */
+    readonly setTasksPermissions: boolean;
+    /**
+     * The triggers the module turns into Pub/Sub push subscriptions, keyed by name: `event` or `google.pubSub` triggers
+     * with an HTTP endpoint, not disabled.
+     */
+    readonly pubsubTriggers: ReadonlyMap<string, ServiceContainerTrigger>;
+    /**
+     * The triggers the module turns into Cloud Tasks queues, keyed by name. A disabled trigger still has its * queue,
+     * paused.
+     */
+    readonly tasksTriggers: ReadonlyMap<string, ServiceContainerTrigger>;
+    /**
+     * The triggers the module turns into Cloud Scheduler jobs, keyed by name. A disabled trigger still has its job,
+     * paused.
+     */
+    readonly cronTriggers: ReadonlyMap<string, ServiceContainerTrigger>;
+    /**
+     * The GCP project part of resource names.
+     */
+    readonly projectPart: GraphTemplatePart;
+    /**
+     * The location part of resource names, shared by the service, its queues, and its jobs.
+     */
+    readonly locationPart: GraphTemplatePart;
+};
+/**
+ * The blocks of the Cloud Run module, evaluated against the configuration of the projects they deploy.
+ * Blocks whose `configuration_file` does not name a project of the workspace cannot be mirrored, and are reported.
+ */
+export declare class CloudRunFact extends GraphFact<CloudRunService[]> {
+    compute(graph: GraphContext): Promise<GraphFactOutput<CloudRunService[]>>;
+    /**
+     * Evaluates a Cloud Run module block, mirroring the defaults of the module.
+     *
+     * @param block The module block.
+     * @param project The project whose configuration file the block reads.
+     * @param warnings The warnings of the fact, to which the ones about the block are added.
+     * @returns The {@link CloudRunService}.
+     */
+    private evaluate;
+}
+export {};

package/dist/graph/cloud-run.js

@@ -0,0 +1,102 @@
+import { GraphFact, ProjectsFact, serviceId, } from '@causa/workspace-core/graph';
+import { modulesWithSource, TerraformProjectsFact, } from '@causa/workspace-terraform';
+import { argumentOrConfiguration, projectOfConfigurationFile, } from './terraform-modules.js';
+/**
+ * The source of the Causa Terraform module deploying a service container to Cloud Run.
+ */
+export const CLOUD_RUN_MODULE_SOURCE = 'causa-io/service-container-cloud-run/google';
+/**
+ * The major version of the Cloud Run module whose behavior is mirrored (trigger filters, IAM grants, resource names).
+ */
+const MIRRORED_CLOUD_RUN_MAJOR = 1;
+/**
+ * The blocks of the Cloud Run module, evaluated against the configuration of the projects they deploy.
+ * Blocks whose `configuration_file` does not name a project of the workspace cannot be mirrored, and are reported.
+ */
+export class CloudRunFact extends GraphFact {
+    async compute(graph) {
+        const [terraformProjects, projects] = await Promise.all([
+            graph.get(TerraformProjectsFact),
+            graph.get(ProjectsFact),
+        ]);
+        const services = [];
+        const warnings = [];
+        for (const block of modulesWithSource(terraformProjects, CLOUD_RUN_MODULE_SOURCE)) {
+            const project = projectOfConfigurationFile(block.arguments['configuration_file'], projects);
+            if (!project) {
+                warnings.push({
+                    message: "The Cloud Run module block is skipped, as its 'configuration_file' does not name a project of the workspace.",
+                    sources: [block.declaration],
+                });
+                continue;
+            }
+            services.push(this.evaluate(block, project, warnings));
+        }
+        return { value: services, warnings };
+    }
+    /**
+     * Evaluates a Cloud Run module block, mirroring the defaults of the module.
+     *
+     * @param block The module block.
+     * @param project The project whose configuration file the block reads.
+     * @param warnings The warnings of the fact, to which the ones about the block are added.
+     * @returns The {@link CloudRunService}.
+     */
+    evaluate(block, project, warnings) {
+        const sources = [block.declaration];
+        const major = Number(block.version?.split('.')[0]);
+        if (major !== MIRRORED_CLOUD_RUN_MAJOR) {
+            warnings.push({
+                message: `The Cloud Run module version '${block.version ?? 'unset'}' is not the one being mirrored (${MIRRORED_CLOUD_RUN_MAJOR}.x). Resources are extracted as for that version.`,
+                sources,
+            });
+        }
+        const argument = (name, fallback) => {
+            const value = block.arguments[name];
+            if (value === undefined) {
+                return fallback;
+            }
+            if (!('value' in value)) {
+                const assumed = typeof fallback === 'string' ? fallback : JSON.stringify(fallback);
+                warnings.push({
+                    message: `The argument '${name}' is computed (${value.expression}). Assuming ${assumed}.`,
+                    sources,
+                });
+                return fallback;
+            }
+            return (value.value ?? fallback);
+        };
+        const name = argument('name', project.name) || project.name;
+        const enableTriggers = argument('enable_triggers', false);
+        const triggers = Object.entries({
+            ...(project.context
+                .asConfiguration()
+                .get('serviceContainer.triggers', { unsafe: true }) ?? {}),
+            ...argument('triggers', {}),
+        }).filter(([, t]) => t.endpoint?.type === 'http');
+        const ofTypes = (enabled, types, excludeDisabled = false) => new Map(enabled
+            ? triggers.filter(([, t]) => types.includes(t.type ?? '') &&
+                !(excludeDisabled && t.enabled === false))
+            : []);
+        const setIamPermissions = argument('set_iam_permissions', true);
+        return {
+            block,
+            project,
+            name,
+            id: serviceId(project.directory, name),
+            enablePublicHttpEndpoints: argument('enable_public_http_endpoints', false),
+            setPubsubPermissions: argument('set_pubsub_permissions', setIamPermissions),
+            setSpannerPermissions: argument('set_spanner_permissions', setIamPermissions),
+            setFirestorePermissions: argument('set_firestore_permissions', setIamPermissions),
+            setTasksPermissions: argument('set_tasks_permissions', setIamPermissions),
+            pubsubTriggers: ofTypes(argument('enable_pubsub_triggers', enableTriggers), ['event', 'google.pubSub'], true),
+            tasksTriggers: ofTypes(argument('enable_tasks_triggers', enableTriggers), ['task', 'google.task', 'google.tasks']),
+            cronTriggers: ofTypes(argument('enable_cron_triggers', enableTriggers), [
+                'cron',
+                'google.scheduler',
+            ]),
+            projectPart: argumentOrConfiguration(block, 'gcp_project_id', 'google.project', warnings),
+            locationPart: argumentOrConfiguration(block, 'location', 'google.cloudRun.location', warnings),
+        };
+    }
+}

package/dist/graph/ids.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The engine of Spanner databases. It is also the key of `serviceContainer.outputs` listing the databases a project
+ * owns, and the `engine` of Spanner database bindings.
+ */
+export declare const SPANNER_ENGINE = "google.spanner";
+/**
+ * The engine of Firestore databases. It is also the key of `serviceContainer.outputs` listing the collections a
+ * project owns, and the `engine` of Firestore database bindings.
+ */
+export declare const FIRESTORE_ENGINE = "google.firestore";
+/**
+ * The engine of BigQuery datasets.
+ */
+export declare const BIGQUERY_ENGINE = "google.bigquery";
+export declare const spannerInstanceId: (instance: string) => string;
+/**
+ * The name of a Spanner database within its engine, `<instance>.<database>`, as `outputs['google.spanner']` lists it.
+ */
+export declare const spannerDatabaseName: (instance: string, database: string) => string;
+export declare const spannerDatabaseLocator: (instance: string, database: string) => string;
+export declare const firestoreDatabaseLocator: (database: string) => string;
+export declare const bigQueryDatasetLocator: (dataset: string) => string;
+/**
+ * Returns the path of the collection holding the documents of a Firestore binding, independently of the properties
+ * used as document IDs: the last segment (the document) is dropped, and the other placeholders are replaced with `{}`.
+ * For example, `users/{user}/bookmarkFolders/{id}` becomes `users/{}/bookmarkFolders`.
+ *
+ * @param bindingTable The table of the binding, i.e. the path of its documents.
+ * @returns The collection path, or `undefined` if the root collection is not named by the binding.
+ */
+export declare function firestoreCollectionPath(bindingTable: string): string | undefined;
+/**
+ * The locator of the BigQuery subscription archiving a topic's raw events.
+ */
+export declare const rawEventsSubscriptionLocator: (topic: string) => string;

package/dist/graph/ids.js

@@ -0,0 +1,44 @@
+import { databaseLocator, nodeId } from '@causa/workspace-core/graph';
+/**
+ * The engine of Spanner databases. It is also the key of `serviceContainer.outputs` listing the databases a project
+ * owns, and the `engine` of Spanner database bindings.
+ */
+export const SPANNER_ENGINE = 'google.spanner';
+/**
+ * The engine of Firestore databases. It is also the key of `serviceContainer.outputs` listing the collections a
+ * project owns, and the `engine` of Firestore database bindings.
+ */
+export const FIRESTORE_ENGINE = 'google.firestore';
+/**
+ * The engine of BigQuery datasets.
+ */
+export const BIGQUERY_ENGINE = 'google.bigquery';
+export const spannerInstanceId = (instance) => nodeId('google.spanner.instance', instance);
+/**
+ * The name of a Spanner database within its engine, `<instance>.<database>`, as `outputs['google.spanner']` lists it.
+ */
+export const spannerDatabaseName = (instance, database) => `${instance}.${database}`;
+export const spannerDatabaseLocator = (instance, database) => databaseLocator(SPANNER_ENGINE, spannerDatabaseName(instance, database));
+export const firestoreDatabaseLocator = (database) => databaseLocator(FIRESTORE_ENGINE, database);
+export const bigQueryDatasetLocator = (dataset) => databaseLocator(BIGQUERY_ENGINE, dataset);
+/**
+ * Returns the path of the collection holding the documents of a Firestore binding, independently of the properties
+ * used as document IDs: the last segment (the document) is dropped, and the other placeholders are replaced with `{}`.
+ * For example, `users/{user}/bookmarkFolders/{id}` becomes `users/{}/bookmarkFolders`.
+ *
+ * @param bindingTable The table of the binding, i.e. the path of its documents.
+ * @returns The collection path, or `undefined` if the root collection is not named by the binding.
+ */
+export function firestoreCollectionPath(bindingTable) {
+    const segments = bindingTable.split('/').slice(0, -1);
+    if (segments.length === 0 || /^\{.*\}$/.test(segments[0])) {
+        return undefined;
+    }
+    return segments
+        .map((segment) => (/^\{.*\}$/.test(segment) ? '{}' : segment))
+        .join('/');
+}
+/**
+ * The locator of the BigQuery subscription archiving a topic's raw events.
+ */
+export const rawEventsSubscriptionLocator = (topic) => `rawEvents/${topic}`;

package/dist/graph/index.d.ts

@@ -0,0 +1,6 @@
+export * from './cloud-run.js';
+export * from './ids.js';
+export * from './rules/configuration/index.js';
+export * from './rules/terraform/index.js';
+export * from './spanner.js';
+export * from './terraform-modules.js';

package/dist/graph/index.js

@@ -0,0 +1,6 @@
+export * from './cloud-run.js';
+export * from './ids.js';
+export * from './rules/configuration/index.js';
+export * from './rules/terraform/index.js';
+export * from './spanner.js';
+export * from './terraform-modules.js';

package/dist/graph/rules/configuration/enqueues-assumed-from-google-task-trigger.d.ts

@@ -0,0 +1,6 @@
+import { type GraphRule } from '@causa/workspace-core';
+/**
+ * An `enqueues` edge from a service container project to each of its own `google.task` or `google.tasks` triggers,
+ * assuming the owning project is the producer.
+ */
+export declare const enqueuesAssumedFromGoogleTaskTrigger: GraphRule;

package/dist/graph/rules/configuration/enqueues-assumed-from-google-task-trigger.js

@@ -0,0 +1,39 @@
+import { GraphOriginKind, } from '@causa/workspace-core';
+import { projectId, triggerId, ProjectsFact, } from '@causa/workspace-core/graph';
+/**
+ * An `enqueues` edge from a service container project to each of its own `google.task` or `google.tasks` triggers,
+ * assuming the owning project is the producer.
+ */
+export const enqueuesAssumedFromGoogleTaskTrigger = {
+    name: 'enqueuesAssumedFromGoogleTaskTrigger',
+    kind: GraphOriginKind.Inferred,
+    description: 'One `enqueues` edge from a service container project to each of its own `google.task` or `google.tasks` triggers, assuming the owning project is the producer.',
+    async run(graph) {
+        const { locator } = graph;
+        const projects = await graph.get(ProjectsFact);
+        const edges = [];
+        for (const project of projects.filter((p) => p.type === 'serviceContainer')) {
+            const triggers = project.context
+                .asConfiguration()
+                .get('serviceContainer.triggers', { unsafe: true }) ?? {};
+            for (const [name, trigger] of Object.entries(triggers)) {
+                if (!['google.task', 'google.tasks'].includes(trigger.type ?? '')) {
+                    continue;
+                }
+                edges.push({
+                    type: 'enqueues',
+                    from: projectId(project.directory),
+                    to: triggerId(project.directory, name),
+                    sources: [
+                        await locator.configurationSource(project.context, [
+                            'serviceContainer',
+                            'triggers',
+                            name,
+                        ]),
+                    ],
+                });
+            }
+        }
+        return { edges };
+    },
+};

package/dist/graph/rules/configuration/firestore.d.ts

@@ -0,0 +1,11 @@
+import { type GraphRule } from '@causa/workspace-core';
+/**
+ * The Firestore database of the workspace, `google.firestore.database`, and the collections schemas bind to:
+ *
+ * - A `database` node for the database.
+ * - A `table` node per Firestore collection a schema binds to (`causa.googleFirestoreCollection`). The locator is the
+ *   collection path, with `{}` in place of document IDs (e.g. `users/{}/bookmarks`), under the single Firestore database
+ *   of the workspace. A binding that does not name its root collection is reported.
+ * - A `realizes` edge from each collection to the entity whose binding declares it.
+ */
+export declare const firestoreFromConfiguration: GraphRule;