@causa/workspace-google 1.3.1 → 1.4.0-beta.2

package/dist/graph/environment/resources.d.ts

@@ -0,0 +1,45 @@
+import type { GraphEnvironmentContext, GraphNodeEntry } from '@causa/workspace-core/graph';
+/**
+ * The segments of a Google Cloud resource name, keyed by collection.
+ * For example, `projects/my-project/locations/europe-west1/services/my-service` is
+ * `{ projects: 'my-project', locations: 'europe-west1', services: 'my-service' }`.
+ */
+export type ResourceNameSegments = Record<string, string>;
+/**
+ * Parses a Google Cloud resource name into its segments.
+ * The `global` segment, which is not followed by an ID (e.g. in `projects/my-project/global/urlMaps/api`), is skipped.
+ *
+ * @param name The resource name.
+ * @returns The segments, keyed by collection.
+ */
+export declare function parseResourceName(name: string): ResourceNameSegments;
+/**
+ * A node whose resource is a Google Cloud resource, along with its full name.
+ */
+export type GoogleResource = {
+    /**
+     * The node.
+     */
+    readonly node: GraphNodeEntry;
+    /**
+     * The type of the resource, e.g. `run.googleapis.com/Service`.
+     */
+    readonly type: string;
+    /**
+     * The full resource name.
+     */
+    readonly name: string;
+    /**
+     * The segments of the resource name.
+     */
+    readonly segments: ResourceNameSegments;
+};
+/**
+ * Returns the Google Cloud resources of the graph, with the segments of their names.
+ *
+ * @param environment The context of the environment.
+ * @param resourceType The type of the resources. Defaults to all Google Cloud resource types.
+ * @param nodeType The type of the nodes. Defaults to all node types.
+ * @returns The resources, in the order of the graph.
+ */
+export declare function googleResources(environment: GraphEnvironmentContext, resourceType?: string, nodeType?: string): GoogleResource[];

package/dist/graph/environment/resources.js

@@ -0,0 +1,49 @@
+/**
+ * Parses a Google Cloud resource name into its segments.
+ * The `global` segment, which is not followed by an ID (e.g. in `projects/my-project/global/urlMaps/api`), is skipped.
+ *
+ * @param name The resource name.
+ * @returns The segments, keyed by collection.
+ */
+export function parseResourceName(name) {
+    const tokens = name.split('/');
+    const segments = {};
+    for (let index = 0; index < tokens.length;) {
+        const collection = tokens[index];
+        if (collection === 'global') {
+            index += 1;
+            continue;
+        }
+        segments[collection] = tokens[index + 1] ?? '';
+        index += 2;
+    }
+    return segments;
+}
+/**
+ * Returns whether a resource type is the type of a Google Cloud resource.
+ *
+ * @param type The type of the resource.
+ * @returns `true` for Google Cloud resource types, e.g. `run.googleapis.com/Service`.
+ */
+function isGoogleResourceType(type) {
+    return type.includes('.googleapis.com/');
+}
+/**
+ * Returns the Google Cloud resources of the graph, with the segments of their names.
+ *
+ * @param environment The context of the environment.
+ * @param resourceType The type of the resources. Defaults to all Google Cloud resource types.
+ * @param nodeType The type of the nodes. Defaults to all node types.
+ * @returns The resources, in the order of the graph.
+ */
+export function googleResources(environment, resourceType, nodeType) {
+    return environment
+        .resources(resourceType, nodeType)
+        .filter(({ resource }) => isGoogleResourceType(resource.type))
+        .map(({ node, resource: { type, id } }) => ({
+        node,
+        type,
+        name: id,
+        segments: parseResourceName(id),
+    }));
+}

package/dist/graph/ids.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The engine of Spanner databases. It is also the key of `serviceContainer.outputs` listing the databases a project
+ * owns, and the `engine` of Spanner database bindings.
+ */
+export declare const SPANNER_ENGINE = "google.spanner";
+/**
+ * The engine of Firestore databases. It is also the key of `serviceContainer.outputs` listing the collections a
+ * project owns, and the `engine` of Firestore database bindings.
+ */
+export declare const FIRESTORE_ENGINE = "google.firestore";
+/**
+ * The engine of BigQuery datasets.
+ */
+export declare const BIGQUERY_ENGINE = "google.bigquery";
+export declare const spannerInstanceId: (instance: string) => string;
+/**
+ * The name of a Spanner database within its engine, `<instance>.<database>`, as `outputs['google.spanner']` lists it.
+ */
+export declare const spannerDatabaseName: (instance: string, database: string) => string;
+export declare const spannerDatabaseLocator: (instance: string, database: string) => string;
+export declare const firestoreDatabaseLocator: (database: string) => string;
+export declare const bigQueryDatasetLocator: (dataset: string) => string;
+/**
+ * Returns the path of the collection holding the documents of a Firestore binding, independently of the properties
+ * used as document IDs: the last segment (the document) is dropped, and the other placeholders are replaced with `{}`.
+ * For example, `users/{user}/bookmarkFolders/{id}` becomes `users/{}/bookmarkFolders`.
+ *
+ * @param bindingTable The table of the binding, i.e. the path of its documents.
+ * @returns The collection path, or `undefined` if the root collection is not named by the binding.
+ */
+export declare function firestoreCollectionPath(bindingTable: string): string | undefined;
+/**
+ * The locator of the BigQuery subscription archiving a topic's raw events.
+ */
+export declare const rawEventsSubscriptionLocator: (topic: string) => string;

package/dist/graph/ids.js

@@ -0,0 +1,44 @@
+import { databaseLocator, nodeId } from '@causa/workspace-core/graph';
+/**
+ * The engine of Spanner databases. It is also the key of `serviceContainer.outputs` listing the databases a project
+ * owns, and the `engine` of Spanner database bindings.
+ */
+export const SPANNER_ENGINE = 'google.spanner';
+/**
+ * The engine of Firestore databases. It is also the key of `serviceContainer.outputs` listing the collections a
+ * project owns, and the `engine` of Firestore database bindings.
+ */
+export const FIRESTORE_ENGINE = 'google.firestore';
+/**
+ * The engine of BigQuery datasets.
+ */
+export const BIGQUERY_ENGINE = 'google.bigquery';
+export const spannerInstanceId = (instance) => nodeId('google.spanner.instance', instance);
+/**
+ * The name of a Spanner database within its engine, `<instance>.<database>`, as `outputs['google.spanner']` lists it.
+ */
+export const spannerDatabaseName = (instance, database) => `${instance}.${database}`;
+export const spannerDatabaseLocator = (instance, database) => databaseLocator(SPANNER_ENGINE, spannerDatabaseName(instance, database));
+export const firestoreDatabaseLocator = (database) => databaseLocator(FIRESTORE_ENGINE, database);
+export const bigQueryDatasetLocator = (dataset) => databaseLocator(BIGQUERY_ENGINE, dataset);
+/**
+ * Returns the path of the collection holding the documents of a Firestore binding, independently of the properties
+ * used as document IDs: the last segment (the document) is dropped, and the other placeholders are replaced with `{}`.
+ * For example, `users/{user}/bookmarkFolders/{id}` becomes `users/{}/bookmarkFolders`.
+ *
+ * @param bindingTable The table of the binding, i.e. the path of its documents.
+ * @returns The collection path, or `undefined` if the root collection is not named by the binding.
+ */
+export function firestoreCollectionPath(bindingTable) {
+    const segments = bindingTable.split('/').slice(0, -1);
+    if (segments.length === 0 || /^\{.*\}$/.test(segments[0])) {
+        return undefined;
+    }
+    return segments
+        .map((segment) => (/^\{.*\}$/.test(segment) ? '{}' : segment))
+        .join('/');
+}
+/**
+ * The locator of the BigQuery subscription archiving a topic's raw events.
+ */
+export const rawEventsSubscriptionLocator = (topic) => `rawEvents/${topic}`;

package/dist/graph/index.d.ts

@@ -0,0 +1,7 @@
+export * from './cloud-run.js';
+export * from './environment/index.js';
+export * from './ids.js';
+export * from './rules/configuration/index.js';
+export * from './rules/terraform/index.js';
+export * from './spanner.js';
+export * from './terraform-modules.js';

package/dist/graph/index.js

@@ -0,0 +1,7 @@
+export * from './cloud-run.js';
+export * from './environment/index.js';
+export * from './ids.js';
+export * from './rules/configuration/index.js';
+export * from './rules/terraform/index.js';
+export * from './spanner.js';
+export * from './terraform-modules.js';

package/dist/graph/rules/configuration/enqueues-assumed-from-google-task-trigger.d.ts

@@ -0,0 +1,6 @@
+import { type GraphRule } from '@causa/workspace-core';
+/**
+ * An `enqueues` edge from a service container project to each of its own `google.task` or `google.tasks` triggers,
+ * assuming the owning project is the producer.
+ */
+export declare const enqueuesAssumedFromGoogleTaskTrigger: GraphRule;

package/dist/graph/rules/configuration/enqueues-assumed-from-google-task-trigger.js

@@ -0,0 +1,39 @@
+import { GraphOriginKind, } from '@causa/workspace-core';
+import { projectId, triggerId, ProjectsFact, } from '@causa/workspace-core/graph';
+/**
+ * An `enqueues` edge from a service container project to each of its own `google.task` or `google.tasks` triggers,
+ * assuming the owning project is the producer.
+ */
+export const enqueuesAssumedFromGoogleTaskTrigger = {
+    name: 'enqueuesAssumedFromGoogleTaskTrigger',
+    kind: GraphOriginKind.Inferred,
+    description: 'One `enqueues` edge from a service container project to each of its own `google.task` or `google.tasks` triggers, assuming the owning project is the producer.',
+    async run(graph) {
+        const { locator } = graph;
+        const projects = await graph.get(ProjectsFact);
+        const edges = [];
+        for (const project of projects.filter((p) => p.type === 'serviceContainer')) {
+            const triggers = project.context
+                .asConfiguration()
+                .get('serviceContainer.triggers', { unsafe: true }) ?? {};
+            for (const [name, trigger] of Object.entries(triggers)) {
+                if (!['google.task', 'google.tasks'].includes(trigger.type ?? '')) {
+                    continue;
+                }
+                edges.push({
+                    type: 'enqueues',
+                    from: projectId(project.directory),
+                    to: triggerId(project.directory, name),
+                    sources: [
+                        await locator.configurationSource(project.context, [
+                            'serviceContainer',
+                            'triggers',
+                            name,
+                        ]),
+                    ],
+                });
+            }
+        }
+        return { edges };
+    },
+};

package/dist/graph/rules/configuration/firestore.d.ts

@@ -0,0 +1,11 @@
+import { type GraphRule } from '@causa/workspace-core';
+/**
+ * The Firestore database of the workspace, `google.firestore.database`, and the collections schemas bind to:
+ *
+ * - A `database` node for the database.
+ * - A `table` node per Firestore collection a schema binds to (`causa.googleFirestoreCollection`). The locator is the
+ *   collection path, with `{}` in place of document IDs (e.g. `users/{}/bookmarks`), under the single Firestore database
+ *   of the workspace. A binding that does not name its root collection is reported.
+ * - A `realizes` edge from each collection to the entity whose binding declares it.
+ */
+export declare const firestoreFromConfiguration: GraphRule;

package/dist/graph/rules/configuration/firestore.js

@@ -0,0 +1,93 @@
+import { GraphOriginKind, } from '@causa/workspace-core';
+import { tableId, tableLocator, databaseId, ModelFact, graphTemplate, } from '@causa/workspace-core/graph';
+import { FIRESTORE_ENGINE, firestoreCollectionPath, firestoreDatabaseLocator, } from '../../ids.js';
+/**
+ * The Firestore database of the workspace, `google.firestore.database`, and the collections schemas bind to:
+ *
+ * - A `database` node for the database.
+ * - A `table` node per Firestore collection a schema binds to (`causa.googleFirestoreCollection`). The locator is the
+ *   collection path, with `{}` in place of document IDs (e.g. `users/{}/bookmarks`), under the single Firestore database
+ *   of the workspace. A binding that does not name its root collection is reported.
+ * - A `realizes` edge from each collection to the entity whose binding declares it.
+ */
+export const firestoreFromConfiguration = {
+    name: 'firestoreFromConfiguration',
+    kind: GraphOriginKind.Declared,
+    description: 'One `database` node from `google.firestore.database`, located by the database name. One `table` node per schema with a Firestore binding, located by its collection path under that database, and one `realizes` edge from the table to the entity.',
+    async run(graph) {
+        const { locator, context } = graph;
+        const model = await graph.get(ModelFact);
+        const nodes = [];
+        const edges = [];
+        const warnings = [];
+        const database = context
+            .asConfiguration()
+            .get('google.firestore.database');
+        if (typeof database === 'string') {
+            const data = {
+                engine: FIRESTORE_ENGINE,
+                resource: {
+                    type: 'firestore.googleapis.com/Database',
+                    id: graphTemplate('projects/', { configuration: 'google.project' }, '/databases/', { configuration: 'google.firestore.database' }),
+                },
+            };
+            nodes.push({
+                layer: 'infrastructure',
+                type: 'database',
+                locator: firestoreDatabaseLocator(database),
+                name: database,
+                sources: [
+                    await locator.configurationSource(context, [
+                        'google',
+                        'firestore',
+                        'database',
+                    ]),
+                ],
+                data,
+            });
+        }
+        for (const entity of model.entities.values()) {
+            const { schema } = entity;
+            const table = schema.definition.databases.find((d) => d.engine === FIRESTORE_ENGINE)?.table;
+            if (!table) {
+                continue;
+            }
+            const source = await locator.source(schema.file, [
+                ...schema.segments,
+                'causa',
+                'googleFirestoreCollection',
+            ]);
+            if (typeof database !== 'string') {
+                warnings.push({
+                    message: `Schema '${schema.definition.name}' binds to Firestore but 'google.firestore.database' is not set.`,
+                    sources: [source],
+                });
+                continue;
+            }
+            const collection = firestoreCollectionPath(table);
+            if (!collection) {
+                warnings.push({
+                    message: `Schema '${schema.definition.name}' binds to Firestore documents '${table}', whose root collection is not named.`,
+                    sources: [source],
+                });
+                continue;
+            }
+            const databaseLocator = firestoreDatabaseLocator(database);
+            nodes.push({
+                layer: 'infrastructure',
+                type: 'table',
+                locator: tableLocator(databaseLocator, collection),
+                parent: databaseId(databaseLocator),
+                name: collection,
+                sources: [source],
+            });
+            edges.push({
+                type: 'realizes',
+                from: tableId(databaseLocator, collection),
+                to: entity.id,
+                sources: [source],
+            });
+        }
+        return { nodes, edges, warnings };
+    },
+};

package/dist/graph/rules/configuration/index.d.ts

@@ -0,0 +1,5 @@
+import type { GraphRule } from '@causa/workspace-core';
+/**
+ * The Google rules reading the workspace configuration and model, independently of the infrastructure code.
+ */
+export declare const GOOGLE_GRAPH_RULES: readonly GraphRule[];

package/dist/graph/rules/configuration/index.js

@@ -0,0 +1,11 @@
+import { enqueuesAssumedFromGoogleTaskTrigger } from './enqueues-assumed-from-google-task-trigger.js';
+import { firestoreFromConfiguration } from './firestore.js';
+import { googleServiceContainerFromConfiguration } from './service-container.js';
+/**
+ * The Google rules reading the workspace configuration and model, independently of the infrastructure code.
+ */
+export const GOOGLE_GRAPH_RULES = [
+    firestoreFromConfiguration,
+    googleServiceContainerFromConfiguration,
+    enqueuesAssumedFromGoogleTaskTrigger,
+];

package/dist/graph/rules/configuration/service-container.d.ts

@@ -0,0 +1,13 @@
+import { type GraphRule } from '@causa/workspace-core';
+/**
+ * The elements declared by the Google-specific parts of the `serviceContainer` configuration of every service container
+ * project.
+ *
+ * - A `delivers` edge from a topic to each `google.pubSub` trigger consuming it. A trigger on a topic that no event
+ *   schema defines has no topic node to come from: its edge only exists in the infrastructure layer.
+ * - An `accesses` edge from a project to each entity whose table lives in a datastore the project owns.
+ *   `outputs['google.spanner']` lists databases (`<instance>.<database>`), and `outputs['google.firestore']` lists root
+ *   collections. A Spanner entity belongs to the database whose DDL creates its table. A Firestore entity belongs to
+ *   the root collection of its path.
+ */
+export declare const googleServiceContainerFromConfiguration: GraphRule;

package/dist/graph/rules/configuration/service-container.js

@@ -0,0 +1,123 @@
+import { GraphOriginKind, } from '@causa/workspace-core';
+import { DomainsFact, ModelFact, projectId, ProjectsFact, topicId, triggerId, } from '@causa/workspace-core/graph';
+import { FIRESTORE_ENGINE, firestoreCollectionPath, SPANNER_ENGINE, } from '../../ids.js';
+import { ddlSource, resolveSpannerTable, SpannerFact } from '../../spanner.js';
+/**
+ * The elements declared by the Google-specific parts of the `serviceContainer` configuration of every service container
+ * project.
+ *
+ * - A `delivers` edge from a topic to each `google.pubSub` trigger consuming it. A trigger on a topic that no event
+ *   schema defines has no topic node to come from: its edge only exists in the infrastructure layer.
+ * - An `accesses` edge from a project to each entity whose table lives in a datastore the project owns.
+ *   `outputs['google.spanner']` lists databases (`<instance>.<database>`), and `outputs['google.firestore']` lists root
+ *   collections. A Spanner entity belongs to the database whose DDL creates its table. A Firestore entity belongs to
+ *   the root collection of its path.
+ */
+export const googleServiceContainerFromConfiguration = {
+    name: 'googleServiceContainerFromConfiguration',
+    kind: GraphOriginKind.Declared,
+    description: 'One `delivers` edge from a topic to each trigger of type `google.pubSub` naming it, when an event schema defines the topic. One `accesses` edge from a project to each entity persisted in a Spanner database or a Firestore collection listed in its `serviceContainer.outputs`.',
+    async run(graph) {
+        const { locator } = graph;
+        const [domains, projects, model, spanner] = await Promise.all([
+            graph.get(DomainsFact),
+            graph.get(ProjectsFact),
+            graph.get(ModelFact),
+            graph.get(SpannerFact),
+        ]);
+        const edges = [];
+        const warnings = [];
+        const entities = [...model.entities.values()];
+        const spannerEntities = entities.flatMap((entity) => {
+            const resolution = resolveSpannerTable(spanner, entity, domains);
+            return resolution?.kind === 'resolved' ? [{ entity, resolution }] : [];
+        });
+        for (const project of projects.filter((p) => p.type === 'serviceContainer')) {
+            const configuration = project.context.asConfiguration();
+            const triggers = configuration.get('serviceContainer.triggers', { unsafe: true }) ?? {};
+            for (const [name, trigger] of Object.entries(triggers)) {
+                if (trigger.type !== 'google.pubSub' ||
+                    typeof trigger.topic !== 'string' ||
+                    !model.topics.has(trigger.topic)) {
+                    continue;
+                }
+                edges.push({
+                    type: 'delivers',
+                    from: topicId(trigger.topic),
+                    to: triggerId(project.directory, name),
+                    sources: [
+                        await locator.configurationSource(project.context, [
+                            'serviceContainer',
+                            'triggers',
+                            name,
+                            'topic',
+                        ]),
+                    ],
+                });
+            }
+            const outputs = configuration.get('serviceContainer.outputs', {
+                unsafe: true,
+            });
+            const databases = (outputs?.[SPANNER_ENGINE] ?? []);
+            for (const [index, database] of databases.entries()) {
+                const source = await locator.configurationSource(project.context, [
+                    'serviceContainer',
+                    'outputs',
+                    SPANNER_ENGINE,
+                    index,
+                ]);
+                const owned = spannerEntities.filter(({ resolution }) => resolution.database.name === database);
+                if (owned.length === 0) {
+                    warnings.push({
+                        message: `Project '${project.name}' owns Spanner database '${database}' but no entity resolves to it.`,
+                        sources: [source],
+                    });
+                }
+                for (const { entity, resolution } of owned) {
+                    edges.push({
+                        type: 'accesses',
+                        from: projectId(project.directory),
+                        to: entity.id,
+                        sources: [source, ddlSource(resolution.table)],
+                    });
+                }
+            }
+            const collections = (outputs?.[FIRESTORE_ENGINE] ?? []);
+            for (const [index, collection] of collections.entries()) {
+                const source = await locator.configurationSource(project.context, [
+                    'serviceContainer',
+                    'outputs',
+                    FIRESTORE_ENGINE,
+                    index,
+                ]);
+                const owned = entities.filter((entity) => {
+                    const table = entity.schema.definition.databases.find((d) => d.engine === FIRESTORE_ENGINE)?.table;
+                    return (!!table &&
+                        firestoreCollectionPath(table)?.split('/')[0] === collection);
+                });
+                if (owned.length === 0) {
+                    warnings.push({
+                        message: `Project '${project.name}' owns Firestore collection '${collection}' but no schema binds to it.`,
+                        sources: [source],
+                    });
+                }
+                for (const entity of owned) {
+                    edges.push({
+                        type: 'accesses',
+                        from: projectId(project.directory),
+                        to: entity.id,
+                        sources: [
+                            source,
+                            await locator.source(entity.schema.file, [
+                                ...entity.schema.segments,
+                                'causa',
+                                'googleFirestoreCollection',
+                            ]),
+                        ],
+                    });
+                }
+            }
+        }
+        return { edges, warnings };
+    },
+};

package/dist/graph/rules/terraform/api-router.d.ts

@@ -0,0 +1,15 @@
+import { type GraphRule } from '@causa/workspace-core';
+/**
+ * The source of the Causa Terraform module creating the load balancer routing requests to services.
+ */
+export declare const API_ROUTER_MODULE_SOURCE = "causa-io/api-router/google";
+/**
+ * The resources created by the blocks of the API router module:
+ *
+ * - An `apiRouter` node per block, located by its `name` argument (default `api`). The module does not read the
+ *   workspace configuration: the GCP project of its URL map is assumed to be `google.project` when the
+ *   `gcp_project_id` argument cannot be evaluated.
+ * - A `routes` edge from the router to each service whose Cloud Run module block sets `enable_public_http_endpoints`,
+ *   with the project's `serviceContainer.endpoints.http` as paths.
+ */
+export declare const apiRouterModule: GraphRule;

package/dist/graph/rules/terraform/api-router.js

@@ -0,0 +1,117 @@
+import { GraphOriginKind, } from '@causa/workspace-core';
+import { apiRouterId, nodeId } from '@causa/workspace-core/graph';
+import { modulesWithSource, terraformDeploys, TerraformProjectsFact, terraformValue, } from '@causa/workspace-terraform';
+import { CloudRunFact } from '../../cloud-run.js';
+import { blockResource, argumentOrConfiguration, } from '../../terraform-modules.js';
+/**
+ * The source of the Causa Terraform module creating the load balancer routing requests to services.
+ */
+export const API_ROUTER_MODULE_SOURCE = 'causa-io/api-router/google';
+/**
+ * The default name of the API router.
+ */
+const DEFAULT_API_ROUTER_NAME = 'api';
+/**
+ * Returns the name of an API router, from its `name` argument or the module's default.
+ */
+function routerName(block) {
+    const argument = block.arguments['name'];
+    if (argument === undefined) {
+        return DEFAULT_API_ROUTER_NAME;
+    }
+    const value = terraformValue(argument);
+    return typeof value === 'string' ? value : undefined;
+}
+/**
+ * The resources created by the blocks of the API router module:
+ *
+ * - An `apiRouter` node per block, located by its `name` argument (default `api`). The module does not read the
+ *   workspace configuration: the GCP project of its URL map is assumed to be `google.project` when the
+ *   `gcp_project_id` argument cannot be evaluated.
+ * - A `routes` edge from the router to each service whose Cloud Run module block sets `enable_public_http_endpoints`,
+ *   with the project's `serviceContainer.endpoints.http` as paths.
+ */
+export const apiRouterModule = {
+    name: 'apiRouterModule',
+    kind: GraphOriginKind.Declared,
+    description: 'One `apiRouter` node per API router module block, located by its `name` argument or the module default `api`, and linked by a `deploys` edge from the projects applying the block. One `routes` edge from the router to each service whose Cloud Run module block enables public HTTP endpoints, with the project’s `endpoints.http` as paths, assuming the single router is wired to them.',
+    async run(graph) {
+        const { locator } = graph;
+        const [terraformProjects, cloudRun] = await Promise.all([
+            graph.get(TerraformProjectsFact),
+            graph.get(CloudRunFact),
+        ]);
+        const apiRouters = modulesWithSource(terraformProjects, API_ROUTER_MODULE_SOURCE);
+        const nodes = [];
+        const edges = [];
+        const warnings = [];
+        for (const block of apiRouters) {
+            const source = block.declaration;
+            const name = routerName(block) ?? DEFAULT_API_ROUTER_NAME;
+            if (!routerName(block)) {
+                warnings.push({
+                    message: `The router name is computed. Assuming '${DEFAULT_API_ROUTER_NAME}'.`,
+                    sources: [source],
+                });
+            }
+            const part = argumentOrConfiguration(block, 'gcp_project_id', 'google.project', warnings);
+            nodes.push({
+                layer: 'infrastructure',
+                type: 'apiRouter',
+                locator: name,
+                name,
+                sources: [source],
+                data: {
+                    resource: await blockResource(graph, block, {
+                        type: 'compute.googleapis.com/UrlMap',
+                        id: ['projects/', part, `/global/urlMaps/${name}`],
+                    }, warnings),
+                },
+            });
+            edges.push(...terraformDeploys(block, nodeId('apiRouter', name)));
+        }
+        const exposed = cloudRun.filter((s) => s.enablePublicHttpEndpoints);
+        if (exposed.length === 0) {
+            return { nodes, edges, warnings };
+        }
+        if (apiRouters.length !== 1) {
+            warnings.push({
+                message: `There are ${apiRouters.length} API router module blocks. Cannot tell which one routes to ${exposed
+                    .map((s) => `'${s.name}'`)
+                    .join(', ')}.`,
+                sources: apiRouters.map((b) => b.declaration),
+            });
+            return { nodes, edges, warnings };
+        }
+        const [router] = apiRouters;
+        const name = routerName(router) ?? DEFAULT_API_ROUTER_NAME;
+        for (const service of exposed) {
+            const paths = service.project.context
+                .asConfiguration()
+                .get('serviceContainer.endpoints.http') ?? [];
+            if (paths.length === 0) {
+                warnings.push({
+                    message: `Service '${service.name}' enables public HTTP endpoints but its project declares no 'endpoints.http'.`,
+                    sources: [service.block.declaration],
+                });
+            }
+            const data = { paths };
+            edges.push({
+                type: 'routes',
+                from: apiRouterId(name),
+                to: service.id,
+                sources: [
+                    service.block.declaration,
+                    await locator.configurationSource(service.project.context, [
+                        'serviceContainer',
+                        'endpoints',
+                        'http',
+                    ]),
+                    router.declaration,
+                ],
+                data,
+            });
+        }
+        return { nodes, edges, warnings };
+    },
+};

package/dist/graph/rules/terraform/cloud-run-cron-triggers.d.ts

@@ -0,0 +1,11 @@
+import { type GraphRuleOutput } from '@causa/workspace-core';
+import { type GraphContext } from '@causa/workspace-core/graph';
+/**
+ * A `scheduledJob` node per cron trigger of a project, for each Cloud Run module block deploying it with cron triggers
+ * enabled. The module names the job `run-<service>-<trigger>`. The locator is the trigger's. The job `realizes` its
+ * trigger, and `targets` the service the block deploys.
+ *
+ * @param graph The context of the extraction.
+ * @returns The scheduled jobs, and their edges.
+ */
+export declare function cloudRunCronTriggers(graph: GraphContext): Promise<GraphRuleOutput>;