@causa/workspace-google 1.4.0-beta.1 → 1.4.0-beta.2

package/README.md

@@ -83,6 +83,20 @@ This module contributes to the architecture graph extracted by `cs graph extract
 
 Infrastructure nodes carry the Google Cloud resource they stand for in `data.resource`: its `type` (e.g. `pubsub.googleapis.com/Topic`), its `id`, i.e. its full resource name (or `idPrefix` when the full name is not known), and the `scope`, i.e. the project whose configuration should be used to render the identifier.
 
+When the graph is enriched with environment data, this module resolves the names of Cloud Tasks queues by listing the queues of the environment. Queues that cannot be resolved are removed from their nodes. This module's fetchers then:
+
+- read metrics of services, API routers, Pub/Sub topics and subscriptions, Cloud Tasks queues, and Spanner, Firestore, and BigQuery databases from Cloud Monitoring
+- add the `deployment` of Cloud Run services, and the `lastAttempt` and `nextRun` of Cloud Scheduler jobs. They describe services and jobs as they are when the graph is enriched, with a warning when they changed after `at`.
+- add `links` to the Google Cloud console for each resource
+- attach the alerts open in Cloud Monitoring to the nodes of their resources. Matching an alert to a node requires the condition of its policy to keep the labels making up the resource name (e.g. `project_id`, `location`, and `service_name`), along with `monitored_resource` when the metric is written against several resource types, like `logging.googleapis.com/log_entry_count`.
+- attach the open Error Reporting groups of Cloud Run services to their nodes, as alerts with the `error` severity. A group is open when it has occurrences during the last 30 days, and is not acknowledged, resolved, or muted.
+
+The requests and latencies of API routers are also grouped by the `node` the requests were routed to, by mapping the serverless network endpoint groups of their load balancers to Cloud Run services. They are listed using the Compute Engine API (`compute.networkEndpointGroups.list`) in the projects of the API routers.
+
+`GraphFetchEnvironmentMetricSeries` is implemented for the metrics read from Cloud Monitoring.
+
+Cloud Monitoring exposes complete data with a delay of a few minutes. Metrics, including their time series, are read over windows ending at most 5 minutes ago.
+
 ### Secrets backend
 
 This module implements the `google.secretManager` secret backend, allowing fetching secrets from the Google Secret Manager service. Here are some example of how secrets with the `google.secretManager` backend should be defined:

package/dist/functions/google-app-check/generate-token.js

@@ -9,6 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import { CliCommand, CliOption } from '@causa/cli';
 import { callDeferred, WorkspaceFunction } from '@causa/workspace';
+import { PassArgumentsByReference } from '@causa/workspace/function-registry';
 import { AllowMissing } from '@causa/workspace/validation';
 import { IsString } from 'class-validator';
 import { appCheckCommandDefinition } from '../../cli/index.js';
@@ -48,6 +49,7 @@ If the Firebase app ID is not specified, it will:
 - If not present in the configuration, will be automatically looked up from the API.`,
         summary: 'Generates an AppCheck token.',
         outputFn: (token) => console.log(token),
-    })
+    }),
+    PassArgumentsByReference()
 ], GoogleAppCheckGenerateToken);
 export { GoogleAppCheckGenerateToken };

package/dist/functions/google-firebase-storage/merge-rules.js

@@ -9,6 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import { CliCommand } from '@causa/cli';
 import { WorkspaceFunction } from '@causa/workspace';
+import { PassArgumentsByReference } from '@causa/workspace/function-registry';
 import { AllowMissing } from '@causa/workspace/validation';
 import { IsBoolean } from 'class-validator';
 import { firebaseStorageCommandDefinition } from '../../cli/index.js';
@@ -67,6 +68,7 @@ GoogleFirebaseStorageMergeRules = __decorate([
 Input files are looked for in the workspace using the globs defined in google.firebaseStorage.securityRulesFiles.`,
         summary: 'Merge Firebase Storage security rules into a single file.',
         outputFn: ({ securityRuleFile }) => console.log(securityRuleFile),
-    })
+    }),
+    PassArgumentsByReference()
 ], GoogleFirebaseStorageMergeRules);
 export { GoogleFirebaseStorageMergeRules };

package/dist/functions/google-firestore/merge-rules.js

@@ -9,6 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import { CliCommand } from '@causa/cli';
 import { WorkspaceFunction } from '@causa/workspace';
+import { PassArgumentsByReference } from '@causa/workspace/function-registry';
 import { AllowMissing } from '@causa/workspace/validation';
 import { IsBoolean } from 'class-validator';
 import { firestoreCommandDefinition } from '../../cli/index.js';
@@ -67,6 +68,7 @@ GoogleFirestoreMergeRules = __decorate([
 Input files are looked for in the workspace using the globs defined in google.firestore.securityRulesFiles.`,
         summary: 'Merge Firestore security rules into a single file.',
         outputFn: ({ securityRuleFile }) => console.log(securityRuleFile),
-    })
+    }),
+    PassArgumentsByReference()
 ], GoogleFirestoreMergeRules);
 export { GoogleFirestoreMergeRules };

package/dist/functions/google-identity-platform/generate-custom-token.js

@@ -8,6 +8,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { callDeferred, WorkspaceFunction } from '@causa/workspace';
+import { PassArgumentsByReference } from '@causa/workspace/function-registry';
 import { AllowMissing } from '@causa/workspace/validation';
 import { IsObject, IsString } from 'class-validator';
 /**
@@ -17,7 +18,7 @@ import { IsObject, IsString } from 'class-validator';
  * If `google.firebase.adminServiceAccount` is set, the service account will be used to sign the token. Otherwise, an
  * attempt will be made to find a valid service account in the `google.project`.
  */
-export class GoogleIdentityPlatformGenerateCustomToken extends WorkspaceFunction {
+let GoogleIdentityPlatformGenerateCustomToken = class GoogleIdentityPlatformGenerateCustomToken extends WorkspaceFunction {
     /**
      * The ID of the user for which the custom token should be generated.
      */
@@ -32,7 +33,7 @@ export class GoogleIdentityPlatformGenerateCustomToken extends WorkspaceFunction
     _supports() {
         return true;
     }
-}
+};
 __decorate([
     IsString(),
     __metadata("design:type", String)
@@ -42,3 +43,7 @@ __decorate([
     AllowMissing(),
     __metadata("design:type", Object)
 ], GoogleIdentityPlatformGenerateCustomToken.prototype, "claims", void 0);
+GoogleIdentityPlatformGenerateCustomToken = __decorate([
+    PassArgumentsByReference()
+], GoogleIdentityPlatformGenerateCustomToken);
+export { GoogleIdentityPlatformGenerateCustomToken };

package/dist/functions/google-pubsub/write-topics.js

@@ -9,6 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import { WorkspaceFunction } from '@causa/workspace';
 import { EventTopicList, } from '@causa/workspace-core';
+import { PassArgumentsByReference } from '@causa/workspace/function-registry';
 import { CAUSA_FOLDER } from '@causa/workspace/initialization';
 import { AllowMissing } from '@causa/workspace/validation';
 import { IsBoolean } from 'class-validator';
@@ -34,7 +35,7 @@ export function rawEventsTableName(topic) {
  * topic configurations.
  * This function returns a partial configuration, such that it can be used as a processor.
  */
-export class GooglePubSubWriteTopics extends WorkspaceFunction {
+let GooglePubSubWriteTopics = class GooglePubSubWriteTopics extends WorkspaceFunction {
     tearDown;
     /**
      * Returns the path to the directory where Pub/Sub topic configurations should be written.
@@ -80,9 +81,13 @@ export class GooglePubSubWriteTopics extends WorkspaceFunction {
     _supports() {
         return true;
     }
-}
+};
 __decorate([
     IsBoolean(),
     AllowMissing(),
     __metadata("design:type", Boolean)
 ], GooglePubSubWriteTopics.prototype, "tearDown", void 0);
+GooglePubSubWriteTopics = __decorate([
+    PassArgumentsByReference()
+], GooglePubSubWriteTopics);
+export { GooglePubSubWriteTopics };

package/dist/functions/google-services/enable.js

@@ -9,6 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import { CliCommand } from '@causa/cli';
 import { callDeferred, WorkspaceFunction } from '@causa/workspace';
+import { PassArgumentsByReference } from '@causa/workspace/function-registry';
 import { AllowMissing } from '@causa/workspace/validation';
 import { IsBoolean } from 'class-validator';
 import { googleCommandDefinition } from '../../cli/index.js';
@@ -38,6 +39,7 @@ Required GCP services should be defined in the 'google.services' configuration.
 They will be enabled in the 'google.project' GCP project.`,
         summary: 'Enables the GCP services used by the current project.',
         outputFn: ({ services }) => console.log(services.join('\n')),
-    })
+    }),
+    PassArgumentsByReference()
 ], GoogleServicesEnable);
 export { GoogleServicesEnable };

package/dist/functions/google-spanner/write-databases.js

@@ -8,6 +8,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { WorkspaceFunction } from '@causa/workspace';
+import { PassArgumentsByReference } from '@causa/workspace/function-registry';
 import { CAUSA_FOLDER } from '@causa/workspace/initialization';
 import { AllowMissing } from '@causa/workspace/validation';
 import { IsBoolean } from 'class-validator';
@@ -25,7 +26,7 @@ const DEFAULT_DATABASE_CONFIGURATIONS_DIRECTORY = join(CAUSA_FOLDER, 'spanner-da
  * database configurations.
  * This function returns a partial configuration, such that it can be used as a processor.
  */
-export class GoogleSpannerWriteDatabases extends WorkspaceFunction {
+let GoogleSpannerWriteDatabases = class GoogleSpannerWriteDatabases extends WorkspaceFunction {
     tearDown;
     /**
      * Returns the path to the directory where Spanner databases configurations should be written.
@@ -64,9 +65,13 @@ export class GoogleSpannerWriteDatabases extends WorkspaceFunction {
     _supports() {
         return true;
     }
-}
+};
 __decorate([
     IsBoolean(),
     AllowMissing(),
     __metadata("design:type", Boolean)
 ], GoogleSpannerWriteDatabases.prototype, "tearDown", void 0);
+GoogleSpannerWriteDatabases = __decorate([
+    PassArgumentsByReference()
+], GoogleSpannerWriteDatabases);
+export { GoogleSpannerWriteDatabases };

package/dist/functions/graph/fetch-environment-metric-series.call.d.ts

@@ -0,0 +1,3 @@
+import { type GraphMetricSeries } from '@causa/workspace-core';
+import type { GraphFetchEnvironmentMetricSeriesForGoogle } from './fetch-environment-metric-series.js';
+export default function call(this: GraphFetchEnvironmentMetricSeriesForGoogle): Promise<GraphMetricSeries>;

package/dist/functions/graph/fetch-environment-metric-series.call.js

@@ -0,0 +1,107 @@
+import { GraphMetricKind, } from '@causa/workspace-core';
+import { GraphEnvironmentContext } from '@causa/workspace-core/graph';
+import { monitoringMetricKind } from '../../graph/environment/monitoring-catalog.js';
+import { MIN_ALIGNMENT_PERIOD, monitoringEnd, queryMonitoringMetric, } from '../../graph/environment/monitoring-query.js';
+import { BucketLayoutRegistry } from '../../graph/environment/monitoring-values.js';
+/**
+ * The steps between points from which the default one is chosen, in seconds.
+ */
+const DEFAULT_STEPS = [
+    60, 120, 300, 600, 900, 1800, 3600, 7200, 10800, 21600, 43200, 86400,
+];
+/**
+ * The maximum number of points in a series when the step is chosen by default.
+ */
+const DEFAULT_MAX_POINTS = 300;
+/**
+ * Returns the default step for a series, as the smallest of {@link DEFAULT_STEPS} that results in at most
+ * {@link DEFAULT_MAX_POINTS} points. For longer series, a whole number of days is used.
+ *
+ * @param duration The duration of the series, in seconds.
+ * @returns The step, in seconds.
+ */
+function defaultStep(duration) {
+    const minimum = duration / DEFAULT_MAX_POINTS;
+    const day = DEFAULT_STEPS[DEFAULT_STEPS.length - 1];
+    return (DEFAULT_STEPS.find((step) => step >= minimum) ??
+        Math.ceil(minimum / day) * day);
+}
+/**
+ * The maximum number of points in a series.
+ */
+const MAX_POINTS = 10000;
+export default async function call() {
+    const metric = this.findMetric();
+    if (!metric) {
+        throw new Error(`The metric '${this.metric}' of node '${this.node}' is not read from Cloud Monitoring.`);
+    }
+    const { start: requestedStart } = this;
+    if (isNaN(this.end.getTime()) || isNaN(requestedStart.getTime())) {
+        throw new Error('The start and end of the series must be valid dates.');
+    }
+    const end = monitoringEnd(this.end);
+    const duration = (end.getTime() - requestedStart.getTime()) / 1000;
+    const requestedStep = this.step ?? defaultStep(duration);
+    if (!Number.isInteger(requestedStep) ||
+        requestedStep < MIN_ALIGNMENT_PERIOD) {
+        throw new Error(`The step must be a whole number of seconds, of at least ${MIN_ALIGNMENT_PERIOD} seconds.`);
+    }
+    const requestedCount = Math.floor(duration / requestedStep);
+    if (requestedCount < 1 || requestedCount > MAX_POINTS) {
+        throw new Error(`The series must contain between 1 and ${MAX_POINTS} points, but contains ${Math.max(requestedCount, 0)}.`);
+    }
+    // Metrics sampled less often than the step are read with a larger step, and at least one point, as for the
+    // point-in-time value.
+    const step = Math.max(requestedStep, metric.minPeriod ?? 0);
+    const count = step === requestedStep
+        ? requestedCount
+        : Math.max(Math.floor(duration / step), 1);
+    if (!this.graph.environment) {
+        throw new Error('The graph must be enriched with environment data to fetch a series.');
+    }
+    const environment = await GraphEnvironmentContext.forEnrichedGraph(this._context, this.graph);
+    const layouts = new BucketLayoutRegistry();
+    // Warnings, e.g. about time series relating to resources missing from the graph, don't affect the values.
+    const { values, groupBy, errors } = await queryMonitoringMetric(environment, metric, { end, period: step, count }, layouts, { nodes: [this.node] });
+    if (errors.length > 0) {
+        throw new Error(errors.map((e) => e.message).join(' '));
+    }
+    const points = values.get(this.node) ?? new Array(count).fill(undefined);
+    const start = new Date(end.getTime() - count * step * 1000);
+    return {
+        start,
+        step,
+        values: points.map((p) => p?.value ?? null),
+        ...(groupBy
+            ? {
+                groupBy,
+                groups: seriesGroups(points, monitoringMetricKind(metric) === GraphMetricKind.Rate ? 0 : null),
+            }
+            : {}),
+        bucketLayouts: layouts.all,
+    };
+}
+/**
+ * Returns the series of each group, from the points of the series.
+ *
+ * @param points The points of the series.
+ * @param missing The value of a group in a period where the point exists but not the group, e.g. `0` for rates.
+ * @returns The series of each group, sorted by key.
+ */
+function seriesGroups(points, missing) {
+    const groups = new Map();
+    points.forEach((point, index) => {
+        for (const { key, value } of point?.groups ?? []) {
+            const serialized = JSON.stringify(key);
+            const group = groups.get(serialized) ?? {
+                key,
+                values: points.map((p) => (p ? missing : null)),
+            };
+            groups.set(serialized, group);
+            group.values[index] = value;
+        }
+    });
+    return [...groups.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([, group]) => group);
+}

package/dist/functions/graph/fetch-environment-metric-series.d.ts

@@ -0,0 +1,23 @@
+import { GraphFetchEnvironmentMetricSeries, type GraphMetricSeries } from '@causa/workspace-core';
+import { type GraphNodeEntry } from '@causa/workspace-core/graph';
+import { type MonitoringMetric } from '../../graph/environment/monitoring-catalog.js';
+/**
+ * Implements {@link GraphFetchEnvironmentMetricSeries} for the metrics read from Cloud Monitoring.
+ */
+export declare class GraphFetchEnvironmentMetricSeriesForGoogle extends GraphFetchEnvironmentMetricSeries {
+    _call(): Promise<GraphMetricSeries>;
+    /**
+     * Returns the requested node, from the graph.
+     *
+     * @returns The node, or `undefined` if it does not exist.
+     */
+    findNode(): GraphNodeEntry | undefined;
+    /**
+     * Returns the Cloud Monitoring metric providing the requested metric of the node.
+     *
+     * @returns The metric, or `undefined` if the node does not exist, has no resource, or the metric is not read from
+     *   Cloud Monitoring for it.
+     */
+    findMetric(): MonitoringMetric | undefined;
+    _supports(): boolean;
+}

package/dist/functions/graph/fetch-environment-metric-series.js

@@ -0,0 +1,40 @@
+import { callDeferred } from '@causa/workspace';
+import { GraphFetchEnvironmentMetricSeries, } from '@causa/workspace-core';
+import { listGraphNodes, } from '@causa/workspace-core/graph';
+import { MONITORING_METRICS, } from '../../graph/environment/monitoring-catalog.js';
+/**
+ * Implements {@link GraphFetchEnvironmentMetricSeries} for the metrics read from Cloud Monitoring.
+ */
+export class GraphFetchEnvironmentMetricSeriesForGoogle extends GraphFetchEnvironmentMetricSeries {
+    async _call() {
+        return await callDeferred(this, import.meta.url);
+    }
+    /**
+     * Returns the requested node, from the graph.
+     *
+     * @returns The node, or `undefined` if it does not exist.
+     */
+    findNode() {
+        return listGraphNodes(this.graph).find((n) => n.id === this.node);
+    }
+    /**
+     * Returns the Cloud Monitoring metric providing the requested metric of the node.
+     *
+     * @returns The metric, or `undefined` if the node does not exist, has no resource, or the metric is not read from
+     *   Cloud Monitoring for it.
+     */
+    findMetric() {
+        const node = this.findNode();
+        const resource = node?.node.data?.resource;
+        if (!node || typeof resource?.id !== 'string') {
+            return undefined;
+        }
+        return MONITORING_METRICS.find((m) => m.metric === this.metric &&
+            m.mapping.nodeType === node.type &&
+            m.mapping.resourceType === resource.type &&
+            (!m.measures || m.measures(node, this.graph)));
+    }
+    _supports() {
+        return !!this.findMetric();
+    }
+}

package/dist/functions/graph/get-environment-provider.d.ts

@@ -0,0 +1,11 @@
+import { GraphGetEnvironmentProvider, type GraphEnvironmentProvider } from '@causa/workspace-core';
+/**
+ * Implements {@link GraphGetEnvironmentProvider} for Google Cloud.
+ * The fetchers read metrics and alerts from Cloud Monitoring, open error groups from Error Reporting as alerts, the
+ * state of Cloud Run services and Cloud Scheduler jobs, and build links to the Google Cloud console. Cloud Tasks
+ * queues, only known by a prefix of their name, are resolved by listing them.
+ */
+export declare class GraphGetEnvironmentProviderForGoogle extends GraphGetEnvironmentProvider {
+    _call(): GraphEnvironmentProvider;
+    _supports(): boolean;
+}

package/dist/functions/graph/get-environment-provider.js

@@ -0,0 +1,20 @@
+import { GraphGetEnvironmentProvider, } from '@causa/workspace-core';
+import { CLOUD_TASKS_QUEUE_RESOLVER, GOOGLE_GRAPH_ENVIRONMENT_FETCHERS, GOOGLE_GRAPH_METRIC_DEFINITIONS, } from '../../graph/index.js';
+/**
+ * Implements {@link GraphGetEnvironmentProvider} for Google Cloud.
+ * The fetchers read metrics and alerts from Cloud Monitoring, open error groups from Error Reporting as alerts, the
+ * state of Cloud Run services and Cloud Scheduler jobs, and build links to the Google Cloud console. Cloud Tasks
+ * queues, only known by a prefix of their name, are resolved by listing them.
+ */
+export class GraphGetEnvironmentProviderForGoogle extends GraphGetEnvironmentProvider {
+    _call() {
+        return {
+            metrics: GOOGLE_GRAPH_METRIC_DEFINITIONS,
+            prefixResolvers: [CLOUD_TASKS_QUEUE_RESOLVER],
+            fetchers: GOOGLE_GRAPH_ENVIRONMENT_FETCHERS,
+        };
+    }
+    _supports() {
+        return true;
+    }
+}

package/dist/functions/graph/index.d.ts

@@ -1 +1,3 @@
+export { GraphFetchEnvironmentMetricSeriesForGoogle } from './fetch-environment-metric-series.js';
+export { GraphGetEnvironmentProviderForGoogle } from './get-environment-provider.js';
 export { GraphListRulesForGoogle } from './list-rules.js';

package/dist/functions/graph/index.js

@@ -1 +1,3 @@
+export { GraphFetchEnvironmentMetricSeriesForGoogle } from './fetch-environment-metric-series.js';
+export { GraphGetEnvironmentProviderForGoogle } from './get-environment-provider.js';
 export { GraphListRulesForGoogle } from './list-rules.js';

package/dist/functions/index.js

@@ -8,11 +8,11 @@ import { GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenera
 import { GooglePubSubWriteTopics } from './google-pubsub/index.js';
 import { GoogleServicesEnable } from './google-services/index.js';
 import { DatabaseQueryRecordsForSpanner, GoogleSpannerListDatabases, GoogleSpannerWriteDatabases, ModelGenerateTypeScriptDecoratorsForGoogleSpanner, ModelSchemaExtractDatabaseForGoogleSpanner, } from './google-spanner/index.js';
-import { GraphListRulesForGoogle } from './graph/index.js';
+import { GraphFetchEnvironmentMetricSeriesForGoogle, GraphGetEnvironmentProviderForGoogle, GraphListRulesForGoogle, } from './graph/index.js';
 import { ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, } from './project/index.js';
 import { SecretFetchForGoogleAccessToken, SecretFetchForGoogleSecretManager, } from './secret/index.js';
 import { ServiceContainerQueryLogsForCloudRun } from './service-container/index.js';
 import { ModelGenerateTypeScriptTriggerDecoratorsForGoogle } from './typescript/index.js';
 export function registerFunctions(context) {
-    context.registerFunctionImplementations(CausaListConfigurationSchemasForGoogle, DatabaseQueryRecordsForFirestore, DatabaseQueryRecordsForSpanner, EmulatorStartForFirebaseStorage, EmulatorStartForFirestore, EmulatorStartForIdentityPlatform, EmulatorStartForPubSub, EmulatorStartForSpanner, EmulatorStopForFirebaseStorage, EmulatorStopForFirestore, EmulatorStopForIdentityPlatform, EmulatorStopForPubSub, EmulatorStopForSpanner, EventTopicBrokerCreateTopicForPubSub, EventTopicBrokerCreateTriggerForCloudRun, EventTopicBrokerDeleteTopicForPubSub, EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole, EventTopicBrokerDeleteTriggerResourceForCloudRunService, EventTopicBrokerDeleteTriggerResourceForPubSubSubscription, EventTopicBrokerDeleteTriggerResourceForServiceAccount, EventTopicBrokerGetTopicIdForPubSub, EventTopicBrokerPublishEventsForGoogle, EventTopicBrokerWaitForProcessingForPubSub, EventTopicCreateBackfillSourceForBigQuery, EventTopicQueryEventsForBigQuery, GoogleAppCheckGenerateToken, GoogleFirebaseStorageMergeRules, GoogleFirestoreMergeRules, GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenerateToken, GooglePubSubWriteTopics, GoogleServicesEnable, GoogleSpannerListDatabases, GoogleSpannerWriteDatabases, GraphListRulesForGoogle, ModelGenerateTypeScriptDecoratorsForGoogleFirestore, ModelGenerateTypeScriptDecoratorsForGoogleSpanner, ModelGenerateTypeScriptTriggerDecoratorsForGoogle, ModelSchemaExtractDatabaseForGoogleFirestore, ModelSchemaExtractDatabaseForGoogleSpanner, ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, SecretFetchForGoogleAccessToken, SecretFetchForGoogleSecretManager, ServiceContainerQueryLogsForCloudRun);
+    context.registerFunctionImplementations(CausaListConfigurationSchemasForGoogle, DatabaseQueryRecordsForFirestore, DatabaseQueryRecordsForSpanner, EmulatorStartForFirebaseStorage, EmulatorStartForFirestore, EmulatorStartForIdentityPlatform, EmulatorStartForPubSub, EmulatorStartForSpanner, EmulatorStopForFirebaseStorage, EmulatorStopForFirestore, EmulatorStopForIdentityPlatform, EmulatorStopForPubSub, EmulatorStopForSpanner, EventTopicBrokerCreateTopicForPubSub, EventTopicBrokerCreateTriggerForCloudRun, EventTopicBrokerDeleteTopicForPubSub, EventTopicBrokerDeleteTriggerResourceForCloudRunInvokerRole, EventTopicBrokerDeleteTriggerResourceForCloudRunService, EventTopicBrokerDeleteTriggerResourceForPubSubSubscription, EventTopicBrokerDeleteTriggerResourceForServiceAccount, EventTopicBrokerGetTopicIdForPubSub, EventTopicBrokerPublishEventsForGoogle, EventTopicBrokerWaitForProcessingForPubSub, EventTopicCreateBackfillSourceForBigQuery, EventTopicQueryEventsForBigQuery, GoogleAppCheckGenerateToken, GoogleFirebaseStorageMergeRules, GoogleFirestoreMergeRules, GoogleIdentityPlatformGenerateCustomToken, GoogleIdentityPlatformGenerateToken, GooglePubSubWriteTopics, GoogleServicesEnable, GoogleSpannerListDatabases, GoogleSpannerWriteDatabases, GraphFetchEnvironmentMetricSeriesForGoogle, GraphGetEnvironmentProviderForGoogle, GraphListRulesForGoogle, ModelGenerateTypeScriptDecoratorsForGoogleFirestore, ModelGenerateTypeScriptDecoratorsForGoogleSpanner, ModelGenerateTypeScriptTriggerDecoratorsForGoogle, ModelSchemaExtractDatabaseForGoogleFirestore, ModelSchemaExtractDatabaseForGoogleSpanner, ProjectGetArtefactDestinationForCloudFunctions, ProjectGetArtefactDestinationForCloudRun, ProjectPushArtefactForCloudFunctions, SecretFetchForGoogleAccessToken, SecretFetchForGoogleSecretManager, ServiceContainerQueryLogsForCloudRun);
 }

package/dist/graph/cloud-run.d.ts

@@ -1,5 +1,5 @@
 import type { ServiceContainerConfiguration } from '@causa/workspace-core';
-import { GraphFact, type GraphContext, type GraphFactOutput, type GraphTemplatePart, type WorkspaceProject } from '@causa/workspace-core/graph';
+import { GraphExtractionFact, type GraphContext, type GraphFactOutput, type GraphTemplatePart, type WorkspaceProject } from '@causa/workspace-core/graph';
 import { type TerraformModuleBlock } from '@causa/workspace-terraform';
 /**
  * A trigger defined in the `serviceContainer.triggers` configuration.
@@ -83,7 +83,7 @@ export type CloudRunService = {
  * The blocks of the Cloud Run module, evaluated against the configuration of the projects they deploy.
  * Blocks whose `configuration_file` does not name a project of the workspace cannot be mirrored, and are reported.
  */
-export declare class CloudRunFact extends GraphFact<CloudRunService[]> {
+export declare class CloudRunFact extends GraphExtractionFact<CloudRunService[]> {
     compute(graph: GraphContext): Promise<GraphFactOutput<CloudRunService[]>>;
     /**
      * Evaluates a Cloud Run module block, mirroring the defaults of the module.

package/dist/graph/cloud-run.js

@@ -1,4 +1,4 @@
-import { GraphFact, ProjectsFact, serviceId, } from '@causa/workspace-core/graph';
+import { GraphExtractionFact, ProjectsFact, serviceId, } from '@causa/workspace-core/graph';
 import { modulesWithSource, TerraformProjectsFact, } from '@causa/workspace-terraform';
 import { argumentOrConfiguration, projectOfConfigurationFile, } from './terraform-modules.js';
 /**
@@ -13,7 +13,7 @@ const MIRRORED_CLOUD_RUN_MAJOR = 1;
  * The blocks of the Cloud Run module, evaluated against the configuration of the projects they deploy.
  * Blocks whose `configuration_file` does not name a project of the workspace cannot be mirrored, and are reported.
  */
-export class CloudRunFact extends GraphFact {
+export class CloudRunFact extends GraphExtractionFact {
     async compute(graph) {
         const [terraformProjects, projects] = await Promise.all([
             graph.get(TerraformProjectsFact),

package/dist/graph/environment/fetchers/cloud-monitoring-alerts.d.ts

@@ -0,0 +1,6 @@
+import { type GraphEnvironmentFetcher } from '@causa/workspace-core';
+/**
+ * Reads the alerts open at the end of the evaluation window from Cloud Monitoring, and attaches them to the nodes of
+ * their resources.
+ */
+export declare const googleCloudMonitoringAlerts: GraphEnvironmentFetcher;

package/dist/graph/environment/fetchers/cloud-monitoring-alerts.js

@@ -0,0 +1,106 @@
+import { GraphAlertSeverity, } from '@causa/workspace-core';
+import { alertLabelValue, listOpenAlerts, } from '../monitoring-alerts.js';
+import { MONITORING_RESOURCE_MAPPINGS } from '../monitoring-catalog.js';
+import { findMonitoredNode, prepareMonitoringMapping, readMonitoringResourceKey, } from '../monitoring-mappings.js';
+import { googleResources } from '../resources.js';
+import { consoleUrl } from './console-links.js';
+/**
+ * The severities of alerts, keyed by the severity of their policy.
+ */
+const SEVERITIES = {
+    CRITICAL: GraphAlertSeverity.Critical,
+    ERROR: GraphAlertSeverity.Error,
+    WARNING: GraphAlertSeverity.Warning,
+};
+/**
+ * Converts an alert returned by the Alerts API to a {@link GraphAlert}.
+ *
+ * @param alert The alert.
+ * @param project The GCP project from which the alert was listed.
+ * @returns The alert.
+ */
+function toGraphAlert(alert, project) {
+    const severity = SEVERITIES[alert.policy?.severity ?? ''];
+    const id = alert.name?.split('/').at(-1);
+    return {
+        title: alert.policy?.displayName,
+        ...(severity ? { severity } : {}),
+        openedAt: new Date(alert.openTime),
+        ...(id
+            ? { url: consoleUrl(['monitoring', 'alerting', 'alerts', id], project) }
+            : {}),
+    };
+}
+/**
+ * Describes the resource of an alert in a warning.
+ *
+ * @param resource The resource of the alert.
+ * @returns The description.
+ */
+function describeResource(resource) {
+    if (!resource) {
+        return 'a resource of unknown type';
+    }
+    const labels = Object.entries(resource.labels)
+        .filter(([name]) => name !== 'value' && name !== 'monitored_resource')
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([name, value]) => `${name}=${value}`);
+    return `the '${resource.type}' resource (${labels.join(', ')})`;
+}
+/**
+ * Reads the alerts open at the end of the evaluation window from Cloud Monitoring, and attaches them to the nodes of
+ * their resources.
+ */
+export const googleCloudMonitoringAlerts = {
+    name: 'googleCloudMonitoringAlerts',
+    description: "The `alerts` open at the end of the evaluation window, read from Cloud Monitoring in the projects of the graph's resources, and attached to the nodes of their resources. Alerts that cannot be attached to a node are added to the environment.",
+    fetch: async (environment) => {
+        const projects = [
+            ...new Set(googleResources(environment).map(({ segments }) => segments.projects)),
+        ]
+            .filter((p) => !!p)
+            .sort();
+        const warnings = [];
+        const listed = await Promise.all(projects.map(async (project) => {
+            try {
+                return await listOpenAlerts(environment.context, project, environment.at);
+            }
+            catch (error) {
+                warnings.push({
+                    message: `Failed to list the alerts in project '${project}': ${error.message ?? error}`,
+                });
+                return [];
+            }
+        }));
+        const alerts = listed.flat();
+        if (alerts.length === 0) {
+            return { warnings };
+        }
+        // Only the mappings that may apply to an alert are prepared, as preparing a mapping may require listing resources,
+        // e.g. the backends of load balancers.
+        const candidates = (await Promise.all(MONITORING_RESOURCE_MAPPINGS.filter((mapping) => alerts.some(({ resource }) => resource?.type === mapping.monitoredResource &&
+            readMonitoringResourceKey(mapping, resource.project, (label) => alertLabelValue(resource, label)))).map((mapping) => prepareMonitoringMapping(environment, mapping)))).filter((m) => !!m);
+        const nodes = {};
+        const unattached = [];
+        for (const { alert, project, resource } of alerts) {
+            const graphAlert = toGraphAlert(alert, project);
+            const { node } = resource
+                ? findMonitoredNode(environment, candidates.filter(({ mapping }) => mapping.monitoredResource === resource.type), resource.project, (label) => alertLabelValue(resource, label))
+                : {};
+            if (node) {
+                nodes[node.id] ??= { alerts: [] };
+                nodes[node.id].alerts.push(graphAlert);
+                continue;
+            }
+            unattached.push(graphAlert);
+            warnings.push({
+                message: `The alert of policy '${graphAlert.title}' on ${describeResource(resource)} could not be attached to a node, and is added to the environment.`,
+            });
+        }
+        return {
+            nodes,
+            ...(unattached.length > 0 ? { alerts: unattached } : {}),
+            warnings,
+        };
+    },
+};

package/dist/graph/environment/fetchers/cloud-monitoring.d.ts

@@ -0,0 +1,5 @@
+import type { GraphEnvironmentFetcher } from '@causa/workspace-core';
+/**
+ * Reads the metrics of nodes from Cloud Monitoring, over the evaluation window.
+ */
+export declare const googleCloudMonitoring: GraphEnvironmentFetcher;

package/dist/graph/environment/fetchers/cloud-monitoring.js

@@ -0,0 +1,13 @@
+import { MONITORING_METRICS } from '../monitoring-catalog.js';
+import { queryPointInTimeMetrics } from '../monitoring-query.js';
+/**
+ * Reads the metrics of nodes from Cloud Monitoring, over the evaluation window.
+ */
+export const googleCloudMonitoring = {
+    name: 'googleCloudMonitoring',
+    description: 'The metrics of Cloud Run services, API routers, Pub/Sub topics and subscriptions, Cloud Tasks queues, and Spanner, Firestore, and BigQuery databases, read from Cloud Monitoring.',
+    fetch: async (environment) => {
+        const { nodes, bucketLayouts, warnings } = await queryPointInTimeMetrics(environment, MONITORING_METRICS);
+        return { nodes, bucketLayouts, warnings };
+    },
+};

package/dist/graph/environment/fetchers/cloud-run.d.ts

@@ -0,0 +1,5 @@
+import type { GraphEnvironmentFetcher } from '@causa/workspace-core';
+/**
+ * Reads the deployments of Cloud Run services.
+ */
+export declare const googleCloudRun: GraphEnvironmentFetcher;