@intentius/chant-lexicon-gcp 0.0.24 → 0.1.4

package/dist/integrity.json

@@ -1,41 +1,41 @@
 {
   "algorithm": "xxhash64",
   "artifacts": {
-    "manifest.json": "1a93f9f8be77c3c6",
+    "manifest.json": "b2c3c0befed259f3",
     "meta.json": "4b53e87923a434ef",
     "types/index.d.ts": "c7cc45a739cefe9d",
     "rules/hardcoded-region.ts": "d230565c5cc6b600",
-    "rules/hardcoded-project.ts": "8ce1e3f6f7f7d217",
     "rules/public-iam.ts": "a569c09c0402dc12",
-    "rules/wgc301.ts": "7481759f8344dc46",
+    "rules/hardcoded-project.ts": "8ce1e3f6f7f7d217",
+    "rules/wgc203.ts": "40a8831e701d4882",
+    "rules/wgc108.ts": "4ed90d7ccb04a93",
     "rules/wgc105.ts": "2e6a93ea14234e53",
-    "rules/gcp-helpers.ts": "76fcd4774c99093c",
-    "rules/wgc302.ts": "f2a5f2ea4efec1b",
+    "rules/schema-registry.ts": "6327d2dc2fed726e",
+    "rules/wgc109.ts": "58a4010d5a5e3cfc",
+    "rules/wgc103.ts": "e0a3c0606cb1fe1",
     "rules/wgc110.ts": "2a9da9543e34d8de",
     "rules/wgc201.ts": "173c4cfb020c3593",
-    "rules/wgc303.ts": "4be04d7faa6b2f1e",
-    "rules/wgc102.ts": "ee34a5b1d58643b8",
-    "rules/wgc103.ts": "e0a3c0606cb1fe1",
-    "rules/wgc108.ts": "4ed90d7ccb04a93",
-    "rules/wgc203.ts": "40a8831e701d4882",
+    "rules/wgc302.ts": "f2a5f2ea4efec1b",
     "rules/wgc111.ts": "474a4ab06596ecd0",
-    "rules/wgc202.ts": "b6036fce2553d15b",
-    "rules/wgc403.ts": "a873a8708f82f0a9",
-    "rules/wgc204.ts": "bf9cb93ace50c4b0",
-    "rules/wgc401.ts": "35fcebf42c7379c7",
-    "rules/schema-registry.ts": "6327d2dc2fed726e",
-    "rules/wgc101.ts": "170fc08848092171",
-    "rules/wgc104.ts": "56b3c40af42e9302",
     "rules/wgc112.ts": "34b22234dfca1a17",
-    "rules/wgc107.ts": "ae6dcd327490da06",
-    "rules/wgc109.ts": "58a4010d5a5e3cfc",
     "rules/wgc402.ts": "7f054e29d146290f",
+    "rules/gcp-helpers.ts": "76fcd4774c99093c",
     "rules/wgc106.ts": "180629dfc4f2934",
     "rules/wgc113.ts": "677724b28a9dbd5c",
+    "rules/wgc202.ts": "b6036fce2553d15b",
+    "rules/wgc303.ts": "4be04d7faa6b2f1e",
+    "rules/wgc107.ts": "ae6dcd327490da06",
+    "rules/wgc101.ts": "170fc08848092171",
+    "rules/wgc401.ts": "35fcebf42c7379c7",
+    "rules/wgc301.ts": "7481759f8344dc46",
+    "rules/wgc104.ts": "56b3c40af42e9302",
+    "rules/wgc403.ts": "a873a8708f82f0a9",
+    "rules/wgc102.ts": "ee34a5b1d58643b8",
+    "rules/wgc204.ts": "bf9cb93ace50c4b0",
     "skills/chant-gcp.md": "13a559014514fdb0",
     "skills/chant-gcp-security.md": "9ed168e1fb54d31b",
     "skills/chant-gcp-patterns.md": "6cd0a4a78933323c",
     "skills/chant-gcp-gke.md": "f185f6c0de514ba0"
   },
-  "composite": "2fcb40fd58eb2860"
+  "composite": "b99c7c6bb17a778c"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.0.24",
+  "version": "0.1.4",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.0.24",
+  "version": "0.1.4",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -43,11 +43,14 @@
     "prepack": "bun run generate && bun run bundle && bun run validate"
   },
   "dependencies": {
-    "@intentius/chant": "0.0.22",
     "fflate": "^0.8.2",
     "js-yaml": "^4.1.0"
   },
   "devDependencies": {
+    "@intentius/chant": "0.1.4",
     "typescript": "^5.9.3"
+  },
+  "peerDependencies": {
+    "@intentius/chant": "^0.1.0"
   }
 }

package/src/composites/cloud-sql-instance.ts

@@ -69,6 +69,12 @@ export const CloudSqlInstance = Composite<CloudSqlInstanceProps>((props) => {
     defaults: defs,
   } = props;
 
+  // K8s metadata name must be a valid DNS subdomain (no underscores).
+  // When databaseName differs from the instance name, prefix with instance name
+  // to guarantee uniqueness across instances sharing the same databaseName.
+  const sanitizedDbName = databaseName.replace(/_/g, "-");
+  const databaseK8sName = databaseName === name ? sanitizedDbName : `${name}-${sanitizedDbName}`;
+
   const commonLabels: Record<string, string> = {
     "app.kubernetes.io/name": name,
     "app.kubernetes.io/managed-by": "chant",
@@ -102,15 +108,21 @@ export const CloudSqlInstance = Composite<CloudSqlInstanceProps>((props) => {
 
   const database = new SQLDatabase(mergeDefaults({
     metadata: {
-      name: databaseName,
+      name: databaseK8sName,
       ...(namespace && { namespace }),
       labels: { ...commonLabels, "app.kubernetes.io/component": "database" },
     },
     instanceRef: { name },
+    // resourceID sets the actual Cloud SQL database name when the K8s-safe name differs
+    ...(databaseName !== sanitizedDbName && { resourceID: databaseName }),
   } as Record<string, unknown>, defs?.database));
 
   const user = new SQLUser(mergeDefaults({
     metadata: {
+      // K8s name scoped to the instance for uniqueness (e.g. "mydb-admin").
+      // Without resourceID, Config Connector uses metadata.name as the actual
+      // Cloud SQL username — so the PG username IS the K8s resource name.
+      // Callers can override via defaults.user.resourceID if a shorter name is needed.
       name: `${name}-${userName}`,
       ...(namespace && { namespace }),
       labels: { ...commonLabels, "app.kubernetes.io/component": "database" },

package/src/composites/index.ts

@@ -18,3 +18,5 @@ export { ManagedCertificate } from "./managed-certificate";
 export type { ManagedCertificateProps } from "./managed-certificate";
 export { SecureProject } from "./secure-project";
 export type { SecureProjectProps } from "./secure-project";
+export { MemorystoreRedis } from "./memorystore-redis";
+export type { MemorystoreRedisProps } from "./memorystore-redis";

package/src/composites/memorystore-redis.ts

@@ -0,0 +1,101 @@
+/**
+ * MemorystoreRedis composite — RedisInstance with purpose-driven defaults.
+ */
+
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { RedisInstance } from "../generated";
+
+export interface MemorystoreRedisProps {
+  /** Instance name. */
+  name: string;
+  /**
+   * Purpose drives the maxmemory-policy default:
+   * - "persistent" → "noeviction" (queues, shared_state must not evict)
+   * - "cache"      → "allkeys-lru" (cache/sessions can evict LRU)
+   */
+  purpose: "persistent" | "cache";
+  /** Memorystore tier (e.g. "BASIC", "STANDARD_HA"). */
+  tier: string;
+  /** Memory size in GB. */
+  memorySizeGb: number;
+  /** GCP region. */
+  region: string;
+  /** authorizedNetworkRef.name — the VPC network to authorize. */
+  networkRef: string;
+  /** Redis version (default: "REDIS_7_0"). */
+  redisVersion?: string;
+  /** Enable AUTH (default: true). */
+  authEnabled?: boolean;
+  /** Namespace for all resources. */
+  namespace?: string;
+  /** Additional labels. */
+  labels?: Record<string, string>;
+  /** Per-member defaults for customizing individual resources. */
+  defaults?: {
+    instance?: Partial<Record<string, unknown>>;
+  };
+}
+
+/**
+ * Create a MemorystoreRedis composite.
+ *
+ * @example
+ * ```ts
+ * import { MemorystoreRedis } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { instance } = MemorystoreRedis({
+ *   name: "my-app-persistent",
+ *   purpose: "persistent",
+ *   tier: "STANDARD_HA",
+ *   memorySizeGb: 5,
+ *   region: "us-central1",
+ *   networkRef: "my-vpc",
+ * });
+ * ```
+ */
+export const MemorystoreRedis = Composite<MemorystoreRedisProps>((props) => {
+  const {
+    name,
+    purpose,
+    tier,
+    memorySizeGb,
+    region,
+    networkRef,
+    redisVersion = "REDIS_7_0",
+    authEnabled = true,
+    namespace,
+    labels: extraLabels = {},
+    defaults: defs,
+  } = props;
+
+  const maxmemoryPolicy = purpose === "persistent" ? "noeviction" : "allkeys-lru";
+
+  const commonLabels: Record<string, string> = {
+    "app.kubernetes.io/name": name,
+    "app.kubernetes.io/managed-by": "chant",
+    ...extraLabels,
+  };
+
+  const instance = new RedisInstance(mergeDefaults({
+    metadata: {
+      name,
+      ...(namespace && { namespace }),
+      labels: { ...commonLabels, "app.kubernetes.io/component": "cache" },
+    },
+    region,
+    tier,
+    memorySizeGb,
+    authEnabled,
+    redisVersion,
+    connectMode: "PRIVATE_SERVICE_ACCESS",
+    authorizedNetworkRef: { name: networkRef },
+    // TLS disabled: GitLab's redis-rb client requires either no TLS or a custom CA cert
+    // injected via REDIS_SSL_CA_FILE. AUTH (authEnabled: true) provides access control.
+    transitEncryptionMode: "DISABLED",
+    redisConfigs: {
+      "maxmemory-policy": maxmemoryPolicy,
+    },
+  } as Record<string, unknown>, defs?.instance));
+
+  return { instance };
+}, "MemorystoreRedis");

package/src/composites/vpc-network.ts

@@ -5,6 +5,11 @@
 import { Composite, mergeDefaults } from "@intentius/chant";
 import { VPCNetwork, Subnetwork, Firewall, Router, RouterNAT } from "../generated";
 
+export interface VpcSubnetSecondaryRange {
+  rangeName: string;
+  ipCidrRange: string;
+}
+
 export interface VpcSubnet {
   /** Subnet name suffix. */
   name: string;
@@ -14,6 +19,8 @@ export interface VpcSubnet {
   region: string;
   /** Enable private Google access (default: true). */
   privateIpGoogleAccess?: boolean;
+  /** Secondary IP ranges for VPC-native GKE pods/services. */
+  secondaryIpRanges?: VpcSubnetSecondaryRange[];
 }
 
 export interface VpcNetworkProps {
@@ -104,6 +111,9 @@ export const VpcNetwork = Composite<VpcNetworkProps>((props) => {
       ipCidrRange: sub.ipCidrRange,
       region: sub.region,
       privateIpGoogleAccess: sub.privateIpGoogleAccess ?? true,
+      ...(sub.secondaryIpRanges && sub.secondaryIpRanges.length > 0 && {
+        secondaryIpRange: sub.secondaryIpRanges,
+      }),
     } as Record<string, unknown>);
   }
 

package/src/index.ts

@@ -22,6 +22,7 @@ export * from "./generated/index";
 export {
   GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork,
   PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject,
+  MemorystoreRedis,
 } from "./composites/index";
 export type {
   GkeClusterProps,
@@ -34,6 +35,7 @@ export type {
   PrivateServiceProps,
   ManagedCertificateProps,
   SecureProjectProps,
+  MemorystoreRedisProps,
 } from "./composites/index";
 
 // IAM role constants