@intentius/chant-lexicon-gcp 0.1.4 → 0.1.6

package/dist/integrity.json

@@ -1,41 +1,41 @@
 {
-  "algorithm": "xxhash64",
+  "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "b2c3c0befed259f3",
-    "meta.json": "4b53e87923a434ef",
-    "types/index.d.ts": "c7cc45a739cefe9d",
-    "rules/hardcoded-region.ts": "d230565c5cc6b600",
-    "rules/public-iam.ts": "a569c09c0402dc12",
-    "rules/hardcoded-project.ts": "8ce1e3f6f7f7d217",
-    "rules/wgc203.ts": "40a8831e701d4882",
-    "rules/wgc108.ts": "4ed90d7ccb04a93",
-    "rules/wgc105.ts": "2e6a93ea14234e53",
-    "rules/schema-registry.ts": "6327d2dc2fed726e",
-    "rules/wgc109.ts": "58a4010d5a5e3cfc",
-    "rules/wgc103.ts": "e0a3c0606cb1fe1",
-    "rules/wgc110.ts": "2a9da9543e34d8de",
-    "rules/wgc201.ts": "173c4cfb020c3593",
-    "rules/wgc302.ts": "f2a5f2ea4efec1b",
-    "rules/wgc111.ts": "474a4ab06596ecd0",
-    "rules/wgc112.ts": "34b22234dfca1a17",
-    "rules/wgc402.ts": "7f054e29d146290f",
-    "rules/gcp-helpers.ts": "76fcd4774c99093c",
-    "rules/wgc106.ts": "180629dfc4f2934",
-    "rules/wgc113.ts": "677724b28a9dbd5c",
-    "rules/wgc202.ts": "b6036fce2553d15b",
-    "rules/wgc303.ts": "4be04d7faa6b2f1e",
-    "rules/wgc107.ts": "ae6dcd327490da06",
-    "rules/wgc101.ts": "170fc08848092171",
-    "rules/wgc401.ts": "35fcebf42c7379c7",
-    "rules/wgc301.ts": "7481759f8344dc46",
-    "rules/wgc104.ts": "56b3c40af42e9302",
-    "rules/wgc403.ts": "a873a8708f82f0a9",
-    "rules/wgc102.ts": "ee34a5b1d58643b8",
-    "rules/wgc204.ts": "bf9cb93ace50c4b0",
-    "skills/chant-gcp.md": "13a559014514fdb0",
-    "skills/chant-gcp-security.md": "9ed168e1fb54d31b",
-    "skills/chant-gcp-patterns.md": "6cd0a4a78933323c",
-    "skills/chant-gcp-gke.md": "f185f6c0de514ba0"
+    "manifest.json": "8939a54211882426c712c23fd6cdf36237dd92741ce3b3d18227f84225e2c50c",
+    "meta.json": "2bc3713e9e01e90832d18dedaf4bf544dd4d8fe32f1363f7e95dc711d3d76e9d",
+    "types/index.d.ts": "0554f7e883c6216ba735cbe79a8534ccad762bea28cc4d4c4884f8760a2f1dd3",
+    "rules/hardcoded-project.ts": "228631d3159e1ffcce2359c66073d4ae59bb0285f378e46e446f416aec50481c",
+    "rules/hardcoded-region.ts": "9135e337202d44787e93243811a942f2209627ce522f27a6f3c7c0ad0e2e3545",
+    "rules/public-iam.ts": "bf2fe502ad5bfb077bdb3039a6bb228a3214cff2769996d65362bc3f7c5bb730",
+    "rules/gcp-helpers.ts": "0420adb73527b29a288e219b24742f4f29ef83859228d61fdaff83b1fb800bf1",
+    "rules/schema-registry.ts": "825862c574f0291b07f46478018874556a190940a1653b24e9dec9f1427d8d8b",
+    "rules/wgc101.ts": "679f245ea4665d687848382ff1b934ae133a3c320cc051011cc4d95802e66b38",
+    "rules/wgc102.ts": "22cb997d40a59ce3e0ff833ce946a5571e13d4811b255d4b67db570d58575e07",
+    "rules/wgc103.ts": "589741dbe5828508b5424a74f63f0202ba8452237c366173af283073f81e0317",
+    "rules/wgc104.ts": "5e1a74ffae157296de4882e4d0693146a24d43f3f59f5db80f4b0faf2da230a3",
+    "rules/wgc105.ts": "7208632ce9bc264c597453f1bd5e62f3569207e4e2f988ebb8f0451f3d714184",
+    "rules/wgc106.ts": "916c199b2b1ce064f9e15bcdd0a052e9eb64cb79eb79d03aeae58708b1e894e3",
+    "rules/wgc107.ts": "022474be5f9150c6f352ebbfa5ee9bbe37d2389bfc23bd091c5bedaa7f28a7c3",
+    "rules/wgc108.ts": "170db62ee6af7d5c9f25e1bde9fb308e074178192291992360a77407edec7486",
+    "rules/wgc109.ts": "468b889c6d2bf804e0e214daa0007b5a2f9a8c0d614b57134ac5be9739b7a2a2",
+    "rules/wgc110.ts": "632f692c6e67efad14e24edd1f1cb41d11faefa8d77efcd4e4af93ff2605be3a",
+    "rules/wgc111.ts": "7bb8d5c4121d4038b2089728f3c8ae7f5306163101d157ceccc78a982a9be872",
+    "rules/wgc112.ts": "d6ff610929ee9c85b0f3c455de83ab1c1f984a5c6f9a0b2989ba2cd50e74e4f8",
+    "rules/wgc113.ts": "59d40d6f433b2e448ed895775d3dbbcfad22c3ac41b08c7a32d49474a3973c2a",
+    "rules/wgc201.ts": "96a4ab92c4d7f0ed4f33dc44b7ab64b5ec4ccdd48f24fd69374be79e33769781",
+    "rules/wgc202.ts": "44e4231a9e6ed7e5917506d8d60554cf0ec0e64f148ba7a7ad739cb8bb9e51a0",
+    "rules/wgc203.ts": "716b45cb305634927840623a5dfd8b6c0375420be25096902ab1e5bd0ff71671",
+    "rules/wgc204.ts": "6a0fea0a0e002065fbb5ce11f29dea183b98ec70134987fa1889731235ab4f70",
+    "rules/wgc301.ts": "a7b1ec58d4582911bfef7f82fd83a97706525c2173e2843958f2e62cdaa3fc2a",
+    "rules/wgc302.ts": "94423099c34e1c2193966920a441cb7af80b1048720bdca1263f444dc666b941",
+    "rules/wgc303.ts": "70cdf211020b6bcf3d62d46368d3e753911700ec76478d4a2bb788f75d608c20",
+    "rules/wgc401.ts": "287a28258a6987eacf4228df8e57cdc6d5357d5efcb35a732fb01e4b7b8ce797",
+    "rules/wgc402.ts": "4dacefea0ead25987ded5f8f5b83d02d2aa957f3816a7d0cc602cc9872257458",
+    "rules/wgc403.ts": "156a8af8f8e419d36e740f4fc6f2ed7576a1692e3286e4c9ca6f9e9ccf772965",
+    "skills/chant-gcp.md": "6fd732fb5df2fd6561b4b704379f6779ff4ac12e3069ea4f641d9b222e0c3c81",
+    "skills/chant-gcp-security.md": "39a1c97b7425ed43b081257132449d11ce9d12f2d4755fc30d8b14bbc38f60bd",
+    "skills/chant-gcp-patterns.md": "a7ef31c1eb2f7244d3f73952c300472ef94c1eb09bd7a1003281b89299b6b704",
+    "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "b99c7c6bb17a778c"
+  "composite": "a66d209a7b1a390307e1603ac89a5552e0bd6b095fe7c49ee968a4cb7640d8d6"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -36,18 +36,18 @@
     "./types": "./dist/types/index.d.ts"
   },
   "scripts": {
-    "generate": "bun run src/codegen/generate-cli.ts",
-    "bundle": "bun run src/package-cli.ts",
-    "validate": "bun run src/validate-cli.ts",
-    "docs": "bun run src/codegen/docs-cli.ts",
-    "prepack": "bun run generate && bun run bundle && bun run validate"
+    "generate": "tsx src/codegen/generate-cli.ts",
+    "bundle": "tsx src/package-cli.ts",
+    "validate": "tsx src/validate-cli.ts",
+    "docs": "tsx src/codegen/docs-cli.ts",
+    "prepack": "npm run generate && npm run bundle && npm run validate"
   },
   "dependencies": {
     "fflate": "^0.8.2",
     "js-yaml": "^4.1.0"
   },
   "devDependencies": {
-    "@intentius/chant": "0.1.4",
+    "@intentius/chant": "*",
     "typescript": "^5.9.3"
   },
   "peerDependencies": {

package/src/codegen/docs-cli.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env bun
+#!/usr/bin/env tsx
 import { generateDocs } from "./docs";
 
 generateDocs({ verbose: true }).catch((err) => {

package/src/codegen/docs.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { generateDocs } from "./docs";
 
 describe("generateDocs", () => {

package/src/codegen/docs.ts

@@ -200,7 +200,9 @@ export const reader = new IAMPolicyMember({
         slug: "config-connector-concepts",
         title: "Config Connector Concepts",
         description: "Resource structure, resourceRef, project binding, reconciliation lifecycle",
-        content: `Every exported resource declaration becomes a Config Connector manifest document in the generated YAML.
+        content: `import Diagram from '../../components/Diagram.astro';
+
+Every exported resource declaration becomes a Config Connector manifest document in the generated YAML.
 
 ## Resource structure
 
@@ -257,6 +259,8 @@ This injects the project annotation into every resource. Without it, Config Conn
 
 Config Connector resources go through a reconciliation lifecycle:
 
+<Diagram name="config-connector-lifecycle" alt="Config Connector state machine: YAML applied to kubectl, then Pending → Reconciling → UpToDate, UpdateFailed, or DependencyNotReady with retry paths" caption="Config Connector reconciliation lifecycle" />
+
 | Status | Meaning |
 |--------|---------|
 | UpToDate | Resource matches desired state |

package/src/codegen/generate-cli.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env bun
+#!/usr/bin/env tsx
 /**
  * CLI entry point for GCP lexicon generation.
  */

package/src/codegen/generate.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { generate } from "./generate";
 
 describe("generate", () => {

package/src/codegen/naming.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { NamingStrategy } from "./naming";
 import type { GcpParseResult } from "../spec/parse";
 

package/src/codegen/package.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { packageLexicon } from "./package";
 
 describe("packageLexicon", () => {

package/src/codegen/package.ts

@@ -3,9 +3,8 @@
  * with GCP-specific manifest building and skill collection.
  */
 
-import { createRequire } from "module";
 import { readFileSync } from "fs";
-const require = createRequire(import.meta.url);
+import { gcpPlugin } from "../plugin";
 import { dirname } from "path";
 import { fileURLToPath } from "url";
 import {
@@ -32,8 +31,6 @@ export async function packageLexicon(opts: PackageOptions = {}): Promise<Package
       generate: (genOpts) => generate({ verbose: genOpts.verbose, force: genOpts.force }),
 
       buildManifest: (_genResult) => {
-        const { gcpPlugin } = require("../plugin");
-
         const pseudoParams: string[] = gcpPlugin.pseudoParameters?.() ?? [];
         const pseudoParameters: Record<string, string> = {};
         for (const p of pseudoParams) {
@@ -53,9 +50,7 @@ export async function packageLexicon(opts: PackageOptions = {}): Promise<Package
 
       srcDir: pkgDir,
 
-      collectSkills: () => {
-        const { gcpPlugin } = require("../plugin");
-        const skillDefs = gcpPlugin.skills?.() ?? [];
+      collectSkills: () => {        const skillDefs = gcpPlugin.skills?.() ?? [];
         return collectSkills(skillDefs);
       },
 

package/src/composites/composites.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { GkeCluster } from "./gke-cluster";
 import { CloudRunServiceComposite } from "./cloud-run-service";
 import { CloudSqlInstance } from "./cloud-sql-instance";

package/src/composites/gke-crdb-region.ts

@@ -0,0 +1,232 @@
+/**
+ * GkeCrdbRegion composite — GKE cluster + public DNS zone + per-region IAM for a CockroachDB region.
+ *
+ * Replaces the 2-file per-region GCP infra pattern (infra/cluster.ts + infra/dns.ts) with
+ * a single composite call. Handles the GKE cluster, the public DNS zone, and all per-region
+ * Workload Identity IAM bindings for both ExternalDNS and CockroachDB pods.
+ */
+
+import { Composite } from "@intentius/chant";
+import { GkeCluster } from "./gke-cluster";
+import { DNSManagedZone, GCPServiceAccount, IAMPolicyMember } from "../generated";
+
+export interface GkeCrdbRegionNodeConfig {
+  /** Machine type (default: "n2-standard-2"). */
+  machineType?: string;
+  /** Disk size per node in GB (default: 100). */
+  diskSizeGb?: number;
+  /** Initial/min node count (default: 1). */
+  nodeCount?: number;
+  /** Maximum node count for autoscaling (default: 3). */
+  maxNodeCount?: number;
+}
+
+export interface GkeCrdbRegionConfig {
+  /**
+   * GCP region (e.g. "us-east4").
+   * Used as both the cluster location and for NAT router naming.
+   */
+  region: string;
+  /** GKE cluster name (e.g. "gke-crdb-east"). Used as prefix for child resources. */
+  clusterName: string;
+  /** VPC network resource name. */
+  network: string;
+  /** Node subnet resource name for the cluster. */
+  subnetwork: string;
+  /** Public DNS domain for this region (e.g. "east.crdb.example.com"). */
+  domain: string;
+  /** GCP project ID for Workload Identity pool and service account names. */
+  project: string;
+  /**
+   * K8s namespace where CockroachDB pods run (e.g. "crdb-east").
+   * Used in the Workload Identity binding subject for CRDB pods.
+   */
+  crdbNamespace: string;
+  /**
+   * K8s ServiceAccount name for CockroachDB pods (default: "cockroachdb").
+   * Used in the Workload Identity binding subject.
+   */
+  crdbK8sSa?: string;
+  /**
+   * CIDR block for the GKE master's private endpoint (e.g. "172.16.0.0/28").
+   * Must be /28, unique per cluster, not overlapping with node/pod CIDRs.
+   */
+  masterCidr?: string;
+  /** Node pool configuration. */
+  nodeConfig?: GkeCrdbRegionNodeConfig;
+  /** GCP release channel for cluster upgrades (default: "REGULAR"). */
+  releaseChannel?: "RAPID" | "REGULAR" | "STABLE";
+  /** Optional backup bucket name to grant CRDB GSA storage.objectAdmin access. */
+  backupBucket?: string;
+  /** Additional labels for all resources. */
+  labels?: Record<string, string>;
+  /** Namespace for Config Connector resources. */
+  namespace?: string;
+}
+
+/**
+ * Create a GkeCrdbRegion composite — returns all GCP resources for one CockroachDB region:
+ * GKE cluster, public DNS zone, per-region GSAs, and Workload Identity IAM bindings.
+ *
+ * @example
+ * ```ts
+ * import { GkeCrdbRegion } from "@intentius/chant-lexicon-gcp";
+ *
+ * export const east = GkeCrdbRegion({
+ *   region: "us-east4",
+ *   clusterName: "gke-crdb-east",
+ *   network: "crdb-multi-region",
+ *   subnetwork: "crdb-multi-region-east-nodes",
+ *   domain: "east.crdb.example.com",
+ *   project: GCP_PROJECT_ID,
+ *   crdbNamespace: "crdb-east",
+ *   masterCidr: "172.16.0.0/28",
+ * });
+ * ```
+ */
+export const GkeCrdbRegion = Composite<GkeCrdbRegionConfig>((props) => {
+  const {
+    region,
+    clusterName,
+    network,
+    subnetwork,
+    domain,
+    project,
+    crdbNamespace,
+    crdbK8sSa = "cockroachdb",
+    masterCidr = "172.16.0.0/28",
+    nodeConfig = {},
+    releaseChannel = "REGULAR",
+    backupBucket,
+    labels: extraLabels = {},
+    namespace,
+  } = props;
+
+  const {
+    machineType = "n2-standard-2",
+    diskSizeGb = 100,
+    nodeCount = 1,
+    maxNodeCount = 3,
+  } = nodeConfig;
+
+  const commonLabels: Record<string, string> = {
+    "app.kubernetes.io/name": clusterName,
+    "app.kubernetes.io/managed-by": "chant",
+    ...extraLabels,
+  };
+
+  const meta = (component: string, resourceName: string) => ({
+    name: resourceName,
+    ...(namespace && { namespace }),
+    labels: { ...commonLabels, "app.kubernetes.io/component": component },
+  });
+
+  // ── GKE Cluster ──────────────────────────────────────────────────────────────
+
+  const { cluster, nodePool, defaultPool } = GkeCluster({
+    name: clusterName,
+    location: region,
+    machineType,
+    diskSizeGb,
+    initialNodeCount: nodeCount,
+    minNodeCount: nodeCount,
+    maxNodeCount,
+    network,
+    subnetwork,
+    workloadIdentity: true,
+    privateNodes: true,
+    masterCidr,
+    releaseChannel,
+    labels: extraLabels,
+    ...(namespace && { namespace }),
+  });
+
+  // ── Public DNS Zone ───────────────────────────────────────────────────────────
+
+  const dnsZoneName = `${clusterName}-zone`;
+
+  const dnsZone = new DNSManagedZone({
+    metadata: meta("dns", dnsZoneName),
+    dnsName: `${domain}.`,
+    description: `CockroachDB ${region} UI — managed by chant`,
+  } as Record<string, unknown>);
+
+  // ── ExternalDNS Service Account ───────────────────────────────────────────────
+
+  const dnsGsaName = `${clusterName}-dns`;
+
+  const dnsGsa = new GCPServiceAccount({
+    metadata: meta("iam", dnsGsaName),
+    displayName: `CockroachDB ${region} ExternalDNS workload identity`,
+  } as Record<string, unknown>);
+
+  const dnsWiBinding = new IAMPolicyMember({
+    metadata: meta("iam", `${dnsGsaName}-wi`),
+    member: `serviceAccount:${project}.svc.id.goog[kube-system/external-dns-sa]`,
+    role: "roles/iam.workloadIdentityUser",
+    resourceRef: {
+      apiVersion: "iam.cnrm.cloud.google.com/v1beta1",
+      kind: "IAMServiceAccount",
+      name: dnsGsaName,
+    },
+  } as Record<string, unknown>);
+
+  const dnsAdminBinding = new IAMPolicyMember({
+    metadata: meta("iam", `${dnsGsaName}-admin`),
+    member: `serviceAccount:${dnsGsaName}@${project}.iam.gserviceaccount.com`,
+    role: "roles/dns.admin",
+    resourceRef: {
+      apiVersion: "resourcemanager.cnrm.cloud.google.com/v1beta1",
+      kind: "Project",
+      external: `projects/${project}`,
+    },
+  } as Record<string, unknown>);
+
+  // ── CockroachDB Service Account ───────────────────────────────────────────────
+
+  const crdbGsaName = `${clusterName}-crdb`;
+
+  const crdbGsa = new GCPServiceAccount({
+    metadata: meta("iam", crdbGsaName),
+    displayName: `CockroachDB ${region} workload identity`,
+  } as Record<string, unknown>);
+
+  const crdbWiBinding = new IAMPolicyMember({
+    metadata: meta("iam", `${crdbGsaName}-wi`),
+    member: `serviceAccount:${project}.svc.id.goog[${crdbNamespace}/${crdbK8sSa}]`,
+    role: "roles/iam.workloadIdentityUser",
+    resourceRef: {
+      apiVersion: "iam.cnrm.cloud.google.com/v1beta1",
+      kind: "IAMServiceAccount",
+      name: crdbGsaName,
+    },
+  } as Record<string, unknown>);
+
+  const result: Record<string, any> = {
+    cluster,
+    nodePool,
+    defaultPool,
+    dnsZone,
+    dnsGsa,
+    dnsWiBinding,
+    dnsAdminBinding,
+    crdbGsa,
+    crdbWiBinding,
+  };
+
+  // Optional: GCS backup access for CRDB GSA
+  if (backupBucket) {
+    result.crdbBackupBinding = new IAMPolicyMember({
+      metadata: meta("iam", `${crdbGsaName}-backup`),
+      member: `serviceAccount:${crdbGsaName}@${project}.iam.gserviceaccount.com`,
+      role: "roles/storage.objectAdmin",
+      resourceRef: {
+        apiVersion: "storage.cnrm.cloud.google.com/v1beta1",
+        kind: "StorageBucket",
+        name: backupBucket,
+      },
+    } as Record<string, unknown>);
+  }
+
+  return result;
+}, "GkeCrdbRegion");

package/src/composites/index.ts

@@ -20,3 +20,7 @@ export { SecureProject } from "./secure-project";
 export type { SecureProjectProps } from "./secure-project";
 export { MemorystoreRedis } from "./memorystore-redis";
 export type { MemorystoreRedisProps } from "./memorystore-redis";
+export { MultiRegionVpc } from "./multi-region-vpc";
+export type { MultiRegionVpcConfig, MultiRegionVpcRegion } from "./multi-region-vpc";
+export { GkeCrdbRegion } from "./gke-crdb-region";
+export type { GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig } from "./gke-crdb-region";

package/src/composites/multi-region-vpc.ts

@@ -0,0 +1,157 @@
+/**
+ * MultiRegionVpc composite — VPC + 2 subnets per region + Router + RouterNAT per region + Firewall.
+ *
+ * Collapses the boilerplate of a multi-region GKE networking stack into a single call.
+ * Each region gets node and pod subnets, a Cloud Router, and a Cloud NAT gateway.
+ * A single allow-internal firewall rule covers all region CIDRs.
+ */
+
+import { Composite } from "@intentius/chant";
+import { VPCNetwork, Subnetwork, Router, RouterNAT, Firewall } from "../generated";
+
+export interface MultiRegionVpcRegion {
+  /** GCP region name (e.g. "us-east4"). Used as the Router/NAT region. */
+  region: string;
+  /**
+   * Short alias used in resource names (e.g. "east").
+   * Defaults to the full region string. Use this to keep names concise.
+   */
+  regionAlias?: string;
+  /** IP CIDR for GKE node subnet (e.g. "10.1.0.0/20"). */
+  nodeSubnetCidr: string;
+  /** IP CIDR for GKE pod subnet (e.g. "10.1.16.0/20"). */
+  podSubnetCidr: string;
+}
+
+export interface MultiRegionVpcConfig {
+  /** VPC network name. Used as prefix for all sub-resources. */
+  name: string;
+  /** One entry per GCP region. */
+  regions: MultiRegionVpcRegion[];
+  /** Enable VPC flow logs on all subnets (default: false). */
+  enableFlowLogs?: boolean;
+  /** Additional labels for all resources. */
+  labels?: Record<string, string>;
+  /** Namespace for Config Connector resources. */
+  namespace?: string;
+}
+
+/**
+ * Create a MultiRegionVpc composite — one VPC with subnets, Cloud NAT, and an
+ * allow-internal firewall for every region in the array.
+ *
+ * The composite eliminates the per-region Router/NAT boilerplate that arises when
+ * `VpcNetwork` only handles a single NAT region and the rest must be wired manually.
+ *
+ * @example
+ * ```ts
+ * import { MultiRegionVpc } from "@intentius/chant-lexicon-gcp";
+ *
+ * export const network = MultiRegionVpc({
+ *   name: "crdb-multi-region",
+ *   regions: [
+ *     { region: "us-east4",    regionAlias: "east",    nodeSubnetCidr: "10.1.0.0/20", podSubnetCidr: "10.1.16.0/20" },
+ *     { region: "us-central1", regionAlias: "central", nodeSubnetCidr: "10.2.0.0/20", podSubnetCidr: "10.2.16.0/20" },
+ *     { region: "us-west1",    regionAlias: "west",    nodeSubnetCidr: "10.3.0.0/20", podSubnetCidr: "10.3.16.0/20" },
+ *   ],
+ * });
+ * ```
+ */
+export const MultiRegionVpc = Composite<MultiRegionVpcConfig>((props) => {
+  const {
+    name,
+    regions,
+    enableFlowLogs = false,
+    labels: extraLabels = {},
+    namespace,
+  } = props;
+
+  const commonLabels: Record<string, string> = {
+    "app.kubernetes.io/name": name,
+    "app.kubernetes.io/managed-by": "chant",
+    ...extraLabels,
+  };
+
+  const meta = (component: string, resourceName?: string) => ({
+    metadata: {
+      name: resourceName ?? name,
+      ...(namespace && { namespace }),
+      labels: { ...commonLabels, "app.kubernetes.io/component": component },
+    },
+  });
+
+  const network = new VPCNetwork({
+    ...meta("network"),
+    autoCreateSubnetworks: false,
+    routingMode: "REGIONAL",
+  } as Record<string, unknown>);
+
+  const subnetEntries: Record<string, unknown> = {};
+  const routerEntries: Record<string, unknown> = {};
+  const natEntries: Record<string, unknown> = {};
+  const allCidrs: string[] = [];
+
+  for (const r of regions) {
+    const alias = r.regionAlias ?? r.region;
+
+    allCidrs.push(r.nodeSubnetCidr, r.podSubnetCidr);
+
+    const flowConfig = enableFlowLogs
+      ? { logConfig: { enable: true, aggregationInterval: "INTERVAL_5_SEC", flowSampling: 0.5 } }
+      : {};
+
+    subnetEntries[`subnet_${alias}_nodes`] = new Subnetwork({
+      ...meta("subnet", `${name}-${alias}-nodes`),
+      networkRef: { name },
+      ipCidrRange: r.nodeSubnetCidr,
+      region: r.region,
+      privateIpGoogleAccess: true,
+      ...flowConfig,
+    } as Record<string, unknown>);
+
+    subnetEntries[`subnet_${alias}_pods`] = new Subnetwork({
+      ...meta("subnet", `${name}-${alias}-pods`),
+      networkRef: { name },
+      ipCidrRange: r.podSubnetCidr,
+      region: r.region,
+      privateIpGoogleAccess: true,
+      ...flowConfig,
+    } as Record<string, unknown>);
+
+    const routerName = `${name}-${alias}`;
+
+    routerEntries[`router_${alias}`] = new Router({
+      ...meta("router", routerName),
+      networkRef: { name },
+      region: r.region,
+    } as Record<string, unknown>);
+
+    natEntries[`nat_${alias}`] = new RouterNAT({
+      ...meta("nat", routerName),
+      routerRef: { name: routerName },
+      region: r.region,
+      natIpAllocateOption: "AUTO_ONLY",
+      sourceSubnetworkIpRangesToNat: "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES",
+    } as Record<string, unknown>);
+  }
+
+  // Allow all TCP/UDP/ICMP between every subnet CIDR in the VPC.
+  const firewallInternal = new Firewall({
+    ...meta("firewall", `${name}-allow-internal`),
+    networkRef: { name },
+    allow: [
+      { protocol: "tcp", ports: ["0-65535"] },
+      { protocol: "udp", ports: ["0-65535"] },
+      { protocol: "icmp" },
+    ],
+    sourceRanges: allCidrs,
+  } as Record<string, unknown>);
+
+  return {
+    network,
+    ...subnetEntries,
+    ...routerEntries,
+    ...natEntries,
+    firewallInternal,
+  };
+}, "MultiRegionVpc");

package/src/coverage.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { existsSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";

package/src/default-labels.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import {
   defaultLabels,
   defaultAnnotations,

package/src/import/generator.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { GcpGenerator } from "./generator";
 
 const generator = new GcpGenerator();

package/src/import/import-fixtures.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { GcpParser } from "./parser";
 import { GcpGenerator } from "./generator";
 

package/src/import/parser.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { GcpParser } from "./parser";
 
 const parser = new GcpParser();

package/src/import/roundtrip.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";

package/src/index.ts

@@ -15,14 +15,14 @@ export { GCP, ProjectId, Region, Zone } from "./pseudo";
 export { GcpAnnotations } from "./variables";
 
 // Generated entities — export everything from generated index
-// After running `bun run generate`, this re-exports all Config Connector resource classes
+// After running `npm run generate`, this re-exports all Config Connector resource classes
 export * from "./generated/index";
 
 // Composites
 export {
   GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork,
   PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject,
-  MemorystoreRedis,
+  MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion,
 } from "./composites/index";
 export type {
   GkeClusterProps,
@@ -36,6 +36,8 @@ export type {
   ManagedCertificateProps,
   SecureProjectProps,
   MemorystoreRedisProps,
+  MultiRegionVpcConfig, MultiRegionVpcRegion,
+  GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig,
 } from "./composites/index";
 
 // IAM role constants

package/src/lint/post-synth/gcp-helpers.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import {
   parseGcpManifests,
   isConfigConnectorResource,

package/src/lint/post-synth/post-synth.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc101 } from "./wgc101";
 import { wgc102 } from "./wgc102";
 import { wgc103 } from "./wgc103";

package/src/lint/post-synth/wgc101.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc101 } from "./wgc101";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc102.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc102 } from "./wgc102";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc103.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc103 } from "./wgc103";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc104.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc104 } from "./wgc104";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc105.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc105 } from "./wgc105";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc106.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc106 } from "./wgc106";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc107.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc107 } from "./wgc107";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc108.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc108 } from "./wgc108";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc109.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc109 } from "./wgc109";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc110.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc110 } from "./wgc110";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc111.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc111 } from "./wgc111";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc112.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc112 } from "./wgc112";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc113.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc113 } from "./wgc113";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc201.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc201 } from "./wgc201";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc202.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc202 } from "./wgc202";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc203.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc203 } from "./wgc203";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc204.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc204 } from "./wgc204";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc301.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc301 } from "./wgc301";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc302.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc302 } from "./wgc302";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc303.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc303 } from "./wgc303";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc401.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc401 } from "./wgc401";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc402.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc402 } from "./wgc402";
 
 function makeCtx(yaml: string) {

package/src/lint/post-synth/wgc403.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { wgc403 } from "./wgc403";
 
 function makeCtx(yaml: string) {

package/src/lint/rules/rules.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { hardcodedProjectRule } from "./hardcoded-project";
 import { hardcodedRegionRule } from "./hardcoded-region";
 import { publicIamRule } from "./public-iam";

package/src/lsp/completions.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { existsSync, readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";

package/src/lsp/hover.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { existsSync, readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";

package/src/package-cli.ts

@@ -1,6 +1,6 @@
-#!/usr/bin/env bun
+#!/usr/bin/env tsx
 /**
- * Thin entry point for `bun run bundle` in lexicon-gcp.
+ * Thin entry point for `npm run bundle` in lexicon-gcp.
  * Generates src/generated/ files and writes dist/ bundle.
  *
  * NOTE: Uses top-level await (matching AWS/Azure pattern) to avoid

package/src/plugin.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { gcpPlugin } from "./plugin";
 import { isLexiconPlugin } from "@intentius/chant/lexicon";
 

package/src/plugin.ts

@@ -5,9 +5,7 @@
  * import parsing, and code generation for GCP Config Connector resources.
  */
 
-import { createRequire } from "module";
 import type { LexiconPlugin, InitTemplateSet, ResourceMetadata } from "@intentius/chant/lexicon";
-const require = createRequire(import.meta.url);
 import type { LintRule } from "@intentius/chant/lint/rule";
 import type { TemplateParser } from "@intentius/chant/import/parser";
 import type { TypeScriptGenerator } from "@intentius/chant/import/generator";
@@ -17,15 +15,19 @@ import { createSkillsLoader, createDiffTool, createCatalogResource } from "@inte
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { gcpSerializer } from "./serializer";
+import { hardcodedProjectRule } from "./lint/rules/hardcoded-project";
+import { hardcodedRegionRule } from "./lint/rules/hardcoded-region";
+import { publicIamRule } from "./lint/rules/public-iam";
+import { GcpParser } from "./import/parser";
+import { GcpGenerator } from "./import/generator";
+import { gcpCompletions } from "./lsp/completions";
+import { gcpHover } from "./lsp/hover";
 
 export const gcpPlugin: LexiconPlugin = {
   name: "gcp",
   serializer: gcpSerializer,
 
   lintRules(): LintRule[] {
-    const { hardcodedProjectRule } = require("./lint/rules/hardcoded-project");
-    const { hardcodedRegionRule } = require("./lint/rules/hardcoded-region");
-    const { publicIamRule } = require("./lint/rules/public-iam");
     return [hardcodedProjectRule, hardcodedRegionRule, publicIamRule];
   },
 
@@ -190,22 +192,18 @@ export const bucketReader = new IAMPolicyMember({
   },
 
   templateParser(): TemplateParser {
-    const { GcpParser } = require("./import/parser");
     return new GcpParser();
   },
 
   templateGenerator(): TypeScriptGenerator {
-    const { GcpGenerator } = require("./import/generator");
     return new GcpGenerator();
   },
 
   completionProvider(ctx: CompletionContext): CompletionItem[] {
-    const { gcpCompletions } = require("./lsp/completions");
     return gcpCompletions(ctx);
   },
 
   hoverProvider(ctx: HoverContext): HoverInfo | undefined {
-    const { gcpHover } = require("./lsp/hover");
     return gcpHover(ctx);
   },
 

package/src/pseudo.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect } from "bun:test";
+import { describe, it, expect } from "vitest";
 import { GCP, ProjectId, Region, Zone, PseudoParameter } from "./pseudo";
 
 describe("GCP pseudo-parameters", () => {

package/src/serializer.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { gcpSerializer } from "./serializer";
 import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
 import {

package/src/spec/fetch.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { getCachePath, KCC_VERSION } from "./fetch";
 
 describe("fetch", () => {
@@ -6,7 +6,7 @@ describe("fetch", () => {
     const path = getCachePath();
     expect(path).toContain(KCC_VERSION);
     expect(path).toContain(".chant");
-    expect(path).toEndWith(".tar.gz");
+    expect(path.endsWith(".tar.gz")).toBe(true);
   });
 
   test("custom version in cache path", () => {

package/src/spec/parse.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";

package/src/validate-cli.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env bun
+#!/usr/bin/env tsx
 import { validate } from "./validate";
 import { printValidationResult } from "@intentius/chant/codegen/validate";
 

package/src/validate.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect } from "vitest";
 import { existsSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";