@intentius/chant-lexicon-gcp 0.124.31 → 0.124.32

package/dist/composites/landing-zone.js

@@ -0,0 +1,89 @@
+/**
+ * Landing-zone bootstrap composites — the GCP slice.
+ *
+ * Fixed-shape resources for greenfield creation of the recommended
+ * governance foundation through a Config Connector management stack. The
+ * evaluability rules (EVL002/004) require composites to declare a fixed set
+ * of resources, so these carry the foundation only; arbitrary folder/project
+ * trees are authored as config with `landingZoneConfig()` (../governance.ts)
+ * and reconciled by an external governance reconciler, and further folders/projects are
+ * declared as ordinary resources.
+ *
+ * The pieces compose:
+ *   const lz = GovernanceFoundation({ orgId: "123456789012" });
+ *   const lr = LocationRestriction({ orgId: "123456789012", locations: ["in:eu-locations"] });
+ *   const ac = OrganizationAuditConfig({ orgId: "123456789012" });
+ * There is no OrganizationRoot analog — GCP organizations come from Cloud
+ * Identity / Workspace, not the resource API, so greenfield and brownfield
+ * both start from an existing org id.
+ */
+import { Composite } from "@intentius/chant";
+import { IAMAuditConfig, OrgpolicyPolicy, ResourcemanagerFolder } from "../generated/index.js";
+import { AUDIT_ALL_SERVICES, DISABLE_SA_KEY_CREATION, SKIP_DEFAULT_NETWORK, resourceLocationRestriction, } from "../governance.js";
+/** "organizations/123" and "123" are both accepted everywhere an org id appears. */
+function orgNumber(orgId) {
+    return orgId.replace(/^organizations\//, "");
+}
+function labels(component) {
+    return {
+        "app.kubernetes.io/managed-by": "chant",
+        "app.kubernetes.io/component": component,
+    };
+}
+function orgPolicy(metaName, policy, orgId, namespace) {
+    return new OrgpolicyPolicy({
+        metadata: {
+            name: metaName,
+            ...(namespace && { namespace }),
+            labels: labels("org-policy"),
+        },
+        resourceID: policy.constraint,
+        organizationRef: { external: orgNumber(orgId) },
+        spec: { rules: policy.rules },
+    });
+}
+/**
+ * Security / Infrastructure / Sandbox / Workloads folders with
+ * `disable-sa-key-creation` and `skip-default-network` enforced at the
+ * organization root — the same baseline `landingZoneConfig()` declares.
+ */
+export const GovernanceFoundation = Composite((props) => {
+    const { orgId, namespace } = props;
+    const folder = (metaName, displayName) => new ResourcemanagerFolder({
+        metadata: {
+            name: metaName,
+            ...(namespace && { namespace }),
+            labels: labels("folder"),
+        },
+        displayName,
+        organizationRef: { external: orgNumber(orgId) },
+    });
+    return {
+        folderSecurity: folder("security", "Security"),
+        folderInfrastructure: folder("infrastructure", "Infrastructure"),
+        folderSandbox: folder("sandbox", "Sandbox"),
+        folderWorkloads: folder("workloads", "Workloads"),
+        policyDisableSaKeyCreation: orgPolicy("disable-sa-key-creation", DISABLE_SA_KEY_CREATION, orgId, namespace),
+        policySkipDefaultNetwork: orgPolicy("skip-default-network", SKIP_DEFAULT_NETWORK, orgId, namespace),
+    };
+}, "GovernanceFoundation");
+export const LocationRestriction = Composite((props) => {
+    const policyResourceLocations = orgPolicy("resource-location-restriction", resourceLocationRestriction(props.locations), props.orgId, props.namespace);
+    return { policyResourceLocations };
+}, "LocationRestriction");
+export const OrganizationAuditConfig = Composite((props) => {
+    const auditConfig = new IAMAuditConfig({
+        metadata: {
+            name: "organization-audit",
+            ...(props.namespace && { namespace: props.namespace }),
+            labels: labels("audit"),
+        },
+        resourceRef: {
+            kind: "Organization",
+            external: `organizations/${orgNumber(props.orgId)}`,
+        },
+        service: props.service ?? AUDIT_ALL_SERVICES.service,
+        auditLogConfigs: (props.logTypes ?? [...AUDIT_ALL_SERVICES.logTypes]).map((logType) => ({ logType })),
+    });
+    return { auditConfig };
+}, "OrganizationAuditConfig");

package/dist/composites/managed-certificate.js

@@ -0,0 +1,46 @@
+/**
+ * ManagedCertificate composite — ManagedSslCertificate + optional TargetHttpsProxy + UrlMap.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { ManagedSSLCertificate, TargetHTTPSProxy, URLMap } from "../generated/index.js";
+export const ManagedCertificate = Composite((props) => {
+    const { name, domains, createProxy = false, backendServiceName, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const certificate = new ManagedSSLCertificate(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "certificate" },
+        },
+        managed: {
+            domains,
+        },
+    }, defs?.certificate));
+    const result = { certificate };
+    if (createProxy && backendServiceName) {
+        result.urlMap = new URLMap(mergeDefaults({
+            metadata: {
+                name: `${name}-url-map`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "url-map" },
+            },
+            defaultService: {
+                backendServiceRef: { name: backendServiceName },
+            },
+        }, defs?.urlMap));
+        result.targetHttpsProxy = new TargetHTTPSProxy(mergeDefaults({
+            metadata: {
+                name: `${name}-proxy`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "proxy" },
+            },
+            urlMapRef: { name: `${name}-url-map` },
+            sslCertificates: [{ name }],
+        }, defs?.targetHttpsProxy));
+    }
+    return result;
+}, "ManagedCertificate");

package/dist/composites/memorystore-redis.js

@@ -0,0 +1,52 @@
+/**
+ * MemorystoreRedis composite — RedisInstance with purpose-driven defaults.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { RedisInstance } from "../generated/index.js";
+/**
+ * Create a MemorystoreRedis composite.
+ *
+ * @example
+ * ```ts
+ * import { MemorystoreRedis } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { instance } = MemorystoreRedis({
+ *   name: "my-app-persistent",
+ *   purpose: "persistent",
+ *   tier: "STANDARD_HA",
+ *   memorySizeGb: 5,
+ *   region: "us-central1",
+ *   networkRef: "my-vpc",
+ * });
+ * ```
+ */
+export const MemorystoreRedis = Composite((props) => {
+    const { name, purpose, tier, memorySizeGb, region, networkRef, redisVersion = "REDIS_7_0", authEnabled = true, namespace, labels: extraLabels = {}, defaults: defs, } = props;
+    const maxmemoryPolicy = purpose === "persistent" ? "noeviction" : "allkeys-lru";
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const instance = new RedisInstance(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "cache" },
+        },
+        region,
+        tier,
+        memorySizeGb,
+        authEnabled,
+        redisVersion,
+        connectMode: "PRIVATE_SERVICE_ACCESS",
+        authorizedNetworkRef: { name: networkRef },
+        // TLS disabled: GitLab's redis-rb client requires either no TLS or a custom CA cert
+        // injected via REDIS_SSL_CA_FILE. AUTH (authEnabled: true) provides access control.
+        transitEncryptionMode: "DISABLED",
+        redisConfigs: {
+            "maxmemory-policy": maxmemoryPolicy,
+        },
+    }, defs?.instance));
+    return { instance };
+}, "MemorystoreRedis");

package/dist/composites/multi-region-vpc.js

@@ -0,0 +1,108 @@
+/**
+ * MultiRegionVpc composite — VPC + 2 subnets per region + Router + RouterNAT per region + Firewall.
+ *
+ * Collapses the boilerplate of a multi-region GKE networking stack into a single call.
+ * Each region gets node and pod subnets, a Cloud Router, and a Cloud NAT gateway.
+ * A single allow-internal firewall rule covers all region CIDRs.
+ */
+import { Composite } from "@intentius/chant";
+import { VPCNetwork, Subnetwork, Router, RouterNAT, Firewall } from "../generated/index.js";
+/**
+ * Create a MultiRegionVpc composite — one VPC with subnets, Cloud NAT, and an
+ * allow-internal firewall for every region in the array.
+ *
+ * The composite eliminates the per-region Router/NAT boilerplate that arises when
+ * `VpcNetwork` only handles a single NAT region and the rest must be wired manually.
+ *
+ * @example
+ * ```ts
+ * import { MultiRegionVpc } from "@intentius/chant-lexicon-gcp";
+ *
+ * export const network = MultiRegionVpc({
+ *   name: "crdb-multi-region",
+ *   regions: [
+ *     { region: "us-east4",    regionAlias: "east",    nodeSubnetCidr: "10.1.0.0/20", podSubnetCidr: "10.1.16.0/20" },
+ *     { region: "us-central1", regionAlias: "central", nodeSubnetCidr: "10.2.0.0/20", podSubnetCidr: "10.2.16.0/20" },
+ *     { region: "us-west1",    regionAlias: "west",    nodeSubnetCidr: "10.3.0.0/20", podSubnetCidr: "10.3.16.0/20" },
+ *   ],
+ * });
+ * ```
+ */
+export const MultiRegionVpc = Composite((props) => {
+    const { name, regions, enableFlowLogs = false, labels: extraLabels = {}, namespace, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const meta = (component, resourceName) => ({
+        metadata: {
+            name: resourceName ?? name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": component },
+        },
+    });
+    const network = new VPCNetwork({
+        ...meta("network"),
+        autoCreateSubnetworks: false,
+        routingMode: "REGIONAL",
+    });
+    const subnetEntries = {};
+    const routerEntries = {};
+    const natEntries = {};
+    const allCidrs = [];
+    for (const r of regions) {
+        const alias = r.regionAlias ?? r.region;
+        allCidrs.push(r.nodeSubnetCidr, r.podSubnetCidr);
+        const flowConfig = enableFlowLogs
+            ? { logConfig: { enable: true, aggregationInterval: "INTERVAL_5_SEC", flowSampling: 0.5 } }
+            : {};
+        subnetEntries[`subnet_${alias}_nodes`] = new Subnetwork({
+            ...meta("subnet", `${name}-${alias}-nodes`),
+            networkRef: { name },
+            ipCidrRange: r.nodeSubnetCidr,
+            region: r.region,
+            privateIpGoogleAccess: true,
+            ...flowConfig,
+        });
+        subnetEntries[`subnet_${alias}_pods`] = new Subnetwork({
+            ...meta("subnet", `${name}-${alias}-pods`),
+            networkRef: { name },
+            ipCidrRange: r.podSubnetCidr,
+            region: r.region,
+            privateIpGoogleAccess: true,
+            ...flowConfig,
+        });
+        const routerName = `${name}-${alias}`;
+        routerEntries[`router_${alias}`] = new Router({
+            ...meta("router", routerName),
+            networkRef: { name },
+            region: r.region,
+        });
+        natEntries[`nat_${alias}`] = new RouterNAT({
+            ...meta("nat", routerName),
+            routerRef: { name: routerName },
+            region: r.region,
+            natIpAllocateOption: "AUTO_ONLY",
+            sourceSubnetworkIpRangesToNat: "ALL_SUBNETWORKS_ALL_PRIMARY_IP_RANGES",
+        });
+    }
+    // Allow all TCP/UDP/ICMP between every subnet CIDR in the VPC.
+    const firewallInternal = new Firewall({
+        ...meta("firewall", `${name}-allow-internal`),
+        networkRef: { name },
+        allow: [
+            { protocol: "tcp", ports: ["0-65535"] },
+            { protocol: "udp", ports: ["0-65535"] },
+            { protocol: "icmp" },
+        ],
+        sourceRanges: allCidrs,
+    });
+    return {
+        network,
+        ...subnetEntries,
+        ...routerEntries,
+        ...natEntries,
+        firewallInternal,
+    };
+}, "MultiRegionVpc");

package/dist/composites/private-service.js

@@ -0,0 +1,50 @@
+/**
+ * PrivateService composite — GlobalAddress + ServiceNetworkingConnection + optional DNS.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { ComputeAddress, ServicenetworkingConnection, DNSManagedZone, } from "../generated/index.js";
+export const PrivateService = Composite((props) => {
+    const { name, networkName, prefixLength = 16, addressType = "INTERNAL", purpose = "VPC_PEERING", enableDns = false, dnsZoneName, dnsSuffix = "internal.", labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const globalAddress = new ComputeAddress(mergeDefaults({
+        metadata: {
+            name: `${name}-address`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "address" },
+        },
+        addressType,
+        purpose,
+        prefixLength,
+        networkRef: { name: networkName },
+    }, defs?.globalAddress));
+    const serviceConnection = new ServicenetworkingConnection(mergeDefaults({
+        metadata: {
+            name: `${name}-connection`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "connection" },
+        },
+        networkRef: { name: networkName },
+        service: "servicenetworking.googleapis.com",
+        reservedPeeringRanges: [{ name: `${name}-address` }],
+    }, defs?.serviceConnection));
+    const result = { globalAddress, serviceConnection };
+    if (enableDns) {
+        result.dnsZone = new DNSManagedZone(mergeDefaults({
+            metadata: {
+                name: dnsZoneName ?? `${name}-dns`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "dns" },
+            },
+            dnsName: dnsSuffix,
+            visibility: "private",
+            privateVisibilityConfig: {
+                networks: [{ networkRef: { name: networkName } }],
+            },
+        }, defs?.dnsZone));
+    }
+    return result;
+}, "PrivateService");

package/dist/composites/pubsub-pipeline.js

@@ -0,0 +1,63 @@
+/**
+ * PubSubPipeline composite — Topic + Subscription + optional DLQ topic + subscriber IAM binding.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { PubSubTopic, PubSubSubscription, IAMPolicyMember } from "../generated/index.js";
+export const PubSubPipeline = Composite((props) => {
+    const { name, ackDeadlineSeconds = 10, messageRetentionDuration = "604800s", enableDeadLetterQueue = false, maxDeliveryAttempts = 5, subscriberServiceAccount, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const topic = new PubSubTopic(mergeDefaults({
+        metadata: {
+            name: `${name}-topic`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "topic" },
+        },
+    }, defs?.topic));
+    const subscriptionProps = {
+        metadata: {
+            name: `${name}-subscription`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "subscription" },
+        },
+        topicRef: { name: `${name}-topic` },
+        ackDeadlineSeconds,
+        messageRetentionDuration,
+    };
+    const result = { topic };
+    if (enableDeadLetterQueue) {
+        result.deadLetterTopic = new PubSubTopic(mergeDefaults({
+            metadata: {
+                name: `${name}-dlq`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "dead-letter" },
+            },
+        }, defs?.deadLetterTopic));
+        subscriptionProps.deadLetterPolicy = {
+            deadLetterTopicRef: { name: `${name}-dlq` },
+            maxDeliveryAttempts,
+        };
+    }
+    const subscription = new PubSubSubscription(mergeDefaults(subscriptionProps, defs?.subscription));
+    result.subscription = subscription;
+    if (subscriberServiceAccount) {
+        result.subscriberIam = new IAMPolicyMember(mergeDefaults({
+            metadata: {
+                name: `${name}-subscriber`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "iam" },
+            },
+            member: `serviceAccount:${subscriberServiceAccount}`,
+            role: "roles/pubsub.subscriber",
+            resourceRef: {
+                apiVersion: "pubsub.cnrm.cloud.google.com/v1beta1",
+                kind: "PubSubSubscription",
+                name: `${name}-subscription`,
+            },
+        }, defs?.subscriberIam));
+    }
+    return result;
+}, "PubSubPipeline");

package/dist/composites/secure-project.js

@@ -0,0 +1,85 @@
+/**
+ * SecureProject composite — Project + IAMAuditConfig + Service enablement + owner IAM + LoggingSink.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { ResourcemanagerProject, IAMAuditConfig, ServiceusageService, IAMPolicyMember, LogSink, } from "../generated/index.js";
+export const SecureProject = Composite((props) => {
+    const { name, orgId, folderId, billingAccountRef, owner, enabledApis = [
+        "compute.googleapis.com",
+        "container.googleapis.com",
+        "iam.googleapis.com",
+        "logging.googleapis.com",
+        "monitoring.googleapis.com",
+    ], loggingSinkDestination, loggingSinkFilter = 'logName:"cloudaudit.googleapis.com"', labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const project = new ResourcemanagerProject(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "project" },
+        },
+        ...(orgId && { organizationRef: { external: orgId } }),
+        ...(folderId && { folderRef: { external: folderId } }),
+        ...(billingAccountRef && { billingAccountRef: { external: billingAccountRef } }),
+    }, defs?.project));
+    const auditConfig = new IAMAuditConfig(mergeDefaults({
+        metadata: {
+            name: `${name}-audit`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "audit" },
+        },
+        service: "allServices",
+        auditLogConfigs: [
+            { logType: "ADMIN_READ" },
+            { logType: "DATA_READ" },
+            { logType: "DATA_WRITE" },
+        ],
+    }, defs?.auditConfig));
+    // Spread services into named members (service_compute, service_container, etc.)
+    // so the Composite validator accepts them as individual Declarables.
+    const serviceEntries = {};
+    for (const api of enabledApis) {
+        const key = `service_${api.split(".")[0]}`;
+        serviceEntries[key] = new ServiceusageService({
+            metadata: {
+                name: `${name}-${api.split(".")[0]}`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "service" },
+            },
+            resourceID: api,
+        });
+    }
+    const result = { project, auditConfig, ...serviceEntries };
+    if (owner) {
+        result.ownerIam = new IAMPolicyMember(mergeDefaults({
+            metadata: {
+                name: `${name}-owner`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "iam" },
+            },
+            member: owner,
+            role: "roles/owner",
+            resourceRef: {
+                apiVersion: "resourcemanager.cnrm.cloud.google.com/v1beta1",
+                kind: "Project",
+                name,
+            },
+        }, defs?.ownerIam));
+    }
+    if (loggingSinkDestination) {
+        result.loggingSink = new LogSink(mergeDefaults({
+            metadata: {
+                name: `${name}-audit-sink`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "logging" },
+            },
+            destination: loggingSinkDestination,
+            filter: loggingSinkFilter,
+        }, defs?.loggingSink));
+    }
+    return result;
+}, "SecureProject");

package/dist/composites/vpc-network.js

@@ -0,0 +1,113 @@
+/**
+ * VpcNetwork composite — ComputeNetwork + ComputeSubnetwork + ComputeFirewall + ComputeRouterNAT.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { VPCNetwork, Subnetwork, Firewall, Router, RouterNAT } from "../generated/index.js";
+/**
+ * Create a VpcNetwork composite.
+ *
+ * @example
+ * ```ts
+ * import { VpcNetwork } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { network, subnets, firewalls } = VpcNetwork({
+ *   name: "my-vpc",
+ *   subnets: [
+ *     { name: "app", ipCidrRange: "10.0.0.0/24", region: "us-central1" },
+ *     { name: "data", ipCidrRange: "10.0.1.0/24", region: "us-central1" },
+ *   ],
+ *   enableNat: true,
+ *   natRegion: "us-central1",
+ * });
+ * ```
+ */
+export const VpcNetwork = Composite((props) => {
+    const { name, autoCreateSubnetworks = false, subnets: subnetDefs = [], enableNat = false, natRegion, allowInternalTraffic = true, allowIapSsh = false, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const network = new VPCNetwork(mergeDefaults({
+        metadata: {
+            name,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "network" },
+        },
+        autoCreateSubnetworks,
+        routingMode: "REGIONAL",
+    }, defs?.network));
+    // Spread subnets into named members (subnet_<name>) for Composite validation.
+    const subnetEntries = {};
+    for (const sub of subnetDefs) {
+        subnetEntries[`subnet_${sub.name}`] = new Subnetwork({
+            metadata: {
+                name: `${name}-${sub.name}`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "subnet" },
+            },
+            networkRef: { name },
+            ipCidrRange: sub.ipCidrRange,
+            region: sub.region,
+            privateIpGoogleAccess: sub.privateIpGoogleAccess ?? true,
+            ...(sub.secondaryIpRanges && sub.secondaryIpRanges.length > 0 && {
+                secondaryIpRange: sub.secondaryIpRanges,
+            }),
+        });
+    }
+    // Spread firewalls into named members for Composite validation.
+    const firewallEntries = {};
+    if (allowInternalTraffic) {
+        firewallEntries.firewallAllowInternal = new Firewall({
+            metadata: {
+                name: `${name}-allow-internal`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "firewall" },
+            },
+            networkRef: { name },
+            allow: [
+                { protocol: "tcp", ports: ["0-65535"] },
+                { protocol: "udp", ports: ["0-65535"] },
+                { protocol: "icmp" },
+            ],
+            sourceRanges: subnetDefs.map((s) => s.ipCidrRange),
+        });
+    }
+    if (allowIapSsh) {
+        firewallEntries.firewallAllowIapSsh = new Firewall({
+            metadata: {
+                name: `${name}-allow-iap-ssh`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "firewall" },
+            },
+            networkRef: { name },
+            allow: [{ protocol: "tcp", ports: ["22"] }],
+            sourceRanges: ["35.235.240.0/20"], // IAP IP range
+        });
+    }
+    const result = { network, ...subnetEntries, ...firewallEntries };
+    if (enableNat && natRegion) {
+        const routerName = `${name}-router`;
+        result.router = new Router(mergeDefaults({
+            metadata: {
+                name: routerName,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "router" },
+            },
+            networkRef: { name },
+            region: natRegion,
+        }, defs?.router));
+        result.routerNat = new RouterNAT(mergeDefaults({
+            metadata: {
+                name: `${name}-nat`,
+                ...(namespace && { namespace }),
+                labels: { ...commonLabels, "app.kubernetes.io/component": "nat" },
+            },
+            routerRef: { name: routerName },
+            region: natRegion,
+            natIpAllocateOption: "AUTO_ONLY",
+            sourceSubnetworkIpRangesToNat: "ALL_SUBNETWORKS_ALL_IP_RANGES",
+        }, defs?.routerNat));
+    }
+    return result;
+}, "VpcNetwork");

package/dist/coverage.js

@@ -0,0 +1,28 @@
+/**
+ * GCP lexicon coverage analysis.
+ */
+import { computeCoverage, formatSummary, formatVerbose, checkThresholds, } from "@intentius/chant/codegen/coverage";
+import { readFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+export { computeCoverage, overallPct, formatSummary, formatVerbose, checkThresholds, } from "@intentius/chant/codegen/coverage";
+export async function analyzeGcpCoverage(opts) {
+    const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+    const lexiconPath = join(pkgDir, "src", "generated", "lexicon-gcp.json");
+    const content = readFileSync(lexiconPath, "utf-8");
+    const report = computeCoverage(content);
+    if (opts?.verbose) {
+        console.log(formatVerbose(report));
+    }
+    else {
+        console.log(formatSummary(report));
+    }
+    if (typeof opts?.minOverall === "number") {
+        const result = checkThresholds(report, { minOverallPct: opts.minOverall });
+        if (!result.ok) {
+            for (const v of result.violations)
+                console.error(`  FAIL: ${v}`);
+            throw new Error("Coverage below threshold");
+        }
+    }
+}