@intentius/chant-lexicon-gcp 0.124.35 → 0.124.36

package/dist/api/read-client.d.ts

@@ -24,7 +24,8 @@
  * PubSubTopic, PubSubSubscription, SecretManagerSecret, IAMServiceAccount,
  * RunService, IAMPolicyMember and the Cloud Run load balancer kinds
  * (ComputeAddress, ComputeRegionNetworkEndpointGroup, ComputeBackendService,
- * ComputeURLMap, ComputeTargetHTTPProxy, ComputeForwardingRule; #4233). An
+ * ComputeURLMap, ComputeTargetHTTPProxy, ComputeForwardingRule; #4233), and
+ * ComputeNetwork and ComputeSubnetwork (#4248). An
  * IAMPolicyMember is read through its target's policy and is present when the
  * policy grants its member the role. The kubectl path could fetch any CNRM kind the cluster knew
  * about, so this is narrower on paper. It is not narrower in practice for

package/dist/api/read-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5F,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACnC,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,uHAAuH;AACvH,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAUrH;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IAF1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EAIzB;CACF;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEtE;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiDlC"}
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5F,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACnC,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB;AAED,uHAAuH;AACvH,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAUrH;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IAF1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EAIzB;CACF;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEtE;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiDlC"}

package/dist/api/read-client.js

@@ -24,7 +24,8 @@
  * PubSubTopic, PubSubSubscription, SecretManagerSecret, IAMServiceAccount,
  * RunService, IAMPolicyMember and the Cloud Run load balancer kinds
  * (ComputeAddress, ComputeRegionNetworkEndpointGroup, ComputeBackendService,
- * ComputeURLMap, ComputeTargetHTTPProxy, ComputeForwardingRule; #4233). An
+ * ComputeURLMap, ComputeTargetHTTPProxy, ComputeForwardingRule; #4233), and
+ * ComputeNetwork and ComputeSubnetwork (#4248). An
  * IAMPolicyMember is read through its target's policy and is present when the
  * policy grants its member the role. The kubectl path could fetch any CNRM kind the cluster knew
  * about, so this is narrower on paper. It is not narrower in practice for

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA2LD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8F5G"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0OD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8F5G"}

package/dist/deep-observe.js

@@ -166,6 +166,25 @@ const CNRM_REFINERS = {
             template.serviceAccountRef = email.endsWith(suffix) ? { name: email.slice(0, -suffix.length) } : { external: email };
             delete template.serviceAccount;
         }
+        // #4249: Direct VPC egress paths back to CNRM's refs, `name` for the
+        // project's own network and subnetwork, `external` otherwise.
+        const vpcAccess = template?.vpcAccess;
+        if (vpcAccess && Array.isArray(vpcAccess.networkInterfaces)) {
+            const own = (value, pattern) => {
+                if (!value.includes("/"))
+                    return { name: value };
+                const hit = pattern.exec(value);
+                return hit && hit[1] === ctx.project ? { name: hit[2] } : { external: value };
+            };
+            vpcAccess.networkInterfaces = vpcAccess.networkInterfaces.map((i) => {
+                const { network, subnetwork, ...rest } = i;
+                return {
+                    ...rest,
+                    ...(typeof network === "string" ? { networkRef: own(network, /^projects\/([^/]+)\/global\/networks\/([^/]+)$/) } : {}),
+                    ...(typeof subnetwork === "string" ? { subnetworkRef: own(subnetwork, /^projects\/([^/]+)\/regions\/[^/]+\/subnetworks\/([^/]+)$/) } : {}),
+                };
+            });
+        }
     },
     // #4233: the inverse of gcp-compute.ts's body builders. Compute returns refs
     // as full URLs and a region as a URL; CNRM writes `*Ref: { name }` and a
@@ -247,6 +266,39 @@ const CNRM_REFINERS = {
             delete tree.urlMap;
         }
     },
+    // #4248: a network is global and has no location; compute nests the routing
+    // mode and lists the subnetworks it holds, which CNRM declares separately.
+    ComputeNetwork(tree) {
+        const routing = tree.routingConfig;
+        if (routing) {
+            if (routing.routingMode !== undefined)
+                tree.routingMode = routing.routingMode;
+            delete tree.routingConfig;
+        }
+        delete tree.subnetworks;
+        delete tree.gatewayIPv4;
+    },
+    ComputeSubnetwork(tree) {
+        if (typeof tree.region === "string")
+            tree.region = lastSegment(tree.region);
+        if (typeof tree.network === "string") {
+            tree.networkRef = { name: lastSegment(tree.network) };
+            delete tree.network;
+        }
+        if (Array.isArray(tree.secondaryIpRanges)) {
+            tree.secondaryIpRange = tree.secondaryIpRanges;
+            delete tree.secondaryIpRanges;
+        }
+        const log = tree.logConfig;
+        if (log) {
+            if (log.enable === false)
+                delete tree.logConfig;
+            else
+                delete log.enable;
+        }
+        delete tree.gatewayAddress;
+        delete tree.fingerprint;
+    },
     ComputeForwardingRule(tree) {
         computeLocation(tree);
         if (tree.IPProtocol !== undefined) {

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "1df258f1ce42c92a75d16af8bb02fb96e2b8a35903feafb3991be4162737103f",
+    "manifest.json": "9c67ab15a45ae8ce5c5ac3a6e3a83295bd28e78a4acf71b0d00d74040f5d27e0",
     "meta.json": "75643660010c044c6f465bef2688a864ab30cc96fd9b68111969749748ac64ca",
     "types/index.d.ts": "da1ebc6bcf83e1a018a773b59714194aeeb74ae1d5c1252b737b7e730ca98bd5",
     "rules/hardcoded-project.ts": "6d5ae9efa74d73800eebe1a0a0d43c619ee0fdebe3347195df93fcbe63b34f0d",
@@ -40,5 +40,5 @@
     "skills/chant-gcp-patterns.md": "4c6809fc7c37fa1879379ad4c0e2d114dec9497bc6eb9d1bca4e79fddea4f509",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "8f56e528b666ee71c8dde34f63317337bb6183280e11dd1925ac7c1e4117ca89"
+  "composite": "f841125ccfbe364d6981cf4a1f444c9edeaa213e3b5d562dce7b12b341d82daf"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.124.35",
+  "version": "0.124.36",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/dist/op/activities/gcp-apply.d.ts

@@ -189,6 +189,13 @@ export declare const pubSubTopicMapper: ResourceMapper;
 export declare function cloudRunServiceBody(resource: GcpResource, project?: string): {
     template?: unknown;
 };
+/**
+ * A CNRM Direct VPC egress interface as Cloud Run v2 takes it (#4249):
+ * `networkRef` and `subnetworkRef` become `network` and `subnetwork` paths,
+ * `name` in the project (the subnetwork in the service's region) and
+ * `external` as given. `tags` and anything else pass through. Pure.
+ */
+export declare function networkInterface(iface: unknown, project: string | undefined, region: string): unknown;
 /**
  * The email a CNRM `serviceAccountRef` names: `external` as given (an email,
  * or a `projects/<p>/serviceAccounts/<email>` path), `name` as an account id

package/dist/op/activities/gcp-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-apply.ts"],"names":[],"mappings":"AAcA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAIhC;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEvF;AAQD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,UAAU,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACnC,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;KAClG,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE;QAAE,wBAAwB,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACtE,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACvG;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAID;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACjG,8DAA8D;IAC9D,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC;IACxC,8EAA8E;IAC9E,KAAK,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,GAAG,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACpD,4EAA4E;IAC5E,KAAK,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnI,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7H;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,GAAG,SAAS,CAAC;IACvD,2IAA2I;IAC3I,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC;IACzD,8EAA8E;IAC9E,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAcnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAsB1E;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,eAAe,CAOtE;AAED,eAAO,MAAM,mBAAmB,EAAE,cAmBjC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cA0B/B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAQnG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS/H;AAED,eAAO,MAAM,qBAAqB,EAAE,cAuBnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtG;AAED,eAAO,MAAM,wBAAwB,EAAE,cAStC,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzE;AAED,eAAO,MAAM,yBAAyB,EAAE,cAuBvC,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpG;AAED,eAAO,MAAM,uBAAuB,EAAE,cAerC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAelD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,CAE/D;AAmBD,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBjG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAwBzE;AAID;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,EAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAEpB;AAED,kGAAkG;AAClG;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAYrI;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAWrG;AAED,6FAA6F;AAC7F,MAAM,MAAM,OAAO,GAAG,CACpB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAY/C;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4B7E;AA4BD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,IAAI,CAAC,CAiBf;AAqBD,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAU1E;AAED,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB;0EACsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpF,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,GAAG,WAAW,CAoBd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAAC;IAC7C,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,SAAS,EACtE,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CAiCD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,+EAA+E;IAC/E,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,qEAAqE;IACrE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CAmCD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB3D;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE;;2EAEuE;IACvE,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC,CA2BD"}
+{"version":3,"file":"gcp-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-apply.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAIhC;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEvF;AAQD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,UAAU,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACnC,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;KAClG,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE;QAAE,wBAAwB,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACtE,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACvG;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAID;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACjG,8DAA8D;IAC9D,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC;IACxC,8EAA8E;IAC9E,KAAK,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,GAAG,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACpD,4EAA4E;IAC5E,KAAK,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnI,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7H;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,GAAG,SAAS,CAAC;IACvD,2IAA2I;IAC3I,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC;IACzD,8EAA8E;IAC9E,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAcnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAsB1E;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,eAAe,CAOtE;AAED,eAAO,MAAM,mBAAmB,EAAE,cAmBjC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cA0B/B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAcnG;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAarG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAS/H;AAED,eAAO,MAAM,qBAAqB,EAAE,cAuBnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtG;AAED,eAAO,MAAM,wBAAwB,EAAE,cAStC,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzE;AAED,eAAO,MAAM,yBAAyB,EAAE,cAuBvC,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpG;AAED,eAAO,MAAM,uBAAuB,EAAE,cAerC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAiBlD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,CAE/D;AAqBD,2GAA2G;AAC3G,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBjG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAwBzE;AAID;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,EAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAEpB;AAED,kGAAkG;AAClG;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAYrI;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAWrG;AAED,6FAA6F;AAC7F,MAAM,MAAM,OAAO,GAAG,CACpB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAY/C;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4B7E;AA4BD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,IAAI,CAAC,CAiBf;AAqBD,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAU1E;AAED,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB;0EACsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpF,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,YAAY,CAAC,EAAE,eAAe,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC;CAChC,GAAG,WAAW,CAoBd;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,oBAAoB,GAAG,aAAa,CAAC;IAC7C,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK,SAAS,EACtE,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CAiCD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,+EAA+E;IAC/E,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,qEAAqE;IACrE,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B,CAAC,CAmCD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,SAAS,EACd,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAoB3D;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE;;2EAEuE;IACvE,YAAY,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC,CA2BD"}

package/dist/op/activities/gcp-apply.js

@@ -4,7 +4,7 @@ import { sleep } from "@intentius/chant/op";
 import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
 import { GCP_RESOURCE_OWNERSHIP_KEYS } from "../../ownership.js";
 import { iamPolicyMemberMapper } from "./gcp-iam.js";
-import { backendServiceMapper, computeAddressMapper, forwardingRuleMapper, regionNetworkEndpointGroupMapper, targetHttpProxyMapper, urlMapMapper, } from "./gcp-compute.js";
+import { backendServiceMapper, computeAddressMapper, forwardingRuleMapper, networkMapper, subnetworkMapper, regionNetworkEndpointGroupMapper, targetHttpProxyMapper, urlMapMapper, } from "./gcp-compute.js";
 import { applyResult, } from "@intentius/chant/apply";
 const PROJECT_ID_ANNOTATION = "cnrm.cloud.google.com/project-id";
 /**
@@ -157,9 +157,40 @@ export function cloudRunServiceBody(resource, project) {
         return body;
     const { serviceAccountRef, ...template } = spec.template;
     const email = serviceAccountEmail(serviceAccountRef, project);
-    body.template = email ? { ...template, serviceAccount: email } : template;
+    const out = email ? { ...template, serviceAccount: email } : { ...template };
+    const vpcAccess = out.vpcAccess;
+    if (vpcAccess && Array.isArray(vpcAccess.networkInterfaces)) {
+        const region = (resource.spec ?? {}).location ?? "us-central1";
+        out.vpcAccess = { ...vpcAccess, networkInterfaces: vpcAccess.networkInterfaces.map((i) => networkInterface(i, project, region)) };
+    }
+    body.template = out;
     return body;
 }
+/**
+ * A CNRM Direct VPC egress interface as Cloud Run v2 takes it (#4249):
+ * `networkRef` and `subnetworkRef` become `network` and `subnetwork` paths,
+ * `name` in the project (the subnetwork in the service's region) and
+ * `external` as given. `tags` and anything else pass through. Pure.
+ */
+export function networkInterface(iface, project, region) {
+    if (!iface || typeof iface !== "object")
+        return iface;
+    const { networkRef, subnetworkRef, ...rest } = iface;
+    const path = (ref, scoped, key) => {
+        if (!ref)
+            return undefined;
+        if (ref.external)
+            return ref.external;
+        if (!ref.name)
+            return undefined;
+        if (!project)
+            throw new Error(`${key} { name: "${ref.name}" } needs a project to form its path`);
+        return scoped(project, ref.name);
+    };
+    const network = path(networkRef, (p, n) => `projects/${p}/global/networks/${n}`, "networkRef");
+    const subnetwork = path(subnetworkRef, (p, n) => `projects/${p}/regions/${region}/subnetworks/${n}`, "subnetworkRef");
+    return { ...rest, ...(network ? { network } : {}), ...(subnetwork ? { subnetwork } : {}) };
+}
 /**
  * The email a CNRM `serviceAccountRef` names: `external` as given (an email,
  * or a `projects/<p>/serviceAccounts/<email>` path), `name` as an account id
@@ -295,6 +326,8 @@ export const MAPPERS = {
     ComputeURLMap: urlMapMapper,
     ComputeTargetHTTPProxy: targetHttpProxyMapper,
     ComputeForwardingRule: forwardingRuleMapper,
+    ComputeNetwork: networkMapper,
+    ComputeSubnetwork: subnetworkMapper,
 };
 /**
  * Collect the local resource names this resource references via CNRM `*Ref`
@@ -319,6 +352,8 @@ const REF_KINDS = {
     backendServiceRef: "ComputeBackendService",
     urlMapRef: "ComputeURLMap",
     targetHTTPProxyRef: "ComputeTargetHTTPProxy",
+    networkRef: "ComputeNetwork",
+    subnetworkRef: "ComputeSubnetwork",
 };
 /** The local resources this resource references via `*Ref` fields, each with its kind when known. Pure. */
 export function referencedResources(resource) {

package/dist/op/activities/gcp-compute.d.ts

@@ -31,6 +31,14 @@ export declare function computeLabels(labels: Record<string, string> | undefined
 export declare function addressBody(resource: GcpResource, ctx: ComputeCtx): Obj;
 /** ComputeRegionNetworkEndpointGroup → regionNetworkEndpointGroups.insert body (serverless NEGs). Pure. */
 export declare function negBody(resource: GcpResource, ctx: ComputeCtx): Obj;
+/**
+ * ComputeNetwork → networks.insert body. A network is global. CNRM's
+ * `autoCreateSubnetworks` defaults to false, where compute's default is true,
+ * so it is always sent. Pure.
+ */
+export declare function networkBody(resource: GcpResource): Obj;
+/** ComputeSubnetwork → subnetworks.insert body. CNRM's `secondaryIpRange` and `logConfig` become compute's `secondaryIpRanges` and an enabled `logConfig`. Pure. */
+export declare function subnetworkBody(resource: GcpResource, ctx: ComputeCtx): Obj;
 /** ComputeBackendService → backendServices.insert body. Pure. */
 export declare function backendServiceBody(resource: GcpResource, ctx: ComputeCtx): Obj;
 /** ComputeURLMap → urlMaps.insert body. Pure. */
@@ -52,5 +60,7 @@ export declare const backendServiceMapper: ResourceMapper;
 export declare const urlMapMapper: ResourceMapper;
 export declare const targetHttpProxyMapper: ResourceMapper;
 export declare const forwardingRuleMapper: ResourceMapper;
+export declare const networkMapper: ResourceMapper;
+export declare const subnetworkMapper: ResourceMapper;
 export {};
 //# sourceMappingURL=gcp-compute.d.ts.map

package/dist/op/activities/gcp-compute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-compute.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-compute.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9E,eAAO,MAAM,YAAY,mCAAmC,CAAC;AAI7D,KAAK,GAAG,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/D,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAqBnC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACnC;AAED,wGAAwG;AACxG,wBAAgB,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG3F;AAMD,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAKzD;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAmB5F;AAkBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMhG;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAWvE;AAED,2GAA2G;AAC3G,wBAAgB,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CA0BnE;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAoC9E;AAED,iDAAiD;AACjD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CA4BtE;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAK/E;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAoB9E;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAe9B,CAAC;AAqBF,eAAO,MAAM,oBAAoB,gBAA4D,CAAC;AAC9F,eAAO,MAAM,gCAAgC,gBAAuF,CAAC;AACrI,eAAO,MAAM,oBAAoB,gBAAgF,CAAC;AAClH,eAAO,MAAM,YAAY,gBAAwD,CAAC;AAClF,eAAO,MAAM,qBAAqB,gBAAoF,CAAC;AACvH,eAAO,MAAM,oBAAoB,gBAAgF,CAAC"}
+{"version":3,"file":"gcp-compute.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-compute.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9E,eAAO,MAAM,YAAY,mCAAmC,CAAC;AAI7D,KAAK,GAAG,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/D,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAqBnC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACnC;AAED,wGAAwG;AACxG,wBAAgB,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAG3F;AAMD,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAKzD;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAmB5F;AAkBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMhG;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAWvE;AAED,2GAA2G;AAC3G,wBAAgB,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CA0BnE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,WAAW,GAAG,GAAG,CAStD;AAED,oKAAoK;AACpK,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAW1E;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAoC9E;AAED,iDAAiD;AACjD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CA4BtE;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAK/E;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,GAAG,CAoB9E;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAe9B,CAAC;AAsBF,eAAO,MAAM,oBAAoB,gBAA4D,CAAC;AAC9F,eAAO,MAAM,gCAAgC,gBAAuF,CAAC;AACrI,eAAO,MAAM,oBAAoB,gBAAgF,CAAC;AAClH,eAAO,MAAM,YAAY,gBAAwD,CAAC;AAClF,eAAO,MAAM,qBAAqB,gBAAoF,CAAC;AACvH,eAAO,MAAM,oBAAoB,gBAAgF,CAAC;AAClH,eAAO,MAAM,aAAa,gBAAuF,CAAC;AAClH,eAAO,MAAM,gBAAgB,gBAAoE,CAAC"}

package/dist/op/activities/gcp-compute.js

@@ -1,7 +1,9 @@
 /**
  * Compute Engine mappers for the Cloud Run load balancer (#4233): ComputeAddress,
  * ComputeRegionNetworkEndpointGroup (serverless NEGs), ComputeBackendService,
- * ComputeURLMap, ComputeTargetHTTPProxy and ComputeForwardingRule.
+ * ComputeURLMap, ComputeTargetHTTPProxy and ComputeForwardingRule; and for a
+ * declared network (#4248): ComputeNetwork (always global) and
+ * ComputeSubnetwork (regional, by its CNRM `region`).
  *
  * Each maps a CNRM spec onto the compute v1 insert body. A resource is global
  * or regional by its CNRM `location` (`"global"` or a region; a NEG has
@@ -158,6 +160,38 @@ export function negBody(resource, ctx) {
         body.subnetwork = refUrl("subnetworkRef", spec.subnetworkRef, ctx, scope);
     return body;
 }
+/**
+ * ComputeNetwork → networks.insert body. A network is global. CNRM's
+ * `autoCreateSubnetworks` defaults to false, where compute's default is true,
+ * so it is always sent. Pure.
+ */
+export function networkBody(resource) {
+    const spec = (resource.spec ?? {});
+    const body = {
+        name: computeName(resource),
+        autoCreateSubnetworks: spec.autoCreateSubnetworks === true,
+        ...pick(spec, ["description", "mtu", "networkFirewallPolicyEnforcementOrder"]),
+    };
+    if (typeof spec.routingMode === "string")
+        body.routingConfig = { routingMode: spec.routingMode };
+    return body;
+}
+/** ComputeSubnetwork → subnetworks.insert body. CNRM's `secondaryIpRange` and `logConfig` become compute's `secondaryIpRanges` and an enabled `logConfig`. Pure. */
+export function subnetworkBody(resource, ctx) {
+    const spec = (resource.spec ?? {});
+    const scope = scopeOf(spec);
+    const body = {
+        name: computeName(resource),
+        ...pick(spec, ["ipCidrRange", "description", "privateIpGoogleAccess", "purpose", "role", "stackType"]),
+    };
+    if (isObj(spec.networkRef))
+        body.network = refUrl("networkRef", spec.networkRef, ctx, scope);
+    if (Array.isArray(spec.secondaryIpRange))
+        body.secondaryIpRanges = spec.secondaryIpRange;
+    if (isObj(spec.logConfig))
+        body.logConfig = { enable: true, ...spec.logConfig };
+    return body;
+}
 /** ComputeBackendService → backendServices.insert body. Pure. */
 export function backendServiceBody(resource, ctx) {
     const spec = (resource.spec ?? {});
@@ -292,13 +326,13 @@ export const computeOperation = {
         return errors?.length ? errors.map((e) => e.message ?? e.code ?? "error").join("; ") : undefined;
     },
 };
-function computeMapper(kind, collection, build, regionalCollection = collection) {
+function computeMapper(kind, collection, build, regionalCollection = collection, scopeFor = (spec) => scopeOf(spec)) {
     return {
         kind,
         defaultHost: COMPUTE_HOST,
         operation: computeOperation,
         plan(resource, ctx) {
-            const scope = scopeOf(resource.spec);
+            const scope = scopeFor(resource.spec);
             const coll = `${ctx.base}/compute/v1/${scopePath(ctx.project, scope)}/${scope === "global" ? collection : regionalCollection}`;
             const name = computeName(resource);
             return { getUrl: `${coll}/${enc(name)}`, create: { method: "POST", url: coll, body: build(resource, ctx) } };
@@ -311,3 +345,5 @@ export const backendServiceMapper = computeMapper("ComputeBackendService", "back
 export const urlMapMapper = computeMapper("ComputeURLMap", "urlMaps", urlMapBody);
 export const targetHttpProxyMapper = computeMapper("ComputeTargetHTTPProxy", "targetHttpProxies", targetHttpProxyBody);
 export const forwardingRuleMapper = computeMapper("ComputeForwardingRule", "forwardingRules", forwardingRuleBody);
+export const networkMapper = computeMapper("ComputeNetwork", "networks", networkBody, "networks", () => "global");
+export const subnetworkMapper = computeMapper("ComputeSubnetwork", "subnetworks", subnetworkBody);

package/dist/serializer.d.ts

@@ -4,6 +4,7 @@
  * Converts Chant declarables to multi-document K8s YAML output
  * for Config Connector resources with apiVersion, kind, metadata, and spec.
  */
+import type { Declarable } from "@intentius/chant/declarable";
 import type { Serializer } from "@intentius/chant/serializer";
 /**
  * Resolve entityType to apiVersion and kind.
@@ -17,6 +18,11 @@ export declare function resolveGVK(entityType: string): {
     apiVersion: string;
     kind: string;
 } | null;
+/**
+ * The metadata.name a resource is written with: a string `metadata.name` in its
+ * props, else its logical id in kebab case.
+ */
+export declare function cnrmName(logical: string, entity: Declarable): string;
 /**
  * GCP Config Connector YAML serializer implementation.
  */

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAiClG;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW1F;AAsED;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAiG3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAiClG;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW1F;AA+CD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAIpE;AA4BD;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAiG3B,CAAC"}

package/dist/serializer.js

@@ -62,15 +62,15 @@ function deriveGVKFromType(entityType) {
  * GCP visitor for the generic serializer walker.
  */
 function gcpVisitor(entityNames) {
+    // Config Connector resolves a `*Ref: { name }` by the target's metadata.name,
+    // which is its declared name or else the kebab-cased logical id (#4242).
+    const cnrmNames = new Map();
+    for (const [entity, logical] of entityNames)
+        cnrmNames.set(logical, cnrmName(logical, entity));
+    const resolve = (logical) => cnrmNames.get(logical) ?? logical;
     return {
-        attrRef: (name, _attr) => {
-            // For Config Connector, references resolve to metadata.name
-            return name;
-        },
-        resourceRef: (name) => {
-            // Config Connector uses resourceRef pattern: { name: "resource-name" }
-            return { name };
-        },
+        attrRef: (name, _attr) => resolve(name),
+        resourceRef: (name) => ({ name: resolve(name) }),
         propertyDeclarable: (entity, walk) => {
             if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
                 return undefined;
@@ -86,6 +86,18 @@ function gcpVisitor(entityNames) {
         },
     };
 }
+/**
+ * The metadata.name a resource is written with: a string `metadata.name` in its
+ * props, else its logical id in kebab case.
+ */
+export function cnrmName(logical, entity) {
+    const props = isResourceDeclarable(entity) ? entity.props : undefined;
+    const declared = props?.metadata?.name;
+    return typeof declared === "string" && declared.length > 0 ? declared : kebabName(logical);
+}
+function kebabName(logical) {
+    return logical.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
 /**
  * Convert a value to YAML-compatible form using the walker.
  */
@@ -152,7 +164,7 @@ export const gcpSerializer = {
             // Build metadata
             const metadata = props.metadata ?? {};
             if (!metadata.name) {
-                metadata.name = name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+                metadata.name = kebabName(name);
             }
             // Merge default labels
             if (Object.keys(defaultLabelEntries).length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.124.35",
+  "version": "0.124.36",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,6 +76,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.35"
+    "@intentius/chant": "^0.124.36"
   }
 }

package/src/api/read-client.ts

@@ -24,7 +24,8 @@
  * PubSubTopic, PubSubSubscription, SecretManagerSecret, IAMServiceAccount,
  * RunService, IAMPolicyMember and the Cloud Run load balancer kinds
  * (ComputeAddress, ComputeRegionNetworkEndpointGroup, ComputeBackendService,
- * ComputeURLMap, ComputeTargetHTTPProxy, ComputeForwardingRule; #4233). An
+ * ComputeURLMap, ComputeTargetHTTPProxy, ComputeForwardingRule; #4233), and
+ * ComputeNetwork and ComputeSubnetwork (#4248). An
  * IAMPolicyMember is read through its target's policy and is present when the
  * policy grants its member the role. The kubectl path could fetch any CNRM kind the cluster knew
  * about, so this is narrower on paper. It is not narrower in practice for

package/src/deep-observe.test.ts

@@ -139,6 +139,32 @@ describe("toCnrmTree — each REST shape in the declared vocabulary (#1210)", ()
     expect(other.template).toEqual({ serviceAccountRef: { external: "x@other.iam.gserviceaccount.com" } });
   });
 
+  test("run service: vpcAccess network and subnetwork paths map back to refs (#4249)", () => {
+    const tree = toCnrmTree(
+      "RunService",
+      {
+        name: "projects/my-project/locations/europe-west1/services/web",
+        template: {
+          vpcAccess: {
+            egress: "PRIVATE_RANGES_ONLY",
+            networkInterfaces: [
+              { network: "projects/my-project/global/networks/vpc", subnetwork: "projects/my-project/regions/europe-west1/subnetworks/apps" },
+              { network: "projects/other/global/networks/shared", subnetwork: "apps" },
+            ],
+          },
+        },
+      },
+      ctx,
+    ) as { template: { vpcAccess: unknown } };
+    expect(tree.template.vpcAccess).toEqual({
+      egress: "PRIVATE_RANGES_ONLY",
+      networkInterfaces: [
+        { networkRef: { name: "vpc" }, subnetworkRef: { name: "apps" } },
+        { networkRef: { external: "projects/other/global/networks/shared" }, subnetworkRef: { name: "apps" } },
+      ],
+    });
+  });
+
   test("bucket: GCS's iamConfiguration and lifecycle map onto the CNRM field names", () => {
     const tree = toCnrmTree(
       "StorageBucket",
@@ -250,7 +276,7 @@ describe("observeResourcesDeepGcp — over REST (#1209)", () => {
   });
 
   test("a kind the applier cannot write is unsupported-kind, and is never queried", async () => {
-    const out = await observe(entities([["e", "GCP::Compute::Network", { metadata: { name: "n" } }]]));
+    const out = await observe(entities([["e", "GCP::Compute::Firewall", { metadata: { name: "n" } }]]));
     expect(out.unobserved?.e?.reason).toBe("unsupported-kind");
     expect(fetchMock).not.toHaveBeenCalled();
   });

package/src/deep-observe.ts

@@ -191,6 +191,24 @@ const CNRM_REFINERS: Record<string, (tree: CnrmTree, ctx: RefineContext) => void
       template.serviceAccountRef = email.endsWith(suffix) ? { name: email.slice(0, -suffix.length) } : { external: email };
       delete template.serviceAccount;
     }
+    // #4249: Direct VPC egress paths back to CNRM's refs, `name` for the
+    // project's own network and subnetwork, `external` otherwise.
+    const vpcAccess = template?.vpcAccess as { networkInterfaces?: unknown } | undefined;
+    if (vpcAccess && Array.isArray(vpcAccess.networkInterfaces)) {
+      const own = (value: string, pattern: RegExp): { name: string } | { external: string } => {
+        if (!value.includes("/")) return { name: value };
+        const hit = pattern.exec(value);
+        return hit && hit[1] === ctx.project ? { name: hit[2] } : { external: value };
+      };
+      vpcAccess.networkInterfaces = (vpcAccess.networkInterfaces as Array<Record<string, unknown>>).map((i) => {
+        const { network, subnetwork, ...rest } = i;
+        return {
+          ...rest,
+          ...(typeof network === "string" ? { networkRef: own(network, /^projects\/([^/]+)\/global\/networks\/([^/]+)$/) } : {}),
+          ...(typeof subnetwork === "string" ? { subnetworkRef: own(subnetwork, /^projects\/([^/]+)\/regions\/[^/]+\/subnetworks\/([^/]+)$/) } : {}),
+        };
+      });
+    }
   },
   // #4233: the inverse of gcp-compute.ts's body builders. Compute returns refs
   // as full URLs and a region as a URL; CNRM writes `*Ref: { name }` and a
@@ -269,6 +287,35 @@ const CNRM_REFINERS: Record<string, (tree: CnrmTree, ctx: RefineContext) => void
       delete tree.urlMap;
     }
   },
+  // #4248: a network is global and has no location; compute nests the routing
+  // mode and lists the subnetworks it holds, which CNRM declares separately.
+  ComputeNetwork(tree) {
+    const routing = tree.routingConfig as { routingMode?: unknown } | undefined;
+    if (routing) {
+      if (routing.routingMode !== undefined) tree.routingMode = routing.routingMode;
+      delete tree.routingConfig;
+    }
+    delete tree.subnetworks;
+    delete tree.gatewayIPv4;
+  },
+  ComputeSubnetwork(tree) {
+    if (typeof tree.region === "string") tree.region = lastSegment(tree.region);
+    if (typeof tree.network === "string") {
+      tree.networkRef = { name: lastSegment(tree.network) };
+      delete tree.network;
+    }
+    if (Array.isArray(tree.secondaryIpRanges)) {
+      tree.secondaryIpRange = tree.secondaryIpRanges;
+      delete tree.secondaryIpRanges;
+    }
+    const log = tree.logConfig as { enable?: unknown } | undefined;
+    if (log) {
+      if (log.enable === false) delete tree.logConfig;
+      else delete log.enable;
+    }
+    delete tree.gatewayAddress;
+    delete tree.fingerprint;
+  },
   ComputeForwardingRule(tree) {
     computeLocation(tree);
     if (tree.IPProtocol !== undefined) {

package/src/describe-resources.test.ts

@@ -80,7 +80,7 @@ describe("gcp describeResources — direct REST (#1209)", () => {
 
   test("a kind the applier has no mapper for is unsupported-kind, not absent", async () => {
     const out = await read(
-      makeEntities([{ name: "e", entityType: "GCP::Compute::Network", props: { metadata: { name: "net" } } }]),
+      makeEntities([{ name: "e", entityType: "GCP::Compute::Firewall", props: { metadata: { name: "net" } } }]),
     );
     expect(out.unobserved?.e?.reason).toBe("unsupported-kind");
     expect(fetchMock).not.toHaveBeenCalled();

package/src/op/activities/gcp-apply.test.ts

@@ -5,6 +5,7 @@ import {
   bucketInsertBody,
   pubSubTopicBody,
   cloudRunServiceBody,
+  networkInterface,
   serviceAccountEmail,
   resolveGcpProject,
   resolveGcpEndpoint,
@@ -122,7 +123,9 @@ describe("mappers build correct plans (#706)", () => {
       "ComputeAddress",
       "ComputeBackendService",
       "ComputeForwardingRule",
+      "ComputeNetwork",
       "ComputeRegionNetworkEndpointGroup",
+      "ComputeSubnetwork",
       "ComputeTargetHTTPProxy",
       "ComputeURLMap",
       "IAMPolicyMember",
@@ -164,6 +167,41 @@ describe("Cloud Run mapper + LRO (#706)", () => {
     expect(() => serviceAccountEmail({ name: "run-sa" })).toThrow(/needs a project/);
   });
 
+  test("cloudRunServiceBody sends vpcAccess refs as network and subnetwork paths (#4249)", () => {
+    const resource = {
+      ...RUN_SERVICE,
+      spec: {
+        ...(RUN_SERVICE.spec as object),
+        location: "europe-west1",
+        template: {
+          containers: [{ image: "i" }],
+          vpcAccess: {
+            egress: "PRIVATE_RANGES_ONLY",
+            networkInterfaces: [{ networkRef: { name: "vpc" }, subnetworkRef: { name: "apps" }, tags: ["run"] }],
+          },
+        },
+      },
+    };
+    expect(cloudRunServiceBody(resource, "p")).toEqual({
+      template: {
+        containers: [{ image: "i" }],
+        vpcAccess: {
+          egress: "PRIVATE_RANGES_ONLY",
+          networkInterfaces: [
+            { tags: ["run"], network: "projects/p/global/networks/vpc", subnetwork: "projects/p/regions/europe-west1/subnetworks/apps" },
+          ],
+        },
+      },
+    });
+  });
+
+  test("networkInterface: external as given, name needs a project", () => {
+    expect(networkInterface({ networkRef: { external: "projects/o/global/networks/shared" } }, "p", "r")).toEqual({
+      network: "projects/o/global/networks/shared",
+    });
+    expect(() => networkInterface({ subnetworkRef: { name: "apps" } }, undefined, "r")).toThrow(/needs a project/);
+  });
+
   test("RunService plan sends the service account email on create and update", () => {
     const resource = {
       ...RUN_SERVICE,

package/src/op/activities/gcp-apply.ts

@@ -8,6 +8,8 @@ import {
   backendServiceMapper,
   computeAddressMapper,
   forwardingRuleMapper,
+  networkMapper,
+  subnetworkMapper,
   regionNetworkEndpointGroupMapper,
   targetHttpProxyMapper,
   urlMapMapper,
@@ -292,10 +294,39 @@ export function cloudRunServiceBody(resource: GcpResource, project?: string): {
   if (!spec.template) return body;
   const { serviceAccountRef, ...template } = spec.template as { serviceAccountRef?: { name?: string; external?: string } };
   const email = serviceAccountEmail(serviceAccountRef, project);
-  body.template = email ? { ...template, serviceAccount: email } : template;
+  const out: Record<string, unknown> = email ? { ...template, serviceAccount: email } : { ...template };
+  const vpcAccess = out.vpcAccess as { networkInterfaces?: unknown } | undefined;
+  if (vpcAccess && Array.isArray(vpcAccess.networkInterfaces)) {
+    const region = ((resource.spec ?? {}) as { location?: string }).location ?? "us-central1";
+    out.vpcAccess = { ...vpcAccess, networkInterfaces: vpcAccess.networkInterfaces.map((i) => networkInterface(i, project, region)) };
+  }
+  body.template = out;
   return body;
 }
 
+type NameRef = { name?: string; external?: string };
+
+/**
+ * A CNRM Direct VPC egress interface as Cloud Run v2 takes it (#4249):
+ * `networkRef` and `subnetworkRef` become `network` and `subnetwork` paths,
+ * `name` in the project (the subnetwork in the service's region) and
+ * `external` as given. `tags` and anything else pass through. Pure.
+ */
+export function networkInterface(iface: unknown, project: string | undefined, region: string): unknown {
+  if (!iface || typeof iface !== "object") return iface;
+  const { networkRef, subnetworkRef, ...rest } = iface as { networkRef?: NameRef; subnetworkRef?: NameRef };
+  const path = (ref: NameRef | undefined, scoped: (p: string, n: string) => string, key: string): string | undefined => {
+    if (!ref) return undefined;
+    if (ref.external) return ref.external;
+    if (!ref.name) return undefined;
+    if (!project) throw new Error(`${key} { name: "${ref.name}" } needs a project to form its path`);
+    return scoped(project, ref.name);
+  };
+  const network = path(networkRef, (p, n) => `projects/${p}/global/networks/${n}`, "networkRef");
+  const subnetwork = path(subnetworkRef, (p, n) => `projects/${p}/regions/${region}/subnetworks/${n}`, "subnetworkRef");
+  return { ...rest, ...(network ? { network } : {}), ...(subnetwork ? { subnetwork } : {}) };
+}
+
 /**
  * The email a CNRM `serviceAccountRef` names: `external` as given (an email,
  * or a `projects/<p>/serviceAccounts/<email>` path), `name` as an account id
@@ -435,6 +466,8 @@ export const MAPPERS: Record<string, ResourceMapper> = {
   ComputeURLMap: urlMapMapper,
   ComputeTargetHTTPProxy: targetHttpProxyMapper,
   ComputeForwardingRule: forwardingRuleMapper,
+  ComputeNetwork: networkMapper,
+  ComputeSubnetwork: subnetworkMapper,
 };
 
 /**
@@ -461,6 +494,8 @@ const REF_KINDS: Record<string, string> = {
   backendServiceRef: "ComputeBackendService",
   urlMapRef: "ComputeURLMap",
   targetHTTPProxyRef: "ComputeTargetHTTPProxy",
+  networkRef: "ComputeNetwork",
+  subnetworkRef: "ComputeSubnetwork",
 };
 
 /** The local resources this resource references via `*Ref` fields, each with its kind when known. Pure. */

package/src/op/activities/gcp-compute.test.ts

@@ -210,3 +210,97 @@ describe("deep observe reads a load balancer back in the declared vocabulary (#4
     });
   });
 });
+
+describe("network and subnetwork mappers (#4248)", () => {
+  const net: GcpResource[] = [
+    {
+      kind: "ComputeSubnetwork",
+      metadata: { name: "apps" },
+      spec: {
+        region: "europe-west1",
+        ipCidrRange: "10.0.0.0/24",
+        networkRef: { name: "vpc" },
+        privateIpGoogleAccess: true,
+        secondaryIpRange: [{ rangeName: "pods", ipCidrRange: "10.4.0.0/14" }],
+      },
+    },
+    { kind: "ComputeNetwork", metadata: { name: "vpc" }, spec: { routingMode: "REGIONAL" } },
+    {
+      kind: "RunService",
+      metadata: { name: "web" },
+      spec: { location: "europe-west1", template: { vpcAccess: { networkInterfaces: [{ networkRef: { name: "vpc" }, subnetworkRef: { name: "apps" } }] } } },
+    },
+  ];
+  const nctx = { base: "https://compute.googleapis.com", project: "p1", manifest: net };
+  const find = (kind: string) => net.find((r) => r.kind === kind)!;
+
+  test("a network is global, with autoCreateSubnetworks false unless declared and the routing mode nested", () => {
+    process.env.GCP_REGION = "us-east1";
+    const plan = MAPPERS.ComputeNetwork.plan(find("ComputeNetwork"), nctx);
+    expect(plan.create.url).toBe("https://compute.googleapis.com/compute/v1/projects/p1/global/networks");
+    expect(plan.getUrl).toBe("https://compute.googleapis.com/compute/v1/projects/p1/global/networks/vpc");
+    expect(plan.create.body).toEqual({ name: "vpc", autoCreateSubnetworks: false, routingConfig: { routingMode: "REGIONAL" } });
+  });
+
+  test("a subnetwork is regional and names its network by partial URL", () => {
+    const plan = MAPPERS.ComputeSubnetwork.plan(find("ComputeSubnetwork"), nctx);
+    expect(plan.create.url).toBe("https://compute.googleapis.com/compute/v1/projects/p1/regions/europe-west1/subnetworks");
+    expect(plan.create.body).toEqual({
+      name: "apps",
+      ipCidrRange: "10.0.0.0/24",
+      privateIpGoogleAccess: true,
+      network: "projects/p1/global/networks/vpc",
+      secondaryIpRanges: [{ rangeName: "pods", ipCidrRange: "10.4.0.0/14" }],
+    });
+  });
+
+  test("apply order: network, then subnetwork, then the Cloud Run service that egresses into them", () => {
+    const order = orderByReferences(net).map((r) => r.kind);
+    expect(order.indexOf("ComputeNetwork")).toBeLessThan(order.indexOf("ComputeSubnetwork"));
+    expect(order.indexOf("ComputeSubnetwork")).toBeLessThan(order.indexOf("RunService"));
+  });
+
+  test("the reader reads a network at its global URL", async () => {
+    const http = async (_m: string, url: string) =>
+      url.endsWith("/global/networks/vpc") ? { status: 200, text: JSON.stringify({ name: "vpc" }) } : { status: 404, text: "" };
+    expect(await getResource({ project: "p1", http }, "ComputeNetwork", "vpc", {})).toEqual({ name: "vpc" });
+  });
+
+  test("deep observe inverts both body builders", async () => {
+    const { toCnrmTree } = await import("../../deep-observe");
+    const c = { project: "p1" };
+    expect(
+      toCnrmTree(
+        "ComputeNetwork",
+        {
+          name: "vpc",
+          autoCreateSubnetworks: false,
+          routingConfig: { routingMode: "REGIONAL" },
+          subnetworks: ["https://compute.googleapis.com/compute/v1/projects/p1/regions/europe-west1/subnetworks/apps"],
+        },
+        c,
+      ),
+    ).toEqual({ metadata: { name: "vpc" }, autoCreateSubnetworks: false, routingMode: "REGIONAL" });
+    expect(
+      toCnrmTree(
+        "ComputeSubnetwork",
+        {
+          name: "apps",
+          region: "https://compute.googleapis.com/compute/v1/projects/p1/regions/europe-west1",
+          network: "https://compute.googleapis.com/compute/v1/projects/p1/global/networks/vpc",
+          ipCidrRange: "10.0.0.0/24",
+          gatewayAddress: "10.0.0.1",
+          fingerprint: "abc",
+          secondaryIpRanges: [{ rangeName: "pods", ipCidrRange: "10.4.0.0/14" }],
+        },
+        c,
+      ),
+    ).toEqual({
+      metadata: { name: "apps" },
+      region: "europe-west1",
+      networkRef: { name: "vpc" },
+      ipCidrRange: "10.0.0.0/24",
+      secondaryIpRange: [{ rangeName: "pods", ipCidrRange: "10.4.0.0/14" }],
+    });
+  });
+});

package/src/op/activities/gcp-compute.ts

@@ -1,7 +1,9 @@
 /**
  * Compute Engine mappers for the Cloud Run load balancer (#4233): ComputeAddress,
  * ComputeRegionNetworkEndpointGroup (serverless NEGs), ComputeBackendService,
- * ComputeURLMap, ComputeTargetHTTPProxy and ComputeForwardingRule.
+ * ComputeURLMap, ComputeTargetHTTPProxy and ComputeForwardingRule; and for a
+ * declared network (#4248): ComputeNetwork (always global) and
+ * ComputeSubnetwork (regional, by its CNRM `region`).
  *
  * Each maps a CNRM spec onto the compute v1 insert body. A resource is global
  * or regional by its CNRM `location` (`"global"` or a region; a NEG has
@@ -168,6 +170,36 @@ export function negBody(resource: GcpResource, ctx: ComputeCtx): Obj {
   return body;
 }
 
+/**
+ * ComputeNetwork → networks.insert body. A network is global. CNRM's
+ * `autoCreateSubnetworks` defaults to false, where compute's default is true,
+ * so it is always sent. Pure.
+ */
+export function networkBody(resource: GcpResource): Obj {
+  const spec = (resource.spec ?? {}) as Obj;
+  const body: Obj = {
+    name: computeName(resource),
+    autoCreateSubnetworks: spec.autoCreateSubnetworks === true,
+    ...pick(spec, ["description", "mtu", "networkFirewallPolicyEnforcementOrder"]),
+  };
+  if (typeof spec.routingMode === "string") body.routingConfig = { routingMode: spec.routingMode };
+  return body;
+}
+
+/** ComputeSubnetwork → subnetworks.insert body. CNRM's `secondaryIpRange` and `logConfig` become compute's `secondaryIpRanges` and an enabled `logConfig`. Pure. */
+export function subnetworkBody(resource: GcpResource, ctx: ComputeCtx): Obj {
+  const spec = (resource.spec ?? {}) as Obj;
+  const scope = scopeOf(spec);
+  const body: Obj = {
+    name: computeName(resource),
+    ...pick(spec, ["ipCidrRange", "description", "privateIpGoogleAccess", "purpose", "role", "stackType"]),
+  };
+  if (isObj(spec.networkRef)) body.network = refUrl("networkRef", spec.networkRef as Ref, ctx, scope);
+  if (Array.isArray(spec.secondaryIpRange)) body.secondaryIpRanges = spec.secondaryIpRange;
+  if (isObj(spec.logConfig)) body.logConfig = { enable: true, ...spec.logConfig };
+  return body;
+}
+
 /** ComputeBackendService → backendServices.insert body. Pure. */
 export function backendServiceBody(resource: GcpResource, ctx: ComputeCtx): Obj {
   const spec = (resource.spec ?? {}) as Obj;
@@ -297,13 +329,14 @@ function computeMapper(
   collection: string,
   build: (resource: GcpResource, ctx: ComputeCtx) => Obj,
   regionalCollection = collection,
+  scopeFor: (spec: Obj | undefined) => string = (spec) => scopeOf(spec),
 ): ResourceMapper {
   return {
     kind,
     defaultHost: COMPUTE_HOST,
     operation: computeOperation,
     plan(resource, ctx) {
-      const scope = scopeOf(resource.spec as Obj | undefined);
+      const scope = scopeFor(resource.spec as Obj | undefined);
       const coll = `${ctx.base}/compute/v1/${scopePath(ctx.project, scope)}/${scope === "global" ? collection : regionalCollection}`;
       const name = computeName(resource);
       return { getUrl: `${coll}/${enc(name)}`, create: { method: "POST", url: coll, body: build(resource, ctx) } };
@@ -317,3 +350,5 @@ export const backendServiceMapper = computeMapper("ComputeBackendService", "back
 export const urlMapMapper = computeMapper("ComputeURLMap", "urlMaps", urlMapBody);
 export const targetHttpProxyMapper = computeMapper("ComputeTargetHTTPProxy", "targetHttpProxies", targetHttpProxyBody);
 export const forwardingRuleMapper = computeMapper("ComputeForwardingRule", "forwardingRules", forwardingRuleBody);
+export const networkMapper = computeMapper("ComputeNetwork", "networks", networkBody, "networks", () => "global");
+export const subnetworkMapper = computeMapper("ComputeSubnetwork", "subnetworks", subnetworkBody);

package/src/serializer.test.ts

@@ -293,3 +293,29 @@ describe("gcpSerializer", () => {
     expect(result).toContain("ComputeInstance");
   });
 });
+
+describe("a .name reference serializes as the target's metadata.name (#4242)", () => {
+  test("a declared metadata.name wins; without one, the kebab-cased logical id", async () => {
+    const { RegionNetworkEndpointGroup, BackendService, CloudRunService } = await import("./generated");
+    const web = new CloudRunService({ location: "us-central1", template: { containers: [{ image: "i" }] } } as any);
+    (web as any).name._setLogicalName("webService");
+    const neg = new RegionNetworkEndpointGroup({
+      metadata: { name: "three-cloud-neg" },
+      region: "us-central1",
+      networkEndpointType: "SERVERLESS",
+      cloudRun: { serviceRef: { name: (web as any).name } },
+    } as any);
+    (neg as any).name._setLogicalName("neg");
+    const backend = new BackendService({
+      metadata: { name: "three-cloud-backend" },
+      location: "global",
+      backend: [{ group: { networkEndpointGroupRef: { name: (neg as any).name } } }],
+    } as any);
+    const entities = new Map<string, any>([["webService", web], ["neg", neg], ["backend", backend]]);
+    const yaml = String(gcpSerializer.serialize(entities));
+    expect(yaml).toContain("name: three-cloud-neg");
+    expect(yaml).not.toMatch(/networkEndpointGroupRef:\s*\n\s*name: neg\b/);
+    expect(yaml).toMatch(/serviceRef:\s*\n\s*name: web-service/);
+    expect(yaml).toMatch(/networkEndpointGroupRef:\s*\n\s*name: three-cloud-neg/);
+  });
+});

package/src/serializer.ts

@@ -84,15 +84,14 @@ function deriveGVKFromType(entityType: string): { apiVersion: string; kind: stri
  * GCP visitor for the generic serializer walker.
  */
 function gcpVisitor(entityNames: Map<Declarable, string>): SerializerVisitor {
+  // Config Connector resolves a `*Ref: { name }` by the target's metadata.name,
+  // which is its declared name or else the kebab-cased logical id (#4242).
+  const cnrmNames = new Map<string, string>();
+  for (const [entity, logical] of entityNames) cnrmNames.set(logical, cnrmName(logical, entity));
+  const resolve = (logical: string) => cnrmNames.get(logical) ?? logical;
   return {
-    attrRef: (name, _attr) => {
-      // For Config Connector, references resolve to metadata.name
-      return name;
-    },
-    resourceRef: (name) => {
-      // Config Connector uses resourceRef pattern: { name: "resource-name" }
-      return { name };
-    },
+    attrRef: (name, _attr) => resolve(name),
+    resourceRef: (name) => ({ name: resolve(name) }),
     propertyDeclarable: (entity, walk) => {
       if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
         return undefined;
@@ -109,6 +108,20 @@ function gcpVisitor(entityNames: Map<Declarable, string>): SerializerVisitor {
   };
 }
 
+/**
+ * The metadata.name a resource is written with: a string `metadata.name` in its
+ * props, else its logical id in kebab case.
+ */
+export function cnrmName(logical: string, entity: Declarable): string {
+  const props = isResourceDeclarable(entity) ? (entity.props as { metadata?: { name?: unknown } } | undefined) : undefined;
+  const declared = props?.metadata?.name;
+  return typeof declared === "string" && declared.length > 0 ? declared : kebabName(logical);
+}
+
+function kebabName(logical: string): string {
+  return logical.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
+
 /**
  * Convert a value to YAML-compatible form using the walker.
  */
@@ -189,7 +202,7 @@ export const gcpSerializer: Serializer = {
       // Build metadata
       const metadata: Record<string, unknown> = props.metadata as Record<string, unknown> ?? {};
       if (!metadata.name) {
-        metadata.name = name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+        metadata.name = kebabName(name);
       }
 
       // Merge default labels