@intentius/chant-lexicon-gcp 0.124.35 → 0.124.37

package/dist/op/activities/gcp-compute.js

@@ -1,7 +1,9 @@
 /**
  * Compute Engine mappers for the Cloud Run load balancer (#4233): ComputeAddress,
  * ComputeRegionNetworkEndpointGroup (serverless NEGs), ComputeBackendService,
- * ComputeURLMap, ComputeTargetHTTPProxy and ComputeForwardingRule.
+ * ComputeURLMap, ComputeTargetHTTPProxy and ComputeForwardingRule; and for a
+ * declared network (#4248): ComputeNetwork (always global) and
+ * ComputeSubnetwork (regional, by its CNRM `region`).
  *
  * Each maps a CNRM spec onto the compute v1 insert body. A resource is global
  * or regional by its CNRM `location` (`"global"` or a region; a NEG has
@@ -158,6 +160,38 @@ export function negBody(resource, ctx) {
         body.subnetwork = refUrl("subnetworkRef", spec.subnetworkRef, ctx, scope);
     return body;
 }
+/**
+ * ComputeNetwork → networks.insert body. A network is global. CNRM's
+ * `autoCreateSubnetworks` defaults to false, where compute's default is true,
+ * so it is always sent. Pure.
+ */
+export function networkBody(resource) {
+    const spec = (resource.spec ?? {});
+    const body = {
+        name: computeName(resource),
+        autoCreateSubnetworks: spec.autoCreateSubnetworks === true,
+        ...pick(spec, ["description", "mtu", "networkFirewallPolicyEnforcementOrder"]),
+    };
+    if (typeof spec.routingMode === "string")
+        body.routingConfig = { routingMode: spec.routingMode };
+    return body;
+}
+/** ComputeSubnetwork → subnetworks.insert body. CNRM's `secondaryIpRange` and `logConfig` become compute's `secondaryIpRanges` and an enabled `logConfig`. Pure. */
+export function subnetworkBody(resource, ctx) {
+    const spec = (resource.spec ?? {});
+    const scope = scopeOf(spec);
+    const body = {
+        name: computeName(resource),
+        ...pick(spec, ["ipCidrRange", "description", "privateIpGoogleAccess", "purpose", "role", "stackType"]),
+    };
+    if (isObj(spec.networkRef))
+        body.network = refUrl("networkRef", spec.networkRef, ctx, scope);
+    if (Array.isArray(spec.secondaryIpRange))
+        body.secondaryIpRanges = spec.secondaryIpRange;
+    if (isObj(spec.logConfig))
+        body.logConfig = { enable: true, ...spec.logConfig };
+    return body;
+}
 /** ComputeBackendService → backendServices.insert body. Pure. */
 export function backendServiceBody(resource, ctx) {
     const spec = (resource.spec ?? {});
@@ -292,13 +326,13 @@ export const computeOperation = {
         return errors?.length ? errors.map((e) => e.message ?? e.code ?? "error").join("; ") : undefined;
     },
 };
-function computeMapper(kind, collection, build, regionalCollection = collection) {
+function computeMapper(kind, collection, build, regionalCollection = collection, scopeFor = (spec) => scopeOf(spec)) {
     return {
         kind,
         defaultHost: COMPUTE_HOST,
         operation: computeOperation,
         plan(resource, ctx) {
-            const scope = scopeOf(resource.spec);
+            const scope = scopeFor(resource.spec);
             const coll = `${ctx.base}/compute/v1/${scopePath(ctx.project, scope)}/${scope === "global" ? collection : regionalCollection}`;
             const name = computeName(resource);
             return { getUrl: `${coll}/${enc(name)}`, create: { method: "POST", url: coll, body: build(resource, ctx) } };
@@ -311,3 +345,5 @@ export const backendServiceMapper = computeMapper("ComputeBackendService", "back
 export const urlMapMapper = computeMapper("ComputeURLMap", "urlMaps", urlMapBody);
 export const targetHttpProxyMapper = computeMapper("ComputeTargetHTTPProxy", "targetHttpProxies", targetHttpProxyBody);
 export const forwardingRuleMapper = computeMapper("ComputeForwardingRule", "forwardingRules", forwardingRuleBody);
+export const networkMapper = computeMapper("ComputeNetwork", "networks", networkBody, "networks", () => "global");
+export const subnetworkMapper = computeMapper("ComputeSubnetwork", "subnetworks", subnetworkBody);

package/dist/op/activities/gcp-iam.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-iam.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-iam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAW,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,UAAU,MAAM;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/E,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/F;AAED,gHAAgH;AAChH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAqB7D;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,SAAS,WAAW,EAAO,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,SAAS,GAAG,SAAS,CAgDvB;AAYD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAElF;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAY5E;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAS/E;AAkED,eAAO,MAAM,qBAAqB,EAAE,cA8CnC,CAAC"}
+{"version":3,"file":"gcp-iam.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-iam.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAW,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvF,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,OAAO;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,UAAU,MAAM;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/E,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/F;AAED,gHAAgH;AAChH,eAAO,MAAM,gBAAgB,+BAA+B,CAAC;AAqB7D;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,SAAS,WAAW,EAAO,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,SAAS,GAAG,SAAS,CAgDvB;AAYD,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAElF;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAY5E;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAS/E;AAkED,eAAO,MAAM,qBAAqB,EAAE,cAgDnC,CAAC"}

package/dist/op/activities/gcp-iam.js

@@ -202,6 +202,8 @@ export const iamPolicyMemberMapper = {
                 status: 200,
                 // `resourceRef` is the declared one: the policy read is that target's, so the binding is on it.
                 text: JSON.stringify({
+                    // The binding has no id of its own; this one names it, so a read reports a physical id (#4251).
+                    selfLink: `${target.path}#${spec.role}#${spec.member}`,
                     member: spec.member,
                     role: spec.role,
                     resource: target.path,

package/dist/serializer.d.ts

@@ -4,6 +4,7 @@
  * Converts Chant declarables to multi-document K8s YAML output
  * for Config Connector resources with apiVersion, kind, metadata, and spec.
  */
+import type { Declarable } from "@intentius/chant/declarable";
 import type { Serializer } from "@intentius/chant/serializer";
 /**
  * Resolve entityType to apiVersion and kind.
@@ -17,8 +18,25 @@ export declare function resolveGVK(entityType: string): {
     apiVersion: string;
     kind: string;
 } | null;
+/**
+ * The metadata.name a resource is written with: a string `metadata.name` in its
+ * props, else its logical id in kebab case.
+ */
+export declare function cnrmName(logical: string, entity: Declarable): string;
+/** {@link cnrmName} from a resource's props, for callers holding props rather than the declarable. */
+export declare function cnrmNameOf(logical: string, props: unknown): string;
+/**
+ * Declared props with each reference to another resource replaced as the
+ * serializer writes it (#4251): an attribute reference (`neg.name`) becomes the
+ * target's metadata.name, and a resource placed whole becomes `{ name }`.
+ * `logicalOf` maps a target's props object to its logical id, for a reference
+ * that does not carry one. Other values, pseudo-parameters included, are kept.
+ */
+export declare function resolveCnrmRefs(value: unknown, logicalOf: (props: unknown) => string | undefined): unknown;
 /**
  * GCP Config Connector YAML serializer implementation.
  */
 export declare const gcpSerializer: Serializer;
+/** The `gcp.project` a chant.config declares, if any (#4252). */
+export declare function gcpConfigProject(config: Record<string, unknown> | undefined): string | undefined;
 //# sourceMappingURL=serializer.d.ts.map

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAiClG;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW1F;AAsED;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAiG3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAiClG;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW1F;AA+CD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM,CAEpE;AAED,sGAAsG;AACtG,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAGlE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,OAAO,CAkB1G;AA4BD;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UAsG3B,CAAC;AAIF,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGhG"}

package/dist/serializer.js

@@ -6,7 +6,8 @@
  */
 import { createRequire } from "module";
 import { moduleSourceUrl } from "@intentius/chant/module-source";
-import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { isDeclarable, isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { AttrRef } from "@intentius/chant/attrref";
 import { ownershipEntries, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import { walkValue } from "@intentius/chant/serializer-walker";
 import { emitYAML } from "@intentius/chant/yaml";
@@ -62,15 +63,15 @@ function deriveGVKFromType(entityType) {
  * GCP visitor for the generic serializer walker.
  */
 function gcpVisitor(entityNames) {
+    // Config Connector resolves a `*Ref: { name }` by the target's metadata.name,
+    // which is its declared name or else the kebab-cased logical id (#4242).
+    const cnrmNames = new Map();
+    for (const [entity, logical] of entityNames)
+        cnrmNames.set(logical, cnrmName(logical, entity));
+    const resolve = (logical) => cnrmNames.get(logical) ?? logical;
     return {
-        attrRef: (name, _attr) => {
-            // For Config Connector, references resolve to metadata.name
-            return name;
-        },
-        resourceRef: (name) => {
-            // Config Connector uses resourceRef pattern: { name: "resource-name" }
-            return { name };
-        },
+        attrRef: (name, _attr) => resolve(name),
+        resourceRef: (name) => ({ name: resolve(name) }),
         propertyDeclarable: (entity, walk) => {
             if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
                 return undefined;
@@ -86,6 +87,51 @@ function gcpVisitor(entityNames) {
         },
     };
 }
+/**
+ * The metadata.name a resource is written with: a string `metadata.name` in its
+ * props, else its logical id in kebab case.
+ */
+export function cnrmName(logical, entity) {
+    return cnrmNameOf(logical, isResourceDeclarable(entity) ? entity.props : undefined);
+}
+/** {@link cnrmName} from a resource's props, for callers holding props rather than the declarable. */
+export function cnrmNameOf(logical, props) {
+    const declared = props?.metadata?.name;
+    return typeof declared === "string" && declared.length > 0 ? declared : kebabName(logical);
+}
+/**
+ * Declared props with each reference to another resource replaced as the
+ * serializer writes it (#4251): an attribute reference (`neg.name`) becomes the
+ * target's metadata.name, and a resource placed whole becomes `{ name }`.
+ * `logicalOf` maps a target's props object to its logical id, for a reference
+ * that does not carry one. Other values, pseudo-parameters included, are kept.
+ */
+export function resolveCnrmRefs(value, logicalOf) {
+    if (value instanceof AttrRef) {
+        const parent = value.parent.deref();
+        const props = parent && isResourceDeclarable(parent) ? parent.props : undefined;
+        const logical = value.getLogicalName() ?? logicalOf(props);
+        return logical === undefined ? value : cnrmNameOf(logical, props);
+    }
+    if (Array.isArray(value))
+        return value.map((v) => resolveCnrmRefs(v, logicalOf));
+    if (value === null || typeof value !== "object")
+        return value;
+    if (isDeclarable(value)) {
+        const props = isResourceDeclarable(value) ? value.props : undefined;
+        const logical = logicalOf(props);
+        return logical === undefined ? value : { name: cnrmNameOf(logical, props) };
+    }
+    if (INTRINSIC_MARKER in value)
+        return value;
+    const out = {};
+    for (const [k, v] of Object.entries(value))
+        out[k] = resolveCnrmRefs(v, logicalOf);
+    return out;
+}
+function kebabName(logical) {
+    return logical.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+}
 /**
  * Convert a value to YAML-compatible form using the walker.
  */
@@ -121,7 +167,11 @@ export const gcpSerializer = {
         let defaultLabelEntries = context?.ownership
             ? { ...ownershipEntries(LABEL_OWNERSHIP_KEYS, context.ownership) }
             : {};
-        let defaultAnnotationEntries = {};
+        // #4252: a member's project, once, in chant.config's `gcp.project`. It
+        // resolves GCP.ProjectId and is written as each resource's project-id
+        // annotation, which apply and the readers take ahead of the env vars.
+        const configProject = gcpConfigProject(context?.config);
+        let defaultAnnotationEntries = configProject ? { [PROJECT_ID_ANNOTATION]: configProject } : {};
         for (const [, entity] of entities) {
             if (isDefaultLabels(entity)) {
                 defaultLabelEntries = { ...defaultLabelEntries, ...entity.labels };
@@ -141,7 +191,7 @@ export const gcpSerializer = {
             const gvk = resolveGVK(entityType);
             if (!gvk)
                 continue;
-            const props = resolvePseudoParameters(toYAMLValue(isResourceDeclarable(entity) ? entity.props : undefined, entityNames), name, unresolved);
+            const props = resolvePseudoParameters(toYAMLValue(isResourceDeclarable(entity) ? entity.props : undefined, entityNames), name, unresolved, configProject);
             if (!props)
                 continue;
             // Build the Config Connector manifest structure
@@ -152,7 +202,7 @@ export const gcpSerializer = {
             // Build metadata
             const metadata = props.metadata ?? {};
             if (!metadata.name) {
-                metadata.name = name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+                metadata.name = kebabName(name);
             }
             // Merge default labels
             if (Object.keys(defaultLabelEntries).length > 0) {
@@ -189,6 +239,12 @@ export const gcpSerializer = {
         return warnings.length > 0 ? { primary, warnings } : primary;
     },
 };
+const PROJECT_ID_ANNOTATION = "cnrm.cloud.google.com/project-id";
+/** The `gcp.project` a chant.config declares, if any (#4252). */
+export function gcpConfigProject(config) {
+    const project = config?.gcp?.project;
+    return typeof project === "string" && project.length > 0 ? project : undefined;
+}
 /**
  * Pseudo-parameter → environment variable mapping.
  * Config Connector annotations must be plain strings, so PseudoParameters
@@ -206,16 +262,16 @@ const PSEUDO_ENV_MAP = {
  * the API as an object. A variable that isn't set is recorded, and the
  * build refuses with every one named.
  */
-function resolvePseudoParameters(value, entity, unresolved) {
+function resolvePseudoParameters(value, entity, unresolved, project) {
     if (Array.isArray(value))
-        return value.map((v) => resolvePseudoParameters(v, entity, unresolved));
+        return value.map((v) => resolvePseudoParameters(v, entity, unresolved, project));
     if (value === null || typeof value !== "object")
         return value;
     const obj = value;
     const keys = Object.keys(obj);
     if (keys.length === 1 && keys[0] === "Ref" && typeof obj.Ref === "string" && obj.Ref in PSEUDO_ENV_MAP) {
         const { envVar } = PSEUDO_ENV_MAP[obj.Ref];
-        const resolved = process.env[envVar];
+        const resolved = (obj.Ref === "GCP::ProjectId" ? project : undefined) ?? process.env[envVar];
         if (resolved)
             return resolved;
         unresolved.push({ entity, ref: obj.Ref, envVar });
@@ -223,7 +279,7 @@ function resolvePseudoParameters(value, entity, unresolved) {
     }
     const out = {};
     for (const [k, v] of Object.entries(obj))
-        out[k] = resolvePseudoParameters(v, entity, unresolved);
+        out[k] = resolvePseudoParameters(v, entity, unresolved, project);
     return out;
 }
 function unresolvedMessage(unresolved) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.124.35",
+  "version": "0.124.37",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,6 +76,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.35"
+    "@intentius/chant": "^0.124.37"
   }
 }

package/src/api/read-client.ts

@@ -24,7 +24,8 @@
  * PubSubTopic, PubSubSubscription, SecretManagerSecret, IAMServiceAccount,
  * RunService, IAMPolicyMember and the Cloud Run load balancer kinds
  * (ComputeAddress, ComputeRegionNetworkEndpointGroup, ComputeBackendService,
- * ComputeURLMap, ComputeTargetHTTPProxy, ComputeForwardingRule; #4233). An
+ * ComputeURLMap, ComputeTargetHTTPProxy, ComputeForwardingRule; #4233), and
+ * ComputeNetwork and ComputeSubnetwork (#4248). An
  * IAMPolicyMember is read through its target's policy and is present when the
  * policy grants its member the role. The kubectl path could fetch any CNRM kind the cluster knew
  * about, so this is narrower on paper. It is not narrower in practice for

package/src/deep-observe.test.ts

@@ -139,6 +139,32 @@ describe("toCnrmTree — each REST shape in the declared vocabulary (#1210)", ()
     expect(other.template).toEqual({ serviceAccountRef: { external: "x@other.iam.gserviceaccount.com" } });
   });
 
+  test("run service: vpcAccess network and subnetwork paths map back to refs (#4249)", () => {
+    const tree = toCnrmTree(
+      "RunService",
+      {
+        name: "projects/my-project/locations/europe-west1/services/web",
+        template: {
+          vpcAccess: {
+            egress: "PRIVATE_RANGES_ONLY",
+            networkInterfaces: [
+              { network: "projects/my-project/global/networks/vpc", subnetwork: "projects/my-project/regions/europe-west1/subnetworks/apps" },
+              { network: "projects/other/global/networks/shared", subnetwork: "apps" },
+            ],
+          },
+        },
+      },
+      ctx,
+    ) as { template: { vpcAccess: unknown } };
+    expect(tree.template.vpcAccess).toEqual({
+      egress: "PRIVATE_RANGES_ONLY",
+      networkInterfaces: [
+        { networkRef: { name: "vpc" }, subnetworkRef: { name: "apps" } },
+        { networkRef: { external: "projects/other/global/networks/shared" }, subnetworkRef: { name: "apps" } },
+      ],
+    });
+  });
+
   test("bucket: GCS's iamConfiguration and lifecycle map onto the CNRM field names", () => {
     const tree = toCnrmTree(
       "StorageBucket",
@@ -250,7 +276,7 @@ describe("observeResourcesDeepGcp — over REST (#1209)", () => {
   });
 
   test("a kind the applier cannot write is unsupported-kind, and is never queried", async () => {
-    const out = await observe(entities([["e", "GCP::Compute::Network", { metadata: { name: "n" } }]]));
+    const out = await observe(entities([["e", "GCP::Compute::Firewall", { metadata: { name: "n" } }]]));
     expect(out.unobserved?.e?.reason).toBe("unsupported-kind");
     expect(fetchMock).not.toHaveBeenCalled();
   });

package/src/deep-observe.ts

@@ -61,7 +61,7 @@ import type {
 } from "@intentius/chant/lexicon";
 import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
 import { hasOwnershipMarker, type ChannelKeys } from "@intentius/chant/ownership";
-import { deriveGVK, manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
+import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources";
 import { getResource, mapperForKind, GcpReadError, isNotFound, type GcpReadClientOptions } from "./api/read-client";
 import { gcpDeepNormalizationHooks } from "./deep-observe-hooks";
 
@@ -191,6 +191,24 @@ const CNRM_REFINERS: Record<string, (tree: CnrmTree, ctx: RefineContext) => void
       template.serviceAccountRef = email.endsWith(suffix) ? { name: email.slice(0, -suffix.length) } : { external: email };
       delete template.serviceAccount;
     }
+    // #4249: Direct VPC egress paths back to CNRM's refs, `name` for the
+    // project's own network and subnetwork, `external` otherwise.
+    const vpcAccess = template?.vpcAccess as { networkInterfaces?: unknown } | undefined;
+    if (vpcAccess && Array.isArray(vpcAccess.networkInterfaces)) {
+      const own = (value: string, pattern: RegExp): { name: string } | { external: string } => {
+        if (!value.includes("/")) return { name: value };
+        const hit = pattern.exec(value);
+        return hit && hit[1] === ctx.project ? { name: hit[2] } : { external: value };
+      };
+      vpcAccess.networkInterfaces = (vpcAccess.networkInterfaces as Array<Record<string, unknown>>).map((i) => {
+        const { network, subnetwork, ...rest } = i;
+        return {
+          ...rest,
+          ...(typeof network === "string" ? { networkRef: own(network, /^projects\/([^/]+)\/global\/networks\/([^/]+)$/) } : {}),
+          ...(typeof subnetwork === "string" ? { subnetworkRef: own(subnetwork, /^projects\/([^/]+)\/regions\/[^/]+\/subnetworks\/([^/]+)$/) } : {}),
+        };
+      });
+    }
   },
   // #4233: the inverse of gcp-compute.ts's body builders. Compute returns refs
   // as full URLs and a region as a URL; CNRM writes `*Ref: { name }` and a
@@ -269,6 +287,35 @@ const CNRM_REFINERS: Record<string, (tree: CnrmTree, ctx: RefineContext) => void
       delete tree.urlMap;
     }
   },
+  // #4248: a network is global and has no location; compute nests the routing
+  // mode and lists the subnetworks it holds, which CNRM declares separately.
+  ComputeNetwork(tree) {
+    const routing = tree.routingConfig as { routingMode?: unknown } | undefined;
+    if (routing) {
+      if (routing.routingMode !== undefined) tree.routingMode = routing.routingMode;
+      delete tree.routingConfig;
+    }
+    delete tree.subnetworks;
+    delete tree.gatewayIPv4;
+  },
+  ComputeSubnetwork(tree) {
+    if (typeof tree.region === "string") tree.region = lastSegment(tree.region);
+    if (typeof tree.network === "string") {
+      tree.networkRef = { name: lastSegment(tree.network) };
+      delete tree.network;
+    }
+    if (Array.isArray(tree.secondaryIpRanges)) {
+      tree.secondaryIpRange = tree.secondaryIpRanges;
+      delete tree.secondaryIpRanges;
+    }
+    const log = tree.logConfig as { enable?: unknown } | undefined;
+    if (log) {
+      if (log.enable === false) delete tree.logConfig;
+      else delete log.enable;
+    }
+    delete tree.gatewayAddress;
+    delete tree.fingerprint;
+  },
   ComputeForwardingRule(tree) {
     computeLocation(tree);
     if (tree.IPProtocol !== undefined) {
@@ -340,8 +387,9 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
 
   const endpoint = process.env.GCP_ENDPOINT_URL;
   const manifestProjects = manifestProjectAnnotations(options.buildOutput);
+  const targets = readTargets(options.entities);
 
-  const reads = [...options.entities].map(async ([entityName, { entityType, props }]) => {
+  const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
     const gvk = deriveGVK(entityType);
     if (!gvk || !mapperForKind(gvk.kind)) {
       unobserved[entityName] = {
@@ -354,16 +402,8 @@ export async function observeResourcesDeepGcp(options: GcpDeepObserveOptions): P
       return;
     }
 
-    const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
-    const name = metadata?.name;
-    if (!name) {
-      unobserved[entityName] = {
-        type: entityType,
-        reason: "read-failed",
-        detail: "declared entity has no metadata.name to query by",
-      };
-      return;
-    }
+    const { name, props } = targets.get(entityName)!;
+    const metadata = props.metadata as { annotations?: Record<string, string> } | undefined;
 
     let client: GcpReadClientOptions;
     try {

package/src/describe-resources.test.ts

@@ -80,16 +80,17 @@ describe("gcp describeResources — direct REST (#1209)", () => {
 
   test("a kind the applier has no mapper for is unsupported-kind, not absent", async () => {
     const out = await read(
-      makeEntities([{ name: "e", entityType: "GCP::Compute::Network", props: { metadata: { name: "net" } } }]),
+      makeEntities([{ name: "e", entityType: "GCP::Compute::Firewall", props: { metadata: { name: "net" } } }]),
     );
     expect(out.unobserved?.e?.reason).toBe("unsupported-kind");
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
-  test("an entity with no metadata.name has nothing to query by", async () => {
-    const out = await read(makeEntities([{ name: "e", entityType: "GCP::Storage::Bucket", props: {} }]));
-    expect(out.unobserved?.e?.reason).toBe("read-failed");
-    expect(fetchMock).not.toHaveBeenCalled();
+  test("an entity with no metadata.name is read by the name the build gives it, the kebab-cased logical id (#4251)", async () => {
+    fetchMock.mockResolvedValue(reply(200, { name: "web-assets" }));
+    const out = await read(makeEntities([{ name: "webAssets", entityType: "GCP::Storage::Bucket", props: {} }]));
+    expect(out.resources.webAssets).toBeDefined();
+    expect(String(fetchMock.mock.calls[0][0])).toContain("/b/web-assets");
   });
 
   test("kinds resolve through the serializer's GVK map, not naive recasing", async () => {

package/src/describe-resources.ts

@@ -40,8 +40,8 @@ import type { ObservationResult, ResourceMetadata, UnobservedEntity } from "@int
 import { observation } from "@intentius/chant/observation";
 import { hasOwnershipMarker, classifyOwnership, readOwnership, type ChannelKeys } from "@intentius/chant/ownership";
 import { getResource, mapperForKind, GcpReadError, isNotFound, type GcpReadClientOptions } from "./api/read-client";
-import { resolveGcpProject, parseManifest, projectRefProject } from "./op/activities/gcp-apply";
-import { resolveGVK } from "./serializer";
+import { NO_PROJECT, parseManifest, projectRefProject } from "./op/activities/gcp-apply";
+import { cnrmNameOf, resolveCnrmRefs, resolveGVK } from "./serializer";
 
 /**
  * chant's ownership marker as GCP labels.
@@ -119,11 +119,12 @@ export function manifestProjectAnnotations(buildOutput: string | undefined): Map
 }
 
 /**
- * The project a read should target: the entity's `projectRef.external`,
- * `GOOGLE_CLOUD_PROJECT`, the entity's own annotation (via
- * `resolveGcpProject`, the applier's rule), then the built
- * manifest's merged annotation. Throws the applier's own error when nothing
- * resolves, so the `no-binding` detail names both knobs.
+ * The project a read should target, in apply's order (#4252): the entity's
+ * own literal `projectRef.external`, then the built manifest's project for it
+ * (its resolved projectRef, or the project-id annotation chant.config's
+ * `gcp.project` writes), then the entity's own annotation, then
+ * `GCP_PROJECT_ID`, then `GOOGLE_CLOUD_PROJECT`. Throws apply's own error when
+ * nothing resolves, so the `no-binding` detail names every knob.
  */
 export function resolveReadProject(
   kind: string,
@@ -131,14 +132,39 @@ export function resolveReadProject(
   metadata: { annotations?: Record<string, string> } | undefined,
   manifestProjects: Map<string, string>,
   props?: Record<string, unknown>,
+  env: NodeJS.ProcessEnv = process.env,
 ): string {
-  try {
-    return resolveGcpProject({ kind, metadata, ...(props ? { spec: props } : {}) });
-  } catch (err) {
-    const fromManifest = manifestProjects.get(`${kind}/${name}`);
-    if (fromManifest) return fromManifest;
-    throw err;
+  const project =
+    projectRefProject(props, {}) ||
+    manifestProjects.get(`${kind}/${name}`) ||
+    metadata?.annotations?.["cnrm.cloud.google.com/project-id"] ||
+    projectRefProject(props, env) ||
+    env.GCP_PROJECT_ID ||
+    env.GOOGLE_CLOUD_PROJECT;
+  if (!project) throw new Error(NO_PROJECT);
+  return project;
+}
+
+/**
+ * Each declared entity as a read sees it (#4251): the name the build writes
+ * (`metadata.name`, else the kebab-cased logical id) and its props with every
+ * reference to another resource resolved as the serializer resolves it, so a
+ * mapper building a read URL never meets an attribute reference.
+ */
+export function readTargets(
+  entities: Map<string, { entityType: string; props: Record<string, unknown> }>,
+): Map<string, { name: string; props: Record<string, unknown> }> {
+  const logicalByProps = new Map<unknown, string>();
+  for (const [logical, { props }] of entities) logicalByProps.set(props, logical);
+  const logicalOf = (props: unknown) => logicalByProps.get(props);
+  const out = new Map<string, { name: string; props: Record<string, unknown> }>();
+  for (const [logical, { props }] of entities) {
+    out.set(logical, {
+      name: cnrmNameOf(logical, props),
+      props: resolveCnrmRefs(props, logicalOf) as Record<string, unknown>,
+    });
   }
+  return out;
 }
 
 function pruneUndefined<T extends Record<string, unknown>>(obj: T): Record<string, unknown> {
@@ -196,8 +222,9 @@ export async function describeResources(options: {
   let warnedOwnership = false;
 
   const manifestProjects = manifestProjectAnnotations(options.buildOutput);
+  const targets = readTargets(options.entities);
 
-  const reads = [...options.entities].map(async ([entityName, { entityType, props }]) => {
+  const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
     const gvk = deriveGVK(entityType);
     if (!gvk) {
       unobserved[entityName] = {
@@ -218,16 +245,8 @@ export async function describeResources(options: {
       return;
     }
 
-    const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
-    const name = metadata?.name;
-    if (!name) {
-      unobserved[entityName] = {
-        type: entityType,
-        reason: "read-failed",
-        detail: "declared entity has no metadata.name to query by",
-      };
-      return;
-    }
+    const { name, props } = targets.get(entityName)!;
+    const metadata = props.metadata as { annotations?: Record<string, string> } | undefined;
 
     let client: GcpReadClientOptions;
     try {

package/src/health.ts

@@ -11,7 +11,7 @@
 
 import type { HealthEntry, HealthReadOptions, HealthReadResult, UnobservedEntity } from "@intentius/chant/lexicon";
 import { getResource, GcpReadError, isNotFound, type GcpReadHttp } from "./api/read-client";
-import { deriveGVK, manifestProjectAnnotations, resolveReadProject } from "./describe-resources";
+import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources";
 
 export const GCP_HEALTH_TYPES = ["GCP::Run::Service"] as const;
 
@@ -75,18 +75,15 @@ export async function observeHealthGcp(options: GcpHealthOptions): Promise<Healt
   const entities: Record<string, HealthEntry> = {};
   const unobserved: Record<string, UnobservedEntity> = {};
   const absent: string[] = [];
+  const targets = readTargets(options.entities);
 
   await Promise.all(
-    [...options.entities].map(async ([entityName, { entityType, props }]) => {
+    [...options.entities].map(async ([entityName, { entityType }]) => {
       const gvk = deriveGVK(entityType);
-      const metadata = props.metadata as { name?: string; annotations?: Record<string, string> } | undefined;
-      const name = metadata?.name;
-      if (!gvk || !name) {
-        unobserved[entityName] = {
-          type: entityType,
-          reason: "read-failed",
-          detail: gvk ? "declared entity has no metadata.name to query by" : `cannot derive a GCP kind from ${entityType}`,
-        };
+      const { name, props } = targets.get(entityName)!;
+      const metadata = props.metadata as { annotations?: Record<string, string> } | undefined;
+      if (!gvk) {
+        unobserved[entityName] = { type: entityType, reason: "read-failed", detail: `cannot derive a GCP kind from ${entityType}` };
         return;
       }
       let project: string;