@intentius/chant-lexicon-gcp 0.124.37 → 0.124.39

package/dist/composites/public-cloud-run.js

@@ -0,0 +1,144 @@
+/**
+ * PublicCloudRun composite: a Cloud Run service behind a global external
+ * Application Load Balancer, running as its own service account with Direct
+ * VPC egress into a subnet.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { BackendService, ComputeAddress, ForwardingRule, GCPServiceAccount, ManagedSSLCertificate, RegionNetworkEndpointGroup, TargetHTTPProxy, TargetHTTPSProxy, URLMap, } from "../generated/index.js";
+import { GCP } from "../pseudo.js";
+import { CloudRunServiceComposite } from "./cloud-run-service.js";
+/**
+ * Create a PublicCloudRun composite.
+ *
+ * @example
+ * ```ts
+ * import { PrivateEgressNetwork, PublicCloudRun } from "@intentius/chant-lexicon-gcp";
+ *
+ * const network = PrivateEgressNetwork({ name: "web", region: "us-central1", subnetCidr: "10.10.0.0/24" });
+ * const web = PublicCloudRun({
+ *   name: "web",
+ *   projectId: "my-project",
+ *   region: "us-central1",
+ *   vpc: network.vpc,
+ *   subnet: network.subnet,
+ *   image: "us-docker.pkg.dev/my-project/web/site:1",
+ * });
+ * ```
+ */
+export const PublicCloudRun = Composite((props) => {
+    const { name, image, region, projectId, vpc, subnet, vpcEgress = "PRIVATE_RANGES_ONLY", port = 8080, frontendPort = 80, minInstanceCount = 0, maxInstanceCount = 100, env, serviceAccount, domains, securityPolicy, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const meta = (suffix, component) => ({
+        name: `${name}-${suffix}`,
+        ...(namespace && { namespace }),
+        labels: { ...commonLabels, "app.kubernetes.io/component": component },
+    });
+    const result = {};
+    if (!serviceAccount) {
+        result.runtime = new GCPServiceAccount(mergeDefaults({
+            metadata: meta("run", "service-account"),
+            displayName: `${name} Cloud Run runtime`,
+        }, defs?.runtime));
+    }
+    const run = CloudRunServiceComposite({
+        name: `${name}-site`,
+        image,
+        projectId,
+        location: region,
+        port,
+        minInstanceCount,
+        maxInstanceCount,
+        env,
+        publicAccess: true,
+        serviceAccount: serviceAccount ?? `${name}-run`,
+        labels: extraLabels,
+        namespace,
+        defaults: {
+            service: mergeDefaults({
+                template: {
+                    vpcAccess: {
+                        egress: vpcEgress,
+                        networkInterfaces: [{ networkRef: { name: vpc.name }, subnetworkRef: { name: subnet.name } }],
+                    },
+                },
+            }, defs?.service),
+            publicIam: defs?.publicAccess,
+        },
+    });
+    result.service = run.service;
+    result.publicAccess = run.publicIam;
+    const neg = new RegionNetworkEndpointGroup(mergeDefaults({
+        metadata: meta("neg", "neg"),
+        region,
+        networkEndpointType: "SERVERLESS",
+        cloudRun: { serviceRef: { name: run.service.name } },
+    }, defs?.neg));
+    // A backend service over a serverless NEG takes no health check: Cloud Run
+    // reports its own readiness.
+    const backend = new BackendService(mergeDefaults({
+        metadata: meta("backend", "backend"),
+        location: "global",
+        loadBalancingScheme: "EXTERNAL_MANAGED",
+        protocol: "HTTP",
+        backend: [{ group: { networkEndpointGroupRef: { name: neg.name } } }],
+        ...(securityPolicy && { securityPolicyRef: { name: securityPolicy } }),
+    }, defs?.backend));
+    const urlMap = new URLMap(mergeDefaults({
+        metadata: meta("map", "url-map"),
+        location: "global",
+        defaultService: { backendServiceRef: { name: backend.name } },
+    }, defs?.urlMap));
+    const address = new ComputeAddress(mergeDefaults({
+        metadata: meta("ip", "address"),
+        location: "global",
+    }, defs?.address));
+    Object.assign(result, { neg, backend, urlMap, address });
+    // With domains, HTTPS serves the URL map and HTTP serves a redirect to it.
+    let httpMapName = urlMap.name;
+    if (domains && domains.length > 0) {
+        const certificate = new ManagedSSLCertificate(mergeDefaults({
+            metadata: meta("cert", "certificate"),
+            projectRef: { external: projectId ?? GCP.ProjectId },
+            managed: { domains },
+        }, defs?.certificate));
+        const httpsProxy = new TargetHTTPSProxy(mergeDefaults({
+            metadata: meta("https-proxy", "proxy"),
+            location: "global",
+            urlMapRef: { name: urlMap.name },
+            sslCertificates: [{ name: certificate.name }],
+        }, defs?.httpsProxy));
+        const httpsRule = new ForwardingRule(mergeDefaults({
+            metadata: meta("https-rule", "forwarding-rule"),
+            location: "global",
+            loadBalancingScheme: "EXTERNAL_MANAGED",
+            portRange: "443",
+            ipAddress: { addressRef: { name: address.name } },
+            target: { targetHTTPSProxyRef: { name: httpsProxy.name } },
+        }, defs?.httpsRule));
+        const redirectMap = new URLMap(mergeDefaults({
+            metadata: meta("redirect", "url-map"),
+            location: "global",
+            defaultUrlRedirect: { httpsRedirect: true, stripQuery: false },
+        }, defs?.redirectMap));
+        httpMapName = redirectMap.name;
+        Object.assign(result, { certificate, httpsProxy, httpsRule, redirectMap });
+    }
+    result.proxy = new TargetHTTPProxy(mergeDefaults({
+        metadata: meta("proxy", "proxy"),
+        location: "global",
+        urlMapRef: { name: httpMapName },
+    }, defs?.proxy));
+    result.rule = new ForwardingRule(mergeDefaults({
+        metadata: meta("rule", "forwarding-rule"),
+        location: "global",
+        loadBalancingScheme: "EXTERNAL_MANAGED",
+        portRange: String(frontendPort),
+        ipAddress: { addressRef: { name: address.name } },
+        target: { targetHTTPProxyRef: { name: result.proxy.name } },
+    }, defs?.rule));
+    return result;
+}, "PublicCloudRun");

package/dist/deep-observe.d.ts

@@ -82,6 +82,11 @@ export declare function restToCnrmShape(body: Record<string, unknown>): Record<s
 interface RefineContext {
     project: string;
     restName?: string;
+    /** A forwarding rule's declared `ipAddress.addressRef` and that address's live IP (#4238). */
+    address?: {
+        ip: string;
+        ref: unknown;
+    };
 }
 /**
  * A REST payload as a CNRM-shaped property tree, in the declared side's

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0OD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuF5G"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;CACxC;AAgPD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AA6BD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0F5G"}

package/dist/deep-observe.js

@@ -55,7 +55,7 @@
  */
 import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
 import { hasOwnershipMarker } from "@intentius/chant/ownership";
-import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources.js";
+import { deriveGVK, manifestProjectAnnotations, readManifest, readTargets, resolveReadProject } from "./describe-resources.js";
 import { getResource, mapperForKind, GcpReadError, isNotFound } from "./api/read-client.js";
 import { gcpDeepNormalizationHooks } from "./deep-observe-hooks.js";
 /** The labels the applier stamps — see describe-resources.ts. */
@@ -299,8 +299,14 @@ const CNRM_REFINERS = {
         delete tree.gatewayAddress;
         delete tree.fingerprint;
     },
-    ComputeForwardingRule(tree) {
+    ComputeForwardingRule(tree, ctx) {
         computeLocation(tree);
+        // Compute returns the IP; CNRM writes `ipAddress: { addressRef }` or `{ ip }`.
+        // The IP is the declared address's own when the read found it so (#4238).
+        if (typeof tree.IPAddress === "string") {
+            tree.ipAddress = ctx.address && ctx.address.ip === tree.IPAddress ? { addressRef: ctx.address.ref } : { ip: tree.IPAddress };
+            delete tree.IPAddress;
+        }
         if (tree.IPProtocol !== undefined) {
             tree.ipProtocol = tree.IPProtocol;
             delete tree.IPProtocol;
@@ -352,6 +358,31 @@ export function toCnrmTree(kind, body, ctx) {
     CNRM_REFINERS[kind]?.(tree, { ...ctx, restName });
     return tree;
 }
+/**
+ * The live IP of the address a forwarding rule declares in
+ * `ipAddress.addressRef`, read with the address's own declaration when the
+ * manifest holds it, so the rule's `IPAddress` can be matched to the ref
+ * rather than read as drift (#4238). Undefined when there is no ref or the
+ * read fails; the rule then shows the IP as it is.
+ */
+async function declaredAddressIp(client, props, manifest) {
+    const spec = props.spec ?? props;
+    const ref = spec.ipAddress?.addressRef;
+    if (!ref)
+        return undefined;
+    const raw = typeof ref.name === "string" ? ref.name : typeof ref.external === "string" ? ref.external : undefined;
+    if (!raw)
+        return undefined;
+    const name = raw.slice(raw.lastIndexOf("/") + 1);
+    const declared = manifest.find((r) => r.kind === "ComputeAddress" && r.metadata?.name === name);
+    try {
+        const body = await getResource(client, "ComputeAddress", name, declared?.spec ?? { location: spec.location });
+        return typeof body.address === "string" ? { ip: body.address, ref } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Read the live property tree for each declared entity over the applier's
  * REST transport, normalized into the declared CNRM shape (see the module
@@ -365,6 +396,7 @@ export async function observeResourcesDeepGcp(options) {
     const endpoint = process.env.GCP_ENDPOINT_URL;
     const manifestProjects = manifestProjectAnnotations(options.buildOutput);
     const targets = readTargets(options.entities);
+    const manifest = readManifest(options.entities, targets);
     const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
         const gvk = deriveGVK(entityType);
         if (!gvk || !mapperForKind(gvk.kind)) {
@@ -384,6 +416,7 @@ export async function observeResourcesDeepGcp(options) {
             client = {
                 project: resolveReadProject(gvk.kind, name, metadata, manifestProjects, props),
                 ...(endpoint ? { endpoint } : {}),
+                manifest,
             };
         }
         catch (err) {
@@ -397,6 +430,7 @@ export async function observeResourcesDeepGcp(options) {
         try {
             const obj = await getResource(client, gvk.kind, name, props);
             const labels = obj.labels;
+            const address = gvk.kind === "ComputeForwardingRule" ? await declaredAddressIp(client, props, manifest) : undefined;
             // owned filter: withhold what does not carry chant's marker. Withheld is
             // not absent (#1089). Where the payload has no labels at all there is
             // nothing to filter on, so the resource passes through — the same
@@ -412,7 +446,7 @@ export async function observeResourcesDeepGcp(options) {
             resources[entityName] = {
                 type: entityType,
                 physicalId: obj.id ?? obj.selfLink ?? obj.name,
-                properties: normalizeDeepProperties(toCnrmTree(gvk.kind, obj, { project: client.project }), {
+                properties: normalizeDeepProperties(toCnrmTree(gvk.kind, obj, { project: client.project, ...(address ? { address } : {}) }), {
                     entityType,
                     side: "live",
                     // The static table is the whole prune here — there is no per-resource

package/dist/describe-resources.d.ts

@@ -36,6 +36,7 @@
  * dropped.
  */
 import type { ObservationResult } from "@intentius/chant/lexicon";
+import { type GcpResource } from "./op/activities/gcp-apply.js";
 /** The parts of a GCP REST payload this reader looks at. Every field is
  * optional because they vary by kind — a bucket has `id` and `labels`, a
  * Pub/Sub topic has neither. */
@@ -105,6 +106,18 @@ export declare function readTargets(entities: Map<string, {
     name: string;
     props: Record<string, unknown>;
 }>;
+/**
+ * The declared resources as the applier's manifest holds them (kind, CNRM
+ * name, spec), for a read that needs another declared resource: an
+ * IAMPolicyMember on a RunService takes the service's region from it (#4251).
+ */
+export declare function readManifest(entities: Map<string, {
+    entityType: string;
+    props: Record<string, unknown>;
+}>, targets: Map<string, {
+    name: string;
+    props: Record<string, unknown>;
+}>): GcpResource[];
 /**
  * Status from a REST payload.
  *

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAsBtG;;gCAEgC;AAChC,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB/F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,EAC9D,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAC5E,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAY/D;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAY3D;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiH7B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAItG,OAAO,EAAgD,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAkB3G;;gCAEgC;AAChC,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB/F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,EAC9D,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAUR;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAC5E,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAY/D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EAC7E,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GACrE,WAAW,EAAE,CAUf;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAY3D;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmH7B"}

package/dist/describe-resources.js

@@ -137,6 +137,23 @@ export function readTargets(entities) {
     }
     return out;
 }
+/**
+ * The declared resources as the applier's manifest holds them (kind, CNRM
+ * name, spec), for a read that needs another declared resource: an
+ * IAMPolicyMember on a RunService takes the service's region from it (#4251).
+ */
+export function readManifest(entities, targets) {
+    const out = [];
+    for (const [logical, { entityType }] of entities) {
+        const gvk = deriveGVK(entityType);
+        const target = targets.get(logical);
+        if (!gvk || !target)
+            continue;
+        const spec = target.props.spec ?? target.props;
+        out.push({ kind: gvk.kind, metadata: { name: target.name }, spec });
+    }
+    return out;
+}
 function pruneUndefined(obj) {
     const out = {};
     for (const [k, v] of Object.entries(obj)) {
@@ -185,6 +202,7 @@ export async function describeResources(options) {
     let warnedOwnership = false;
     const manifestProjects = manifestProjectAnnotations(options.buildOutput);
     const targets = readTargets(options.entities);
+    const manifest = readManifest(options.entities, targets);
     const reads = [...options.entities].map(async ([entityName, { entityType }]) => {
         const gvk = deriveGVK(entityType);
         if (!gvk) {
@@ -212,6 +230,7 @@ export async function describeResources(options) {
             client = {
                 project: resolveReadProject(gvk.kind, name, metadata, manifestProjects, props),
                 ...(endpoint ? { endpoint } : {}),
+                manifest,
             };
         }
         catch (err) {

package/dist/health.d.ts

@@ -1,5 +1,7 @@
 /**
- * Runtime health for GCP (#4177): Cloud Run services.
+ * Runtime health for GCP (#4177): Cloud Run services; and (#4239) backend
+ * services, from `getHealth` on each backend group, and IAM policy members,
+ * healthy when the member holds the role in the target's policy.
  *
  * A Cloud Run v2 service carries its `Ready` condition as `terminalCondition`
  * (`CONDITION_SUCCEEDED`, `CONDITION_FAILED`, pending or reconciling). The v1
@@ -10,7 +12,7 @@
  */
 import type { HealthEntry, HealthReadOptions, HealthReadResult } from "@intentius/chant/lexicon";
 import { type GcpReadHttp } from "./api/read-client.js";
-export declare const GCP_HEALTH_TYPES: readonly ["GCP::Run::Service"];
+export declare const GCP_HEALTH_TYPES: readonly ["GCP::Run::Service", "GCP::Compute::BackendService", "GCP::Iam::PolicyMember"];
 export interface GcpHealthOptions extends HealthReadOptions {
     http?: GcpReadHttp;
     now?: () => Date;
@@ -37,6 +39,28 @@ export interface CloudRunServiceState {
 }
 /** The `Ready` condition's verdict. No condition at all is `unknown`. */
 export declare function cloudRunEntry(body: CloudRunServiceState, observedAt: string): HealthEntry;
+/** One backend group's `getHealth` answer: `healthStatus[].healthState` per endpoint. */
+export interface BackendGroupHealth {
+    group: string;
+    healthStatus?: Array<{
+        healthState?: string;
+    }>;
+    /** Set when the call failed; the group then counts as unknown. */
+    error?: string;
+}
+/**
+ * A backend service's verdict from its groups: any endpoint `UNHEALTHY` is
+ * unhealthy; every endpoint `HEALTHY`, with at least one, is healthy; anything
+ * else (no backends, a group that reports no status, as a serverless NEG
+ * does, a failed call) is unknown.
+ */
+export declare function backendServiceEntry(groups: readonly BackendGroupHealth[], observedAt: string): HealthEntry;
+/** A binding the read found in its target's policy. A missing one is `absent`, never here. */
+export declare function policyMemberEntry(binding: {
+    role?: string;
+    member?: string;
+    resource?: string;
+}, observedAt: string): HealthEntry;
 export declare function observeHealthGcp(options: GcpHealthOptions): Promise<HealthReadResult>;
 export {};
 //# sourceMappingURL=health.d.ts.map

package/dist/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AACnH,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAG5F,eAAO,MAAM,gBAAgB,YAAI,mBAAmB,CAAU,CAAC;AAE/D,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAOD,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAqBzF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAiD3F"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AACnH,OAAO,EAAkD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrG,eAAO,MAAM,gBAAgB,YAAI,mBAAmB,EAAE,8BAA8B,EAAE,wBAAwB,CAAU,CAAC;AAEzH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAOD,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAqBzF;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAkB1G;AAED,8FAA8F;AAC9F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAOjI;AA6BD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqD3F"}

package/dist/health.js

@@ -1,5 +1,7 @@
 /**
- * Runtime health for GCP (#4177): Cloud Run services.
+ * Runtime health for GCP (#4177): Cloud Run services; and (#4239) backend
+ * services, from `getHealth` on each backend group, and IAM policy members,
+ * healthy when the member holds the role in the target's policy.
  *
  * A Cloud Run v2 service carries its `Ready` condition as `terminalCondition`
  * (`CONDITION_SUCCEEDED`, `CONDITION_FAILED`, pending or reconciling). The v1
@@ -8,9 +10,9 @@
  * project resolution and endpoint rule as `describe-resources.ts`, so
  * `GCP_ENDPOINT_URL` (floci-gcp) answers.
  */
-import { getResource, GcpReadError, isNotFound } from "./api/read-client.js";
-import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources.js";
-export const GCP_HEALTH_TYPES = ["GCP::Run::Service"];
+import { getResource, GcpReadError, isNotFound, readUrl } from "./api/read-client.js";
+import { deriveGVK, manifestProjectAnnotations, readManifest, readTargets, resolveReadProject } from "./describe-resources.js";
+export const GCP_HEALTH_TYPES = ["GCP::Run::Service", "GCP::Compute::BackendService", "GCP::Iam::PolicyMember"];
 function readyCondition(body) {
     if (body.terminalCondition && (body.terminalCondition.type ?? "Ready") === "Ready")
         return body.terminalCondition;
@@ -39,6 +41,72 @@ export function cloudRunEntry(body, observedAt) {
         ...(ready.lastTransitionTime ? { checkedAt: ready.lastTransitionTime } : {}),
     };
 }
+/**
+ * A backend service's verdict from its groups: any endpoint `UNHEALTHY` is
+ * unhealthy; every endpoint `HEALTHY`, with at least one, is healthy; anything
+ * else (no backends, a group that reports no status, as a serverless NEG
+ * does, a failed call) is unknown.
+ */
+export function backendServiceEntry(groups, observedAt) {
+    const type = "GCP::Compute::BackendService";
+    if (groups.length === 0)
+        return { type, state: "unknown", detail: "no backends", observedAt };
+    let healthy = 0;
+    let unhealthy = 0;
+    let unknown = 0;
+    for (const g of groups) {
+        const states = g.error ? [] : (g.healthStatus ?? []).map((h) => (h.healthState ?? "").toUpperCase());
+        if (states.length === 0)
+            unknown++;
+        else if (states.some((st) => st === "UNHEALTHY"))
+            unhealthy++;
+        else if (states.every((st) => st === "HEALTHY"))
+            healthy++;
+        else
+            unknown++;
+    }
+    const state = unhealthy > 0 ? "unhealthy" : healthy === groups.length ? "healthy" : "unknown";
+    const parts = [`${healthy} of ${groups.length} backend${groups.length === 1 ? "" : "s"} healthy`];
+    if (unhealthy)
+        parts.push(`${unhealthy} unhealthy`);
+    if (unknown)
+        parts.push(`${unknown} with no health status`);
+    return { type, state, detail: parts.join(", "), observedAt };
+}
+/** A binding the read found in its target's policy. A missing one is `absent`, never here. */
+export function policyMemberEntry(binding, observedAt) {
+    return {
+        type: "GCP::Iam::PolicyMember",
+        state: "healthy",
+        detail: `${binding.member ?? "member"} holds ${binding.role ?? "the role"}${binding.resource ? ` on ${binding.resource}` : ""}`,
+        observedAt,
+    };
+}
+const defaultReadHttp = async (method, url, body) => {
+    const res = await fetch(url, {
+        method,
+        ...(body === undefined ? {} : { headers: { "content-type": "application/json" }, body: JSON.stringify(body) }),
+    });
+    return { status: res.status, text: await res.text() };
+};
+/** `getHealth` for each of a backend service's groups, at the service's own read URL. */
+async function backendGroupsHealth(url, body, http) {
+    const backends = Array.isArray(body.backends) ? body.backends : [];
+    return Promise.all(backends
+        .map((b) => b.group)
+        .filter((g) => typeof g === "string")
+        .map(async (group) => {
+        try {
+            const res = await http("POST", `${url}/getHealth`, { group });
+            if (res.status < 200 || res.status >= 300)
+                return { group, error: `getHealth ${res.status}` };
+            return { group, ...JSON.parse(res.text) };
+        }
+        catch (err) {
+            return { group, error: err instanceof Error ? err.message : String(err) };
+        }
+    }));
+}
 export async function observeHealthGcp(options) {
     const observedAt = (options.now?.() ?? new Date()).toISOString();
     const endpoint = process.env.GCP_ENDPOINT_URL;
@@ -47,6 +115,7 @@ export async function observeHealthGcp(options) {
     const unobserved = {};
     const absent = [];
     const targets = readTargets(options.entities);
+    const manifest = readManifest(options.entities, targets);
     await Promise.all([...options.entities].map(async ([entityName, { entityType }]) => {
         const gvk = deriveGVK(entityType);
         const { name, props } = targets.get(entityName);
@@ -64,8 +133,18 @@ export async function observeHealthGcp(options) {
             return;
         }
         try {
-            const body = await getResource({ project, ...(endpoint ? { endpoint } : {}), ...(options.http ? { http: options.http } : {}) }, gvk.kind, name, props);
-            entities[entityName] = cloudRunEntry(body, observedAt);
+            const client = { project, ...(endpoint ? { endpoint } : {}), ...(options.http ? { http: options.http } : {}), manifest };
+            const body = await getResource(client, gvk.kind, name, props);
+            if (gvk.kind === "ComputeBackendService") {
+                const groups = await backendGroupsHealth(readUrl(client, gvk.kind, name, props), body, options.http ?? defaultReadHttp);
+                entities[entityName] = backendServiceEntry(groups, observedAt);
+            }
+            else if (gvk.kind === "IAMPolicyMember") {
+                entities[entityName] = policyMemberEntry(body, observedAt);
+            }
+            else {
+                entities[entityName] = cloudRunEntry(body, observedAt);
+            }
         }
         catch (err) {
             if (isNotFound(err)) {

package/dist/index.d.ts

@@ -7,8 +7,8 @@ export { GCP, ProjectId, Region, Zone } from "./pseudo.js";
 export { GcpAnnotations } from "./variables.js";
 export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon-output";
 export * from "./generated/index.js";
-export { GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork, PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject, MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GpuNodePool, GovernanceFoundation, LocationRestriction, OrganizationAuditConfig, } from "./composites/index.js";
-export type { GkeClusterProps, CloudRunServiceProps, CloudSqlInstanceProps, GcsBucketProps, VpcNetworkProps, VpcSubnet, PubSubPipelineProps, CloudFunctionWithTriggerProps, PrivateServiceProps, ManagedCertificateProps, SecureProjectProps, MemorystoreRedisProps, MultiRegionVpcConfig, MultiRegionVpcRegion, GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig, GpuNodePoolProps, GpuNodePoolTaint, GovernanceFoundationProps, LocationRestrictionProps, OrganizationAuditConfigProps, } from "./composites/index.js";
+export { GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork, PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject, MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GpuNodePool, PrivateEgressNetwork, PublicCloudRun, GovernanceFoundation, LocationRestriction, OrganizationAuditConfig, } from "./composites/index.js";
+export type { GkeClusterProps, CloudRunServiceProps, CloudSqlInstanceProps, GcsBucketProps, VpcNetworkProps, VpcSubnet, PubSubPipelineProps, CloudFunctionWithTriggerProps, PrivateServiceProps, ManagedCertificateProps, SecureProjectProps, MemorystoreRedisProps, MultiRegionVpcConfig, MultiRegionVpcRegion, GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig, GpuNodePoolProps, GpuNodePoolTaint, PrivateEgressNetworkProps, PublicCloudRunProps, GovernanceFoundationProps, LocationRestrictionProps, OrganizationAuditConfigProps, } from "./composites/index.js";
 export { landingZoneConfig, resourceLocationRestriction, DISABLE_SA_KEY_CREATION, SKIP_DEFAULT_NETWORK, AUDIT_ALL_SERVICES, FOUNDATION_FOLDERS, } from "./governance.js";
 export type { GcpGovernanceConfig, LandingZoneConfigProps, FolderConfig, OrgPolicyConfig, ProjectConfig } from "./governance.js";
 export { StorageRoles, ComputeRoles, ContainerRoles, IAMRoles, SQLRoles, RunRoles, PubSubRoles } from "./actions/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAIzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,UAAU,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAC7E,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAC3F,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAC5D,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,GACnE,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EAAE,SAAS,EAC1B,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAAE,oBAAoB,EAC1C,mBAAmB,EAAE,uBAAuB,EAC5C,gBAAgB,EAAE,gBAAgB,EAClC,yBAAyB,EAAE,wBAAwB,EAAE,4BAA4B,GAClF,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,2BAA2B,EAC9C,uBAAuB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,kBAAkB,GACtF,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG9H,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGxH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAIzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,UAAU,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAC7E,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAC3F,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,cAAc,EAClG,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,GACnE,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EAAE,SAAS,EAC1B,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAAE,oBAAoB,EAC1C,mBAAmB,EAAE,uBAAuB,EAC5C,gBAAgB,EAAE,gBAAgB,EAClC,yBAAyB,EAAE,mBAAmB,EAC9C,yBAAyB,EAAE,wBAAwB,EAAE,4BAA4B,GAClF,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,2BAA2B,EAC9C,uBAAuB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,kBAAkB,GACtF,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG9H,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGxH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -21,7 +21,7 @@ export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon
 // After running `npm run generate`, this re-exports all Config Connector resource classes
 export * from "./generated/index.js";
 // Composites
-export { GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork, PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject, MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GpuNodePool, GovernanceFoundation, LocationRestriction, OrganizationAuditConfig, } from "./composites/index.js";
+export { GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork, PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject, MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GpuNodePool, PrivateEgressNetwork, PublicCloudRun, GovernanceFoundation, LocationRestriction, OrganizationAuditConfig, } from "./composites/index.js";
 // GCP governance authoring: the desired-state config an external governance
 // reconciler applies, and the typed landing-zone authoring layer.
 export { landingZoneConfig, resourceLocationRestriction, DISABLE_SA_KEY_CREATION, SKIP_DEFAULT_NETWORK, AUDIT_ALL_SERVICES, FOUNDATION_FOLDERS, } from "./governance.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "648e7fb96c2a44b72459dc70e777c22836de776eb5f5b8017f8c6057135062a3",
+    "manifest.json": "f3591792043dc8b5c86d1c30c694b09225546ef08cd7a2c9856718ea094d6259",
     "meta.json": "75643660010c044c6f465bef2688a864ab30cc96fd9b68111969749748ac64ca",
     "types/index.d.ts": "da1ebc6bcf83e1a018a773b59714194aeeb74ae1d5c1252b737b7e730ca98bd5",
     "rules/hardcoded-project.ts": "6d5ae9efa74d73800eebe1a0a0d43c619ee0fdebe3347195df93fcbe63b34f0d",
@@ -35,10 +35,10 @@
     "rules/wgc501.ts": "bf99d8dc97537687fdfe9a8d5eb420172bf3279a4147311037f9c1d1f5fd4c85",
     "rules/wgc502.ts": "6460a028f73ef31a66653954e67142079130112b70fa01a79f80464968a1b9f6",
     "rules/wgc503.ts": "44dc51efbf9f9384b61a4e19b173b4c182557143cb59fbaf4da087e70a38f916",
-    "skills/chant-gcp.md": "46a5e711ac59086d9f59ef645085aa54e8b1953afb76a0d93158b7288edf362e",
+    "skills/chant-gcp.md": "da90cf5982451652bd0f0ad51563c248379824a77bd49c9ecbadbb37a82a29e1",
     "skills/chant-gcp-security.md": "39a1c97b7425ed43b081257132449d11ce9d12f2d4755fc30d8b14bbc38f60bd",
     "skills/chant-gcp-patterns.md": "4c6809fc7c37fa1879379ad4c0e2d114dec9497bc6eb9d1bca4e79fddea4f509",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "12781f2fbe08546cbfed0496ef97a0cfc6f301c5576bfafad2cbd4bf3cac39f3"
+  "composite": "73e7ca62da8ef9beafa48e58b549248bd5b24abd37f1a4bb180de513b7319acc"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.124.37",
+  "version": "0.124.39",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/dist/op/activities/gcp-apply.d.ts

@@ -86,7 +86,25 @@ export interface ApplyPlan {
         url: string;
         body: unknown;
     };
+    /**
+     * In place of `update`, for a resource whose update depends on the live body
+     * (#4238): compute updates carry the live `fingerprint`, and some fields only
+     * change through a setter (`setTarget`, `setLabels`). Returns the requests to
+     * send, none when the live resource already matches, or `replace` naming what
+     * differs on a field that can't change in place.
+     */
+    reconcile?(live: unknown, http: GcpHttp, signal?: AbortSignal): Promise<ReconcileStep>;
 }
+/** What {@link ApplyPlan.reconcile} decided for an existing resource. */
+export type ReconcileStep = {
+    requests: Array<{
+        method: "POST" | "PATCH" | "PUT";
+        url: string;
+        body: unknown;
+    }>;
+} | {
+    replace: string;
+};
 /**
  * Handles an async create whose response is a long-running operation. Present
  * only on mappers for resources that provision asynchronously (Cloud Run, GKE,
@@ -280,6 +298,7 @@ export declare function applyResource(mapper: ResourceMapper, resource: GcpResou
     name: string;
     created: boolean;
     updated: boolean;
+    replaceRequired?: string;
 }>;
 /**
  * Poll a long-running operation until it reports done (or errors / times out).