@intentius/chant-lexicon-gcp 0.124.38 → 0.124.39

package/dist/api/read-client.d.ts

@@ -78,5 +78,12 @@ export declare function mapperForKind(kind: string): ResourceMapper | undefined;
  * build a URL — the same input the applier hands it. Returns the parsed body,
  * or throws {@link GcpReadError} carrying the status.
  */
+/**
+ * The URL a read of this resource GETs: the applier's own `plan().getUrl`, so
+ * a health read's sub-calls (`getHealth`) land on the same resource path.
+ * Throws a {@link GcpReadError} when the declared spec can't produce one,
+ * which is a hole, never an absence.
+ */
+export declare function readUrl(client: GcpReadClientOptions, kind: string, name: string, declared?: Record<string, unknown>): string;
 export declare function getResource(client: GcpReadClientOptions, kind: string, name: string, declared?: Record<string, unknown>): Promise<Record<string, unknown>>;
 //# sourceMappingURL=read-client.d.ts.map

package/dist/api/read-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAW,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5F,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACnC,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAUrH;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IAF1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EAIzB;CACF;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEtE;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiDlC"}
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAW,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5F,kCAAkC;AAClC,MAAM,WAAW,oBAAoB;IACnC,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAUrH;;;;GAIG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IAF1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,CAAC,EAAE,MAAM,YAAA,EAIzB;CACF;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEtE;AAED;;;;;;GAMG;AACH;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAc5H;AAED,wBAAsB,WAAW,CAC/B,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA0ClC"}

package/dist/api/read-client.js

@@ -72,6 +72,29 @@ export function mapperForKind(kind) {
  * build a URL — the same input the applier hands it. Returns the parsed body,
  * or throws {@link GcpReadError} carrying the status.
  */
+/**
+ * The URL a read of this resource GETs: the applier's own `plan().getUrl`, so
+ * a health read's sub-calls (`getHealth`) land on the same resource path.
+ * Throws a {@link GcpReadError} when the declared spec can't produce one,
+ * which is a hole, never an absence.
+ */
+export function readUrl(client, kind, name, declared) {
+    const mapper = mapperForKind(kind);
+    if (!mapper)
+        throw new GcpReadError(`no REST mapper for kind ${kind}`);
+    const base = (client.endpoint ?? mapper.defaultHost).replace(/\/$/, "");
+    const resource = {
+        kind,
+        metadata: { name },
+        spec: declared?.spec ?? declared ?? {},
+    };
+    try {
+        return mapper.plan(resource, { base, project: client.project, ...(client.manifest ? { manifest: client.manifest } : {}) }).getUrl;
+    }
+    catch (err) {
+        throw new GcpReadError(`could not build a read URL for ${kind}/${name}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 export async function getResource(client, kind, name, declared) {
     const mapper = mapperForKind(kind);
     if (!mapper)
@@ -97,15 +120,7 @@ export async function getResource(client, kind, name, declared) {
         }
     }
     else {
-        let getUrl;
-        try {
-            getUrl = mapper.plan(resource, ctx).getUrl;
-        }
-        catch (err) {
-            // A mapper that cannot plan from the declared spec cannot produce a URL, so
-            // there is nothing to read — a hole, never an absence.
-            throw new GcpReadError(`could not build a read URL for ${kind}/${name}: ${err instanceof Error ? err.message : String(err)}`);
-        }
+        const getUrl = readUrl(client, kind, name, declared);
         try {
             res = await http("GET", getUrl);
         }

package/dist/composites/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/composites/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAkuC5C,CAAC"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/composites/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,eAAO,MAAM,gBAAgB,EAAE,cAAc,EA65C5C,CAAC"}

package/dist/composites/catalog.js

@@ -170,6 +170,12 @@ export const compositeCatalog = [
                 "required": false,
                 "description": "Environment variables."
             },
+            {
+                "name": "serviceAccount",
+                "type": "string",
+                "required": false,
+                "description": "Service account the service runs as: an email, or the account id of an IAMServiceAccount in the project."
+            },
             {
                 "name": "labels",
                 "type": "Record<string, string>",
@@ -950,6 +956,59 @@ export const compositeCatalog = [
             }
         ]
     },
+    {
+        "name": "PrivateEgressNetwork",
+        "lexicon": "gcp",
+        "description": "Create a PrivateEgressNetwork composite.",
+        "bundles": [
+            "Subnetwork",
+            "VPCNetwork"
+        ],
+        "params": [
+            {
+                "name": "name",
+                "type": "string",
+                "required": true,
+                "description": "Name prefix: the network is `<name>-vpc`, its subnet `<name>-apps`."
+            },
+            {
+                "name": "region",
+                "type": "string",
+                "required": true,
+                "description": "GCP region of the subnet."
+            },
+            {
+                "name": "subnetCidr",
+                "type": "string",
+                "required": true,
+                "description": "IP CIDR range of the subnet."
+            },
+            {
+                "name": "privateIpGoogleAccess",
+                "type": "boolean",
+                "required": false,
+                "description": "Enable private Google access on the subnet (default: true)."
+            },
+            {
+                "name": "labels",
+                "type": "Record<string, string>",
+                "required": false,
+                "description": "Additional labels."
+            },
+            {
+                "name": "namespace",
+                "type": "string",
+                "required": false,
+                "description": "Namespace for all resources."
+            },
+            {
+                "name": "defaults",
+                "type": "{ vpc?: Partial<ConstructorParameters<typeof VPCNetwork>[0]>; subnet?: Partial<ConstructorParameters<typeof Subnetwor...",
+                "required": false,
+                "description": "Per-member defaults for customizing individual resources."
+            }
+        ]
+    },
     {
         "name": "PrivateService",
         "lexicon": "gcp",
@@ -1028,6 +1087,134 @@ export const compositeCatalog = [
             }
         ]
     },
+    {
+        "name": "PublicCloudRun",
+        "lexicon": "gcp",
+        "description": "Create a PublicCloudRun composite.",
+        "bundles": [
+            "BackendService",
+            "CloudRunService",
+            "ComputeAddress",
+            "ForwardingRule",
+            "GCPServiceAccount",
+            "IAMPolicyMember",
+            "ManagedSSLCertificate",
+            "RegionNetworkEndpointGroup",
+            "TargetHTTPProxy",
+            "TargetHTTPSProxy",
+            "URLMap"
+        ],
+        "params": [
+            {
+                "name": "name",
+                "type": "string",
+                "required": true,
+                "description": "Name prefix every resource is named with."
+            },
+            {
+                "name": "image",
+                "type": "string",
+                "required": true,
+                "description": "Container image."
+            },
+            {
+                "name": "region",
+                "type": "string",
+                "required": true,
+                "description": "GCP region of the service and its network endpoint group."
+            },
+            {
+                "name": "projectId",
+                "type": "string",
+                "required": false,
+                "description": "GCP project, as `projectRef.external` (default: GCP.ProjectId, resolved from GCP_PROJECT_ID at build)."
+            },
+            {
+                "name": "vpc",
+                "type": "{ name: string }",
+                "required": true,
+                "description": "VPC the service's egress goes into, such as a PrivateEgressNetwork's `vpc`."
+            },
+            {
+                "name": "subnet",
+                "type": "{ name: string }",
+                "required": true,
+                "description": "Subnet the service's egress goes into, such as a PrivateEgressNetwork's `subnet`."
+            },
+            {
+                "name": "vpcEgress",
+                "type": "string",
+                "required": false,
+                "description": "Egress sent through the VPC: \"PRIVATE_RANGES_ONLY\" or \"ALL_TRAFFIC\" (default: \"PRIVATE_RANGES_ONLY\")."
+            },
+            {
+                "name": "port",
+                "type": "number",
+                "required": false,
+                "description": "Port the container listens on (default: 8080)."
+            },
+            {
+                "name": "frontendPort",
+                "type": "number",
+                "required": false,
+                "description": "Port the HTTP forwarding rule listens on (default: 80)."
+            },
+            {
+                "name": "minInstanceCount",
+                "type": "number",
+                "required": false,
+                "description": "Minimum instances (default: 0)."
+            },
+            {
+                "name": "maxInstanceCount",
+                "type": "number",
+                "required": false,
+                "description": "Maximum instances (default: 100)."
+            },
+            {
+                "name": "env",
+                "type": "Array<{ name: string; value: string }>",
+                "required": false,
+                "description": "Environment variables."
+            },
+            {
+                "name": "serviceAccount",
+                "type": "string",
+                "required": false,
+                "description": "An existing service account to run as: an email, or the account id of an IAMServiceAccount in the project."
+            },
+            {
+                "name": "domains",
+                "type": "string[]",
+                "required": false,
+                "description": "Domains for a Google-managed certificate."
+            },
+            {
+                "name": "securityPolicy",
+                "type": "string",
+                "required": false,
+                "description": "Name of a ComputeSecurityPolicy (Cloud Armor) attached to the backend service."
+            },
+            {
+                "name": "labels",
+                "type": "Record<string, string>",
+                "required": false,
+                "description": "Additional labels."
+            },
+            {
+                "name": "namespace",
+                "type": "string",
+                "required": false,
+                "description": "Namespace for all resources."
+            },
+            {
+                "name": "defaults",
+                "type": "{ runtime?: Partial<ConstructorParameters<typeof GCPServiceAccount>[0]>; service?: Record<string, unknown>; publicAcc...",
+                "required": false,
+                "description": "Per-member defaults for customizing individual resources."
+            }
+        ]
+    },
     {
         "name": "PubSubPipeline",
         "lexicon": "gcp",

package/dist/composites/index.d.ts

@@ -28,4 +28,8 @@ export { GkeCrdbRegion } from "./gke-crdb-region.js";
 export type { GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig } from "./gke-crdb-region.js";
 export { GpuNodePool } from "./gpu-node-pool.js";
 export type { GpuNodePoolProps, GpuNodePoolTaint } from "./gpu-node-pool.js";
+export { PrivateEgressNetwork } from "./private-egress-network.js";
+export type { PrivateEgressNetworkProps } from "./private-egress-network.js";
+export { PublicCloudRun } from "./public-cloud-run.js";
+export type { PublicCloudRunProps } from "./public-cloud-run.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/composites/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACpG,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACpG,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,YAAY,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/composites/index.js

@@ -13,3 +13,5 @@ export { MemorystoreRedis } from "./memorystore-redis.js";
 export { MultiRegionVpc } from "./multi-region-vpc.js";
 export { GkeCrdbRegion } from "./gke-crdb-region.js";
 export { GpuNodePool } from "./gpu-node-pool.js";
+export { PrivateEgressNetwork } from "./private-egress-network.js";
+export { PublicCloudRun } from "./public-cloud-run.js";

package/dist/composites/private-egress-network.d.ts

@@ -0,0 +1,42 @@
+/**
+ * PrivateEgressNetwork composite: a custom-mode VPC with one subnet a service sends its egress into.
+ */
+import { VPCNetwork, Subnetwork } from "../generated/index.js";
+export interface PrivateEgressNetworkProps {
+    /** Name prefix: the network is `<name>-vpc`, its subnet `<name>-apps`. */
+    name: string;
+    /** GCP region of the subnet. */
+    region: string;
+    /** IP CIDR range of the subnet. */
+    subnetCidr: string;
+    /** Enable private Google access on the subnet (default: true). */
+    privateIpGoogleAccess?: boolean;
+    /** Additional labels. */
+    labels?: Record<string, string>;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Per-member defaults for customizing individual resources. */
+    defaults?: {
+        vpc?: Partial<ConstructorParameters<typeof VPCNetwork>[0]>;
+        subnet?: Partial<ConstructorParameters<typeof Subnetwork>[0]>;
+    };
+}
+/**
+ * Create a PrivateEgressNetwork composite.
+ *
+ * @example
+ * ```ts
+ * import { PrivateEgressNetwork } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { vpc, subnet } = PrivateEgressNetwork({
+ *   name: "web",
+ *   region: "us-central1",
+ *   subnetCidr: "10.10.0.0/24",
+ * });
+ * ```
+ */
+export declare const PrivateEgressNetwork: import("@intentius/chant").CompositeDefinition<PrivateEgressNetworkProps, {
+    vpc: import("@intentius/chant").Declarable & Record<string, string>;
+    subnet: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=private-egress-network.d.ts.map

package/dist/composites/private-egress-network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-egress-network.d.ts","sourceRoot":"","sources":["../../src/composites/private-egress-network.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC/D,CAAC;CACH;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB;;;EAwCP,CAAC"}

package/dist/composites/private-egress-network.js

@@ -0,0 +1,48 @@
+/**
+ * PrivateEgressNetwork composite: a custom-mode VPC with one subnet a service sends its egress into.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { VPCNetwork, Subnetwork } from "../generated/index.js";
+/**
+ * Create a PrivateEgressNetwork composite.
+ *
+ * @example
+ * ```ts
+ * import { PrivateEgressNetwork } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { vpc, subnet } = PrivateEgressNetwork({
+ *   name: "web",
+ *   region: "us-central1",
+ *   subnetCidr: "10.10.0.0/24",
+ * });
+ * ```
+ */
+export const PrivateEgressNetwork = Composite((props) => {
+    const { name, region, subnetCidr, privateIpGoogleAccess = true, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const vpc = new VPCNetwork(mergeDefaults({
+        metadata: {
+            name: `${name}-vpc`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "network" },
+        },
+        autoCreateSubnetworks: false,
+        routingMode: "REGIONAL",
+    }, defs?.vpc));
+    const subnet = new Subnetwork(mergeDefaults({
+        metadata: {
+            name: `${name}-apps`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "subnet" },
+        },
+        region,
+        ipCidrRange: subnetCidr,
+        privateIpGoogleAccess,
+        networkRef: { name: vpc.name },
+    }, defs?.subnet));
+    return { vpc, subnet };
+}, "PrivateEgressNetwork");

package/dist/composites/public-cloud-run.d.ts

@@ -0,0 +1,85 @@
+/**
+ * PublicCloudRun composite: a Cloud Run service behind a global external
+ * Application Load Balancer, running as its own service account with Direct
+ * VPC egress into a subnet.
+ */
+import { BackendService, ComputeAddress, ForwardingRule, GCPServiceAccount, ManagedSSLCertificate, RegionNetworkEndpointGroup, TargetHTTPProxy, TargetHTTPSProxy, URLMap } from "../generated/index.js";
+export interface PublicCloudRunProps {
+    /** Name prefix every resource is named with. */
+    name: string;
+    /** Container image. */
+    image: string;
+    /** GCP region of the service and its network endpoint group. */
+    region: string;
+    /** GCP project, as `projectRef.external` (default: GCP.ProjectId, resolved from GCP_PROJECT_ID at build). */
+    projectId?: string;
+    /** VPC the service's egress goes into, such as a PrivateEgressNetwork's `vpc`. */
+    vpc: {
+        name: string;
+    };
+    /** Subnet the service's egress goes into, such as a PrivateEgressNetwork's `subnet`. */
+    subnet: {
+        name: string;
+    };
+    /** Egress sent through the VPC: "PRIVATE_RANGES_ONLY" or "ALL_TRAFFIC" (default: "PRIVATE_RANGES_ONLY"). */
+    vpcEgress?: string;
+    /** Port the container listens on (default: 8080). */
+    port?: number;
+    /** Port the HTTP forwarding rule listens on (default: 80). */
+    frontendPort?: number;
+    /** Minimum instances (default: 0). */
+    minInstanceCount?: number;
+    /** Maximum instances (default: 100). */
+    maxInstanceCount?: number;
+    /** Environment variables. */
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** An existing service account to run as: an email, or the account id of an IAMServiceAccount in the project. When unset, the composite creates `<name>-run`. */
+    serviceAccount?: string;
+    /** Domains for a Google-managed certificate. When set, the composite adds an HTTPS proxy and a rule on 443, and the HTTP rule redirects to HTTPS. */
+    domains?: string[];
+    /** Name of a ComputeSecurityPolicy (Cloud Armor) attached to the backend service. */
+    securityPolicy?: string;
+    /** Additional labels. */
+    labels?: Record<string, string>;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Per-member defaults for customizing individual resources. */
+    defaults?: {
+        runtime?: Partial<ConstructorParameters<typeof GCPServiceAccount>[0]>;
+        service?: Record<string, unknown>;
+        publicAccess?: Record<string, unknown>;
+        neg?: Partial<ConstructorParameters<typeof RegionNetworkEndpointGroup>[0]>;
+        backend?: Partial<ConstructorParameters<typeof BackendService>[0]>;
+        urlMap?: Partial<ConstructorParameters<typeof URLMap>[0]>;
+        proxy?: Partial<ConstructorParameters<typeof TargetHTTPProxy>[0]>;
+        address?: Partial<ConstructorParameters<typeof ComputeAddress>[0]>;
+        rule?: Partial<ConstructorParameters<typeof ForwardingRule>[0]>;
+        certificate?: Partial<ConstructorParameters<typeof ManagedSSLCertificate>[0]>;
+        httpsProxy?: Partial<ConstructorParameters<typeof TargetHTTPSProxy>[0]>;
+        httpsRule?: Partial<ConstructorParameters<typeof ForwardingRule>[0]>;
+        redirectMap?: Partial<ConstructorParameters<typeof URLMap>[0]>;
+    };
+}
+/**
+ * Create a PublicCloudRun composite.
+ *
+ * @example
+ * ```ts
+ * import { PrivateEgressNetwork, PublicCloudRun } from "@intentius/chant-lexicon-gcp";
+ *
+ * const network = PrivateEgressNetwork({ name: "web", region: "us-central1", subnetCidr: "10.10.0.0/24" });
+ * const web = PublicCloudRun({
+ *   name: "web",
+ *   projectId: "my-project",
+ *   region: "us-central1",
+ *   vpc: network.vpc,
+ *   subnet: network.subnet,
+ *   image: "us-docker.pkg.dev/my-project/web/site:1",
+ * });
+ * ```
+ */
+export declare const PublicCloudRun: import("@intentius/chant").CompositeDefinition<PublicCloudRunProps, Record<string, any>>;
+//# sourceMappingURL=public-cloud-run.d.ts.map

package/dist/composites/public-cloud-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-cloud-run.d.ts","sourceRoot":"","sources":["../../src/composites/public-cloud-run.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,EACf,gBAAgB,EAChB,MAAM,EACP,MAAM,cAAc,CAAC;AAItB,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,wFAAwF;IACxF,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzB,4GAA4G;IAC5G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,iKAAiK;IACjK,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qJAAqJ;IACrJ,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,UAAU,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAChE,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,0FAwJP,CAAC"}

package/dist/composites/public-cloud-run.js

@@ -0,0 +1,144 @@
+/**
+ * PublicCloudRun composite: a Cloud Run service behind a global external
+ * Application Load Balancer, running as its own service account with Direct
+ * VPC egress into a subnet.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { BackendService, ComputeAddress, ForwardingRule, GCPServiceAccount, ManagedSSLCertificate, RegionNetworkEndpointGroup, TargetHTTPProxy, TargetHTTPSProxy, URLMap, } from "../generated/index.js";
+import { GCP } from "../pseudo.js";
+import { CloudRunServiceComposite } from "./cloud-run-service.js";
+/**
+ * Create a PublicCloudRun composite.
+ *
+ * @example
+ * ```ts
+ * import { PrivateEgressNetwork, PublicCloudRun } from "@intentius/chant-lexicon-gcp";
+ *
+ * const network = PrivateEgressNetwork({ name: "web", region: "us-central1", subnetCidr: "10.10.0.0/24" });
+ * const web = PublicCloudRun({
+ *   name: "web",
+ *   projectId: "my-project",
+ *   region: "us-central1",
+ *   vpc: network.vpc,
+ *   subnet: network.subnet,
+ *   image: "us-docker.pkg.dev/my-project/web/site:1",
+ * });
+ * ```
+ */
+export const PublicCloudRun = Composite((props) => {
+    const { name, image, region, projectId, vpc, subnet, vpcEgress = "PRIVATE_RANGES_ONLY", port = 8080, frontendPort = 80, minInstanceCount = 0, maxInstanceCount = 100, env, serviceAccount, domains, securityPolicy, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const meta = (suffix, component) => ({
+        name: `${name}-${suffix}`,
+        ...(namespace && { namespace }),
+        labels: { ...commonLabels, "app.kubernetes.io/component": component },
+    });
+    const result = {};
+    if (!serviceAccount) {
+        result.runtime = new GCPServiceAccount(mergeDefaults({
+            metadata: meta("run", "service-account"),
+            displayName: `${name} Cloud Run runtime`,
+        }, defs?.runtime));
+    }
+    const run = CloudRunServiceComposite({
+        name: `${name}-site`,
+        image,
+        projectId,
+        location: region,
+        port,
+        minInstanceCount,
+        maxInstanceCount,
+        env,
+        publicAccess: true,
+        serviceAccount: serviceAccount ?? `${name}-run`,
+        labels: extraLabels,
+        namespace,
+        defaults: {
+            service: mergeDefaults({
+                template: {
+                    vpcAccess: {
+                        egress: vpcEgress,
+                        networkInterfaces: [{ networkRef: { name: vpc.name }, subnetworkRef: { name: subnet.name } }],
+                    },
+                },
+            }, defs?.service),
+            publicIam: defs?.publicAccess,
+        },
+    });
+    result.service = run.service;
+    result.publicAccess = run.publicIam;
+    const neg = new RegionNetworkEndpointGroup(mergeDefaults({
+        metadata: meta("neg", "neg"),
+        region,
+        networkEndpointType: "SERVERLESS",
+        cloudRun: { serviceRef: { name: run.service.name } },
+    }, defs?.neg));
+    // A backend service over a serverless NEG takes no health check: Cloud Run
+    // reports its own readiness.
+    const backend = new BackendService(mergeDefaults({
+        metadata: meta("backend", "backend"),
+        location: "global",
+        loadBalancingScheme: "EXTERNAL_MANAGED",
+        protocol: "HTTP",
+        backend: [{ group: { networkEndpointGroupRef: { name: neg.name } } }],
+        ...(securityPolicy && { securityPolicyRef: { name: securityPolicy } }),
+    }, defs?.backend));
+    const urlMap = new URLMap(mergeDefaults({
+        metadata: meta("map", "url-map"),
+        location: "global",
+        defaultService: { backendServiceRef: { name: backend.name } },
+    }, defs?.urlMap));
+    const address = new ComputeAddress(mergeDefaults({
+        metadata: meta("ip", "address"),
+        location: "global",
+    }, defs?.address));
+    Object.assign(result, { neg, backend, urlMap, address });
+    // With domains, HTTPS serves the URL map and HTTP serves a redirect to it.
+    let httpMapName = urlMap.name;
+    if (domains && domains.length > 0) {
+        const certificate = new ManagedSSLCertificate(mergeDefaults({
+            metadata: meta("cert", "certificate"),
+            projectRef: { external: projectId ?? GCP.ProjectId },
+            managed: { domains },
+        }, defs?.certificate));
+        const httpsProxy = new TargetHTTPSProxy(mergeDefaults({
+            metadata: meta("https-proxy", "proxy"),
+            location: "global",
+            urlMapRef: { name: urlMap.name },
+            sslCertificates: [{ name: certificate.name }],
+        }, defs?.httpsProxy));
+        const httpsRule = new ForwardingRule(mergeDefaults({
+            metadata: meta("https-rule", "forwarding-rule"),
+            location: "global",
+            loadBalancingScheme: "EXTERNAL_MANAGED",
+            portRange: "443",
+            ipAddress: { addressRef: { name: address.name } },
+            target: { targetHTTPSProxyRef: { name: httpsProxy.name } },
+        }, defs?.httpsRule));
+        const redirectMap = new URLMap(mergeDefaults({
+            metadata: meta("redirect", "url-map"),
+            location: "global",
+            defaultUrlRedirect: { httpsRedirect: true, stripQuery: false },
+        }, defs?.redirectMap));
+        httpMapName = redirectMap.name;
+        Object.assign(result, { certificate, httpsProxy, httpsRule, redirectMap });
+    }
+    result.proxy = new TargetHTTPProxy(mergeDefaults({
+        metadata: meta("proxy", "proxy"),
+        location: "global",
+        urlMapRef: { name: httpMapName },
+    }, defs?.proxy));
+    result.rule = new ForwardingRule(mergeDefaults({
+        metadata: meta("rule", "forwarding-rule"),
+        location: "global",
+        loadBalancingScheme: "EXTERNAL_MANAGED",
+        portRange: String(frontendPort),
+        ipAddress: { addressRef: { name: address.name } },
+        target: { targetHTTPProxyRef: { name: result.proxy.name } },
+    }, defs?.rule));
+    return result;
+}, "PublicCloudRun");

package/dist/deep-observe.d.ts

@@ -82,6 +82,11 @@ export declare function restToCnrmShape(body: Record<string, unknown>): Record<s
 interface RefineContext {
     project: string;
     restName?: string;
+    /** A forwarding rule's declared `ipAddress.addressRef` and that address's live IP (#4238). */
+    address?: {
+        ip: string;
+        ref: unknown;
+    };
 }
 /**
  * A REST payload as a CNRM-shaped property tree, in the declared side's