@intentius/chant-lexicon-gcp 0.124.38 → 0.124.40

package/dist/composites/catalog.js

@@ -170,6 +170,12 @@ export const compositeCatalog = [
                 "required": false,
                 "description": "Environment variables."
             },
+            {
+                "name": "serviceAccount",
+                "type": "string",
+                "required": false,
+                "description": "Service account the service runs as: an email, or the account id of an IAMServiceAccount in the project."
+            },
             {
                 "name": "labels",
                 "type": "Record<string, string>",
@@ -950,6 +956,59 @@ export const compositeCatalog = [
             }
         ]
     },
+    {
+        "name": "PrivateEgressNetwork",
+        "lexicon": "gcp",
+        "description": "Create a PrivateEgressNetwork composite.",
+        "bundles": [
+            "Subnetwork",
+            "VPCNetwork"
+        ],
+        "params": [
+            {
+                "name": "name",
+                "type": "string",
+                "required": true,
+                "description": "Name prefix: the network is `<name>-vpc`, its subnet `<name>-apps`."
+            },
+            {
+                "name": "region",
+                "type": "string",
+                "required": true,
+                "description": "GCP region of the subnet."
+            },
+            {
+                "name": "subnetCidr",
+                "type": "string",
+                "required": true,
+                "description": "IP CIDR range of the subnet."
+            },
+            {
+                "name": "privateIpGoogleAccess",
+                "type": "boolean",
+                "required": false,
+                "description": "Enable private Google access on the subnet (default: true)."
+            },
+            {
+                "name": "labels",
+                "type": "Record<string, string>",
+                "required": false,
+                "description": "Additional labels."
+            },
+            {
+                "name": "namespace",
+                "type": "string",
+                "required": false,
+                "description": "Namespace for all resources."
+            },
+            {
+                "name": "defaults",
+                "type": "{ vpc?: Partial<ConstructorParameters<typeof VPCNetwork>[0]>; subnet?: Partial<ConstructorParameters<typeof Subnetwor...",
+                "required": false,
+                "description": "Per-member defaults for customizing individual resources."
+            }
+        ]
+    },
     {
         "name": "PrivateService",
         "lexicon": "gcp",
@@ -1028,6 +1087,134 @@ export const compositeCatalog = [
             }
         ]
     },
+    {
+        "name": "PublicCloudRun",
+        "lexicon": "gcp",
+        "description": "Create a PublicCloudRun composite.",
+        "bundles": [
+            "BackendService",
+            "CloudRunService",
+            "ComputeAddress",
+            "ForwardingRule",
+            "GCPServiceAccount",
+            "IAMPolicyMember",
+            "ManagedSSLCertificate",
+            "RegionNetworkEndpointGroup",
+            "TargetHTTPProxy",
+            "TargetHTTPSProxy",
+            "URLMap"
+        ],
+        "params": [
+            {
+                "name": "name",
+                "type": "string",
+                "required": true,
+                "description": "Name prefix every resource is named with."
+            },
+            {
+                "name": "image",
+                "type": "string",
+                "required": true,
+                "description": "Container image."
+            },
+            {
+                "name": "region",
+                "type": "string",
+                "required": true,
+                "description": "GCP region of the service and its network endpoint group."
+            },
+            {
+                "name": "projectId",
+                "type": "string",
+                "required": false,
+                "description": "GCP project, as `projectRef.external` (default: GCP.ProjectId, resolved from GCP_PROJECT_ID at build)."
+            },
+            {
+                "name": "vpc",
+                "type": "{ name: string }",
+                "required": true,
+                "description": "VPC the service's egress goes into, such as a PrivateEgressNetwork's `vpc`."
+            },
+            {
+                "name": "subnet",
+                "type": "{ name: string }",
+                "required": true,
+                "description": "Subnet the service's egress goes into, such as a PrivateEgressNetwork's `subnet`."
+            },
+            {
+                "name": "vpcEgress",
+                "type": "string",
+                "required": false,
+                "description": "Egress sent through the VPC: \"PRIVATE_RANGES_ONLY\" or \"ALL_TRAFFIC\" (default: \"PRIVATE_RANGES_ONLY\")."
+            },
+            {
+                "name": "port",
+                "type": "number",
+                "required": false,
+                "description": "Port the container listens on (default: 8080)."
+            },
+            {
+                "name": "frontendPort",
+                "type": "number",
+                "required": false,
+                "description": "Port the HTTP forwarding rule listens on (default: 80)."
+            },
+            {
+                "name": "minInstanceCount",
+                "type": "number",
+                "required": false,
+                "description": "Minimum instances (default: 0)."
+            },
+            {
+                "name": "maxInstanceCount",
+                "type": "number",
+                "required": false,
+                "description": "Maximum instances (default: 100)."
+            },
+            {
+                "name": "env",
+                "type": "Array<{ name: string; value: string }>",
+                "required": false,
+                "description": "Environment variables."
+            },
+            {
+                "name": "serviceAccount",
+                "type": "string",
+                "required": false,
+                "description": "An existing service account to run as: an email, or the account id of an IAMServiceAccount in the project."
+            },
+            {
+                "name": "domains",
+                "type": "string[]",
+                "required": false,
+                "description": "Domains for a Google-managed certificate."
+            },
+            {
+                "name": "securityPolicy",
+                "type": "string",
+                "required": false,
+                "description": "Name of a ComputeSecurityPolicy (Cloud Armor) attached to the backend service."
+            },
+            {
+                "name": "labels",
+                "type": "Record<string, string>",
+                "required": false,
+                "description": "Additional labels."
+            },
+            {
+                "name": "namespace",
+                "type": "string",
+                "required": false,
+                "description": "Namespace for all resources."
+            },
+            {
+                "name": "defaults",
+                "type": "{ runtime?: Partial<ConstructorParameters<typeof GCPServiceAccount>[0]>; service?: Record<string, unknown>; publicAcc...",
+                "required": false,
+                "description": "Per-member defaults for customizing individual resources."
+            }
+        ]
+    },
     {
         "name": "PubSubPipeline",
         "lexicon": "gcp",

package/dist/composites/index.d.ts

@@ -28,4 +28,8 @@ export { GkeCrdbRegion } from "./gke-crdb-region.js";
 export type { GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig } from "./gke-crdb-region.js";
 export { GpuNodePool } from "./gpu-node-pool.js";
 export type { GpuNodePoolProps, GpuNodePoolTaint } from "./gpu-node-pool.js";
+export { PrivateEgressNetwork } from "./private-egress-network.js";
+export type { PrivateEgressNetworkProps } from "./private-egress-network.js";
+export { PublicCloudRun } from "./public-cloud-run.js";
+export type { PublicCloudRunProps } from "./public-cloud-run.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/composites/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACpG,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACpG,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,YAAY,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/composites/index.js

@@ -13,3 +13,5 @@ export { MemorystoreRedis } from "./memorystore-redis.js";
 export { MultiRegionVpc } from "./multi-region-vpc.js";
 export { GkeCrdbRegion } from "./gke-crdb-region.js";
 export { GpuNodePool } from "./gpu-node-pool.js";
+export { PrivateEgressNetwork } from "./private-egress-network.js";
+export { PublicCloudRun } from "./public-cloud-run.js";

package/dist/composites/private-egress-network.d.ts

@@ -0,0 +1,42 @@
+/**
+ * PrivateEgressNetwork composite: a custom-mode VPC with one subnet a service sends its egress into.
+ */
+import { VPCNetwork, Subnetwork } from "../generated/index.js";
+export interface PrivateEgressNetworkProps {
+    /** Name prefix: the network is `<name>-vpc`, its subnet `<name>-apps`. */
+    name: string;
+    /** GCP region of the subnet. */
+    region: string;
+    /** IP CIDR range of the subnet. */
+    subnetCidr: string;
+    /** Enable private Google access on the subnet (default: true). */
+    privateIpGoogleAccess?: boolean;
+    /** Additional labels. */
+    labels?: Record<string, string>;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Per-member defaults for customizing individual resources. */
+    defaults?: {
+        vpc?: Partial<ConstructorParameters<typeof VPCNetwork>[0]>;
+        subnet?: Partial<ConstructorParameters<typeof Subnetwork>[0]>;
+    };
+}
+/**
+ * Create a PrivateEgressNetwork composite.
+ *
+ * @example
+ * ```ts
+ * import { PrivateEgressNetwork } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { vpc, subnet } = PrivateEgressNetwork({
+ *   name: "web",
+ *   region: "us-central1",
+ *   subnetCidr: "10.10.0.0/24",
+ * });
+ * ```
+ */
+export declare const PrivateEgressNetwork: import("@intentius/chant").CompositeDefinition<PrivateEgressNetworkProps, {
+    vpc: import("@intentius/chant").Declarable & Record<string, string>;
+    subnet: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=private-egress-network.d.ts.map

package/dist/composites/private-egress-network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-egress-network.d.ts","sourceRoot":"","sources":["../../src/composites/private-egress-network.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,WAAW,yBAAyB;IACxC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC/D,CAAC;CACH;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB;;;EAwCP,CAAC"}

package/dist/composites/private-egress-network.js

@@ -0,0 +1,48 @@
+/**
+ * PrivateEgressNetwork composite: a custom-mode VPC with one subnet a service sends its egress into.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { VPCNetwork, Subnetwork } from "../generated/index.js";
+/**
+ * Create a PrivateEgressNetwork composite.
+ *
+ * @example
+ * ```ts
+ * import { PrivateEgressNetwork } from "@intentius/chant-lexicon-gcp";
+ *
+ * const { vpc, subnet } = PrivateEgressNetwork({
+ *   name: "web",
+ *   region: "us-central1",
+ *   subnetCidr: "10.10.0.0/24",
+ * });
+ * ```
+ */
+export const PrivateEgressNetwork = Composite((props) => {
+    const { name, region, subnetCidr, privateIpGoogleAccess = true, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const vpc = new VPCNetwork(mergeDefaults({
+        metadata: {
+            name: `${name}-vpc`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "network" },
+        },
+        autoCreateSubnetworks: false,
+        routingMode: "REGIONAL",
+    }, defs?.vpc));
+    const subnet = new Subnetwork(mergeDefaults({
+        metadata: {
+            name: `${name}-apps`,
+            ...(namespace && { namespace }),
+            labels: { ...commonLabels, "app.kubernetes.io/component": "subnet" },
+        },
+        region,
+        ipCidrRange: subnetCidr,
+        privateIpGoogleAccess,
+        networkRef: { name: vpc.name },
+    }, defs?.subnet));
+    return { vpc, subnet };
+}, "PrivateEgressNetwork");

package/dist/composites/public-cloud-run.d.ts

@@ -0,0 +1,85 @@
+/**
+ * PublicCloudRun composite: a Cloud Run service behind a global external
+ * Application Load Balancer, running as its own service account with Direct
+ * VPC egress into a subnet.
+ */
+import { BackendService, ComputeAddress, ForwardingRule, GCPServiceAccount, ManagedSSLCertificate, RegionNetworkEndpointGroup, TargetHTTPProxy, TargetHTTPSProxy, URLMap } from "../generated/index.js";
+export interface PublicCloudRunProps {
+    /** Name prefix every resource is named with. */
+    name: string;
+    /** Container image. */
+    image: string;
+    /** GCP region of the service and its network endpoint group. */
+    region: string;
+    /** GCP project, as `projectRef.external` (default: GCP.ProjectId, resolved from GCP_PROJECT_ID at build). */
+    projectId?: string;
+    /** VPC the service's egress goes into, such as a PrivateEgressNetwork's `vpc`. */
+    vpc: {
+        name: string;
+    };
+    /** Subnet the service's egress goes into, such as a PrivateEgressNetwork's `subnet`. */
+    subnet: {
+        name: string;
+    };
+    /** Egress sent through the VPC: "PRIVATE_RANGES_ONLY" or "ALL_TRAFFIC" (default: "PRIVATE_RANGES_ONLY"). */
+    vpcEgress?: string;
+    /** Port the container listens on (default: 8080). */
+    port?: number;
+    /** Port the HTTP forwarding rule listens on (default: 80). */
+    frontendPort?: number;
+    /** Minimum instances (default: 0). */
+    minInstanceCount?: number;
+    /** Maximum instances (default: 100). */
+    maxInstanceCount?: number;
+    /** Environment variables. */
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** An existing service account to run as: an email, or the account id of an IAMServiceAccount in the project. When unset, the composite creates `<name>-run`. */
+    serviceAccount?: string;
+    /** Domains for a Google-managed certificate. When set, the composite adds an HTTPS proxy and a rule on 443, and the HTTP rule redirects to HTTPS. */
+    domains?: string[];
+    /** Name of a ComputeSecurityPolicy (Cloud Armor) attached to the backend service. */
+    securityPolicy?: string;
+    /** Additional labels. */
+    labels?: Record<string, string>;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Per-member defaults for customizing individual resources. */
+    defaults?: {
+        runtime?: Partial<ConstructorParameters<typeof GCPServiceAccount>[0]>;
+        service?: Record<string, unknown>;
+        publicAccess?: Record<string, unknown>;
+        neg?: Partial<ConstructorParameters<typeof RegionNetworkEndpointGroup>[0]>;
+        backend?: Partial<ConstructorParameters<typeof BackendService>[0]>;
+        urlMap?: Partial<ConstructorParameters<typeof URLMap>[0]>;
+        proxy?: Partial<ConstructorParameters<typeof TargetHTTPProxy>[0]>;
+        address?: Partial<ConstructorParameters<typeof ComputeAddress>[0]>;
+        rule?: Partial<ConstructorParameters<typeof ForwardingRule>[0]>;
+        certificate?: Partial<ConstructorParameters<typeof ManagedSSLCertificate>[0]>;
+        httpsProxy?: Partial<ConstructorParameters<typeof TargetHTTPSProxy>[0]>;
+        httpsRule?: Partial<ConstructorParameters<typeof ForwardingRule>[0]>;
+        redirectMap?: Partial<ConstructorParameters<typeof URLMap>[0]>;
+    };
+}
+/**
+ * Create a PublicCloudRun composite.
+ *
+ * @example
+ * ```ts
+ * import { PrivateEgressNetwork, PublicCloudRun } from "@intentius/chant-lexicon-gcp";
+ *
+ * const network = PrivateEgressNetwork({ name: "web", region: "us-central1", subnetCidr: "10.10.0.0/24" });
+ * const web = PublicCloudRun({
+ *   name: "web",
+ *   projectId: "my-project",
+ *   region: "us-central1",
+ *   vpc: network.vpc,
+ *   subnet: network.subnet,
+ *   image: "us-docker.pkg.dev/my-project/web/site:1",
+ * });
+ * ```
+ */
+export declare const PublicCloudRun: import("@intentius/chant").CompositeDefinition<PublicCloudRunProps, Record<string, any>>;
+//# sourceMappingURL=public-cloud-run.d.ts.map

package/dist/composites/public-cloud-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-cloud-run.d.ts","sourceRoot":"","sources":["../../src/composites/public-cloud-run.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,EACf,gBAAgB,EAChB,MAAM,EACP,MAAM,cAAc,CAAC;AAItB,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,wFAAwF;IACxF,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzB,4GAA4G;IAC5G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6BAA6B;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,iKAAiK;IACjK,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qJAAqJ;IACrJ,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvC,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,OAAO,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,UAAU,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAChE,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,0FAwJP,CAAC"}

package/dist/composites/public-cloud-run.js

@@ -0,0 +1,144 @@
+/**
+ * PublicCloudRun composite: a Cloud Run service behind a global external
+ * Application Load Balancer, running as its own service account with Direct
+ * VPC egress into a subnet.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { BackendService, ComputeAddress, ForwardingRule, GCPServiceAccount, ManagedSSLCertificate, RegionNetworkEndpointGroup, TargetHTTPProxy, TargetHTTPSProxy, URLMap, } from "../generated/index.js";
+import { GCP } from "../pseudo.js";
+import { CloudRunServiceComposite } from "./cloud-run-service.js";
+/**
+ * Create a PublicCloudRun composite.
+ *
+ * @example
+ * ```ts
+ * import { PrivateEgressNetwork, PublicCloudRun } from "@intentius/chant-lexicon-gcp";
+ *
+ * const network = PrivateEgressNetwork({ name: "web", region: "us-central1", subnetCidr: "10.10.0.0/24" });
+ * const web = PublicCloudRun({
+ *   name: "web",
+ *   projectId: "my-project",
+ *   region: "us-central1",
+ *   vpc: network.vpc,
+ *   subnet: network.subnet,
+ *   image: "us-docker.pkg.dev/my-project/web/site:1",
+ * });
+ * ```
+ */
+export const PublicCloudRun = Composite((props) => {
+    const { name, image, region, projectId, vpc, subnet, vpcEgress = "PRIVATE_RANGES_ONLY", port = 8080, frontendPort = 80, minInstanceCount = 0, maxInstanceCount = 100, env, serviceAccount, domains, securityPolicy, labels: extraLabels = {}, namespace, defaults: defs, } = props;
+    const commonLabels = {
+        "app.kubernetes.io/name": name,
+        "app.kubernetes.io/managed-by": "chant",
+        ...extraLabels,
+    };
+    const meta = (suffix, component) => ({
+        name: `${name}-${suffix}`,
+        ...(namespace && { namespace }),
+        labels: { ...commonLabels, "app.kubernetes.io/component": component },
+    });
+    const result = {};
+    if (!serviceAccount) {
+        result.runtime = new GCPServiceAccount(mergeDefaults({
+            metadata: meta("run", "service-account"),
+            displayName: `${name} Cloud Run runtime`,
+        }, defs?.runtime));
+    }
+    const run = CloudRunServiceComposite({
+        name: `${name}-site`,
+        image,
+        projectId,
+        location: region,
+        port,
+        minInstanceCount,
+        maxInstanceCount,
+        env,
+        publicAccess: true,
+        serviceAccount: serviceAccount ?? `${name}-run`,
+        labels: extraLabels,
+        namespace,
+        defaults: {
+            service: mergeDefaults({
+                template: {
+                    vpcAccess: {
+                        egress: vpcEgress,
+                        networkInterfaces: [{ networkRef: { name: vpc.name }, subnetworkRef: { name: subnet.name } }],
+                    },
+                },
+            }, defs?.service),
+            publicIam: defs?.publicAccess,
+        },
+    });
+    result.service = run.service;
+    result.publicAccess = run.publicIam;
+    const neg = new RegionNetworkEndpointGroup(mergeDefaults({
+        metadata: meta("neg", "neg"),
+        region,
+        networkEndpointType: "SERVERLESS",
+        cloudRun: { serviceRef: { name: run.service.name } },
+    }, defs?.neg));
+    // A backend service over a serverless NEG takes no health check: Cloud Run
+    // reports its own readiness.
+    const backend = new BackendService(mergeDefaults({
+        metadata: meta("backend", "backend"),
+        location: "global",
+        loadBalancingScheme: "EXTERNAL_MANAGED",
+        protocol: "HTTP",
+        backend: [{ group: { networkEndpointGroupRef: { name: neg.name } } }],
+        ...(securityPolicy && { securityPolicyRef: { name: securityPolicy } }),
+    }, defs?.backend));
+    const urlMap = new URLMap(mergeDefaults({
+        metadata: meta("map", "url-map"),
+        location: "global",
+        defaultService: { backendServiceRef: { name: backend.name } },
+    }, defs?.urlMap));
+    const address = new ComputeAddress(mergeDefaults({
+        metadata: meta("ip", "address"),
+        location: "global",
+    }, defs?.address));
+    Object.assign(result, { neg, backend, urlMap, address });
+    // With domains, HTTPS serves the URL map and HTTP serves a redirect to it.
+    let httpMapName = urlMap.name;
+    if (domains && domains.length > 0) {
+        const certificate = new ManagedSSLCertificate(mergeDefaults({
+            metadata: meta("cert", "certificate"),
+            projectRef: { external: projectId ?? GCP.ProjectId },
+            managed: { domains },
+        }, defs?.certificate));
+        const httpsProxy = new TargetHTTPSProxy(mergeDefaults({
+            metadata: meta("https-proxy", "proxy"),
+            location: "global",
+            urlMapRef: { name: urlMap.name },
+            sslCertificates: [{ name: certificate.name }],
+        }, defs?.httpsProxy));
+        const httpsRule = new ForwardingRule(mergeDefaults({
+            metadata: meta("https-rule", "forwarding-rule"),
+            location: "global",
+            loadBalancingScheme: "EXTERNAL_MANAGED",
+            portRange: "443",
+            ipAddress: { addressRef: { name: address.name } },
+            target: { targetHTTPSProxyRef: { name: httpsProxy.name } },
+        }, defs?.httpsRule));
+        const redirectMap = new URLMap(mergeDefaults({
+            metadata: meta("redirect", "url-map"),
+            location: "global",
+            defaultUrlRedirect: { httpsRedirect: true, stripQuery: false },
+        }, defs?.redirectMap));
+        httpMapName = redirectMap.name;
+        Object.assign(result, { certificate, httpsProxy, httpsRule, redirectMap });
+    }
+    result.proxy = new TargetHTTPProxy(mergeDefaults({
+        metadata: meta("proxy", "proxy"),
+        location: "global",
+        urlMapRef: { name: httpMapName },
+    }, defs?.proxy));
+    result.rule = new ForwardingRule(mergeDefaults({
+        metadata: meta("rule", "forwarding-rule"),
+        location: "global",
+        loadBalancingScheme: "EXTERNAL_MANAGED",
+        portRange: String(frontendPort),
+        ipAddress: { addressRef: { name: address.name } },
+        target: { targetHTTPProxyRef: { name: result.proxy.name } },
+    }, defs?.rule));
+    return result;
+}, "PublicCloudRun");

package/dist/deep-observe.d.ts

@@ -82,6 +82,11 @@ export declare function restToCnrmShape(body: Record<string, unknown>): Record<s
 interface RefineContext {
     project: string;
     restName?: string;
+    /** A forwarding rule's declared `ipAddress.addressRef` and that address's live IP (#4238). */
+    address?: {
+        ip: string;
+        ref: unknown;
+    };
 }
 /**
  * A REST payload as a CNRM-shaped property tree, in the declared side's

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA0OD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyF5G"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;CACxC;AAgPD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AA6BD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0F5G"}

package/dist/deep-observe.js

@@ -299,8 +299,14 @@ const CNRM_REFINERS = {
         delete tree.gatewayAddress;
         delete tree.fingerprint;
     },
-    ComputeForwardingRule(tree) {
+    ComputeForwardingRule(tree, ctx) {
         computeLocation(tree);
+        // Compute returns the IP; CNRM writes `ipAddress: { addressRef }` or `{ ip }`.
+        // The IP is the declared address's own when the read found it so (#4238).
+        if (typeof tree.IPAddress === "string") {
+            tree.ipAddress = ctx.address && ctx.address.ip === tree.IPAddress ? { addressRef: ctx.address.ref } : { ip: tree.IPAddress };
+            delete tree.IPAddress;
+        }
         if (tree.IPProtocol !== undefined) {
             tree.ipProtocol = tree.IPProtocol;
             delete tree.IPProtocol;
@@ -352,6 +358,31 @@ export function toCnrmTree(kind, body, ctx) {
     CNRM_REFINERS[kind]?.(tree, { ...ctx, restName });
     return tree;
 }
+/**
+ * The live IP of the address a forwarding rule declares in
+ * `ipAddress.addressRef`, read with the address's own declaration when the
+ * manifest holds it, so the rule's `IPAddress` can be matched to the ref
+ * rather than read as drift (#4238). Undefined when there is no ref or the
+ * read fails; the rule then shows the IP as it is.
+ */
+async function declaredAddressIp(client, props, manifest) {
+    const spec = props.spec ?? props;
+    const ref = spec.ipAddress?.addressRef;
+    if (!ref)
+        return undefined;
+    const raw = typeof ref.name === "string" ? ref.name : typeof ref.external === "string" ? ref.external : undefined;
+    if (!raw)
+        return undefined;
+    const name = raw.slice(raw.lastIndexOf("/") + 1);
+    const declared = manifest.find((r) => r.kind === "ComputeAddress" && r.metadata?.name === name);
+    try {
+        const body = await getResource(client, "ComputeAddress", name, declared?.spec ?? { location: spec.location });
+        return typeof body.address === "string" ? { ip: body.address, ref } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Read the live property tree for each declared entity over the applier's
  * REST transport, normalized into the declared CNRM shape (see the module
@@ -399,6 +430,7 @@ export async function observeResourcesDeepGcp(options) {
         try {
             const obj = await getResource(client, gvk.kind, name, props);
             const labels = obj.labels;
+            const address = gvk.kind === "ComputeForwardingRule" ? await declaredAddressIp(client, props, manifest) : undefined;
             // owned filter: withhold what does not carry chant's marker. Withheld is
             // not absent (#1089). Where the payload has no labels at all there is
             // nothing to filter on, so the resource passes through — the same
@@ -414,7 +446,7 @@ export async function observeResourcesDeepGcp(options) {
             resources[entityName] = {
                 type: entityType,
                 physicalId: obj.id ?? obj.selfLink ?? obj.name,
-                properties: normalizeDeepProperties(toCnrmTree(gvk.kind, obj, { project: client.project }), {
+                properties: normalizeDeepProperties(toCnrmTree(gvk.kind, obj, { project: client.project, ...(address ? { address } : {}) }), {
                     entityType,
                     side: "live",
                     // The static table is the whole prune here — there is no per-resource