@intentius/chant-lexicon-gcp 0.124.30 → 0.124.32

package/dist/generated/runtime.js

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/dist/governance.js

@@ -0,0 +1,98 @@
+/**
+ * GCP governance authoring: the desired-state config
+ * shape an external governance reconciler reconciles, and `landingZoneConfig()` — the
+ * typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven folder tree walker cannot be one. The split mirrors the AWS
+ * slice (lexicons/aws/src/governance.ts): authoring emits config (this
+ * module, arbitrary cardinality); resources for greenfield bootstrap are the
+ * fixed-shape composites in `composites/landing-zone.ts`; the reconciler
+ * consumes only the config.
+ *
+ * GCP has no OrganizationRoot analog — organizations are created through
+ * Cloud Identity / Workspace, never through the resource API.
+ */
+// ---------------------------------------------------------------------------
+// Baseline guardrails (shared with the bootstrap composites)
+// ---------------------------------------------------------------------------
+export const DISABLE_SA_KEY_CREATION = {
+    description: "User-managed service account keys cannot be created.",
+    constraint: "iam.disableServiceAccountKeyCreation",
+    rules: [{ enforce: "TRUE" }],
+};
+export const SKIP_DEFAULT_NETWORK = {
+    description: "New projects do not get the auto-mode default VPC.",
+    constraint: "compute.skipDefaultNetworkCreation",
+    rules: [{ enforce: "TRUE" }],
+};
+/** Allow resource creation only in `locations` (value-group syntax like "in:us-locations" works too). */
+export function resourceLocationRestriction(locations) {
+    return {
+        description: `Resources may only be created in [${locations.join(", ")}].`,
+        constraint: "gcp.resourceLocations",
+        rules: [{ values: { allowedValues: [...locations] } }],
+    };
+}
+/** The audit-log coverage `auditAllServices` declares. */
+export const AUDIT_ALL_SERVICES = {
+    service: "allServices",
+    logTypes: ["ADMIN_READ", "DATA_READ", "DATA_WRITE"],
+};
+/**
+ * The recommended foundation folder structure. Exported so callers can
+ * extend it rather than restate it.
+ */
+export const FOUNDATION_FOLDERS = {
+    Security: {},
+    Infrastructure: {},
+    Sandbox: {},
+    Workloads: {},
+};
+/**
+ * Author the desired-state tree an external governance reconciler reconciles. Pure.
+ * Throws when the tree attaches an org-policy name with no definition; only
+ * policies the tree actually attaches are included in the output.
+ */
+export function landingZoneConfig(props = {}) {
+    const foundation = props.foundation ?? true;
+    const orgPolicies = {
+        ...(foundation
+            ? { "disable-sa-key-creation": DISABLE_SA_KEY_CREATION, "skip-default-network": SKIP_DEFAULT_NETWORK }
+            : {}),
+        ...(props.allowedLocations?.length
+            ? { "resource-location-restriction": resourceLocationRestriction(props.allowedLocations) }
+            : {}),
+        ...props.orgPolicies,
+    };
+    const folders = { ...(foundation ? FOUNDATION_FOLDERS : {}), ...props.folders };
+    const rootOrgPolicies = [
+        ...(foundation ? ["disable-sa-key-creation", "skip-default-network"] : []),
+        ...(props.allowedLocations?.length ? ["resource-location-restriction"] : []),
+        ...(props.rootOrgPolicies ?? []),
+    ];
+    const attached = new Set(rootOrgPolicies);
+    const collect = (tree) => {
+        for (const node of Object.values(tree)) {
+            for (const p of node.orgPolicies ?? [])
+                attached.add(p);
+            if (node.children)
+                collect(node.children);
+        }
+    };
+    collect(folders);
+    for (const name of attached) {
+        if (!orgPolicies[name]) {
+            throw new Error(`landingZoneConfig: org policy "${name}" is attached but not defined in orgPolicies`);
+        }
+    }
+    return {
+        organization: rootOrgPolicies.length ? { orgPolicies: rootOrgPolicies } : {},
+        folders,
+        orgPolicies: Object.fromEntries(Object.entries(orgPolicies).filter(([n]) => attached.has(n))),
+        ...(props.auditAllServices
+            ? { auditSinks: { auditConfig: { service: AUDIT_ALL_SERVICES.service, logTypes: [...AUDIT_ALL_SERVICES.logTypes] } } }
+            : {}),
+    };
+}

package/dist/import/generator.js

@@ -0,0 +1,68 @@
+/**
+ * Config Connector TypeScript generator.
+ *
+ * Converts import IR from the parser into typed chant TypeScript code.
+ */
+export class GcpGenerator {
+    generate(ir) {
+        const lines = [];
+        const imports = new Set();
+        // Collect imports
+        for (const resource of ir.resources) {
+            const parts = resource.type.split("::");
+            if (parts.length >= 3) {
+                // Use the short name for the import
+                imports.add(parts[2]);
+            }
+        }
+        if (imports.size > 0) {
+            lines.push(`import { ${[...imports].sort().join(", ")} } from "@intentius/chant-lexicon-gcp";`);
+            lines.push("");
+        }
+        // Generate resource declarations
+        for (const resource of ir.resources) {
+            const parts = resource.type.split("::");
+            const className = parts.length >= 3 ? parts[2] : resource.type;
+            const varName = camelCase(resource.logicalId);
+            lines.push(`export const ${varName} = new ${className}(${formatProps(resource.properties, 0)});`);
+            lines.push("");
+        }
+        return [{ path: "main.ts", content: lines.join("\n") + "\n" }];
+    }
+}
+function camelCase(str) {
+    return str
+        .replace(/[-_](.)/g, (_, c) => c.toUpperCase())
+        .replace(/^(.)/, (_, c) => c.toLowerCase());
+}
+function formatProps(props, indent) {
+    const entries = Object.entries(props);
+    if (entries.length === 0)
+        return "{}";
+    const pad = "  ".repeat(indent + 1);
+    const closePad = "  ".repeat(indent);
+    const lines = entries.map(([key, value]) => {
+        return `${pad}${key}: ${formatValue(value, indent + 1)},`;
+    });
+    return `{\n${lines.join("\n")}\n${closePad}}`;
+}
+function formatValue(value, indent) {
+    if (value === null || value === undefined)
+        return "undefined";
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    if (Array.isArray(value)) {
+        if (value.length === 0)
+            return "[]";
+        const pad = "  ".repeat(indent + 1);
+        const closePad = "  ".repeat(indent);
+        const items = value.map((v) => `${pad}${formatValue(v, indent + 1)},`);
+        return `[\n${items.join("\n")}\n${closePad}]`;
+    }
+    if (typeof value === "object") {
+        return formatProps(value, indent);
+    }
+    return String(value);
+}

package/dist/import/live-export.js

@@ -0,0 +1,73 @@
+import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import { GcpParser } from "./parser.js";
+/** Server-written metadata fields, stripped unless `verbatim`. */
+const SERVER_METADATA_FIELDS = [
+    "managedFields",
+    "uid",
+    "resourceVersion",
+    "generation",
+    "creationTimestamp",
+    "selfLink",
+    "ownerReferences",
+    "finalizers",
+];
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Strip `status` and server-written metadata to reach the declared shape of a
+ * Config Connector object. Config Connector writes back several
+ * `cnrm.cloud.google.com/*` annotations that are not authored config; those are
+ * dropped too. Returns a new object; the input is not mutated.
+ */
+export function stripServerFields(obj) {
+    const clone = JSON.parse(JSON.stringify(obj));
+    delete clone.status;
+    if (isRecord(clone.metadata)) {
+        const md = clone.metadata;
+        for (const f of SERVER_METADATA_FIELDS)
+            delete md[f];
+        if (isRecord(md.annotations)) {
+            for (const key of Object.keys(md.annotations)) {
+                // Config Connector's own bookkeeping annotations, plus the apply
+                // round-trip annotation — none are authored config.
+                if (key.startsWith("cnrm.cloud.google.com/") ||
+                    key === "kubectl.kubernetes.io/last-applied-configuration") {
+                    delete md.annotations[key];
+                }
+            }
+            if (Object.keys(md.annotations).length === 0)
+                delete md.annotations;
+        }
+    }
+    return clone;
+}
+/**
+ * Build full-fidelity export IR from a list of live Config Connector objects
+ * (each live object is already its manifest). Reuses the import GcpParser by
+ * feeding cleaned objects as JSON documents. Pure: all I/O stays in the caller.
+ */
+export function buildExportFromObjects(objects, opts = {}) {
+    const owning = opts.owned
+        ? objects.filter((o) => {
+            if (!isRecord(o))
+                return false;
+            const labels = isRecord(o.metadata) ? o.metadata.labels : undefined;
+            return hasOwnershipMarker(labels, LABEL_OWNERSHIP_KEYS);
+        })
+        : objects;
+    const cleaned = owning
+        .filter(isRecord)
+        .map((o) => (opts.verbatim ? o : stripServerFields(o)));
+    const content = cleaned.map((o) => JSON.stringify(o, null, 2)).join("\n---\n");
+    const ir = new GcpParser().parse(content);
+    const selector = opts.selector;
+    if (!selector || (selector.type === undefined && selector.name === undefined)) {
+        return ir;
+    }
+    return {
+        ...ir,
+        resources: ir.resources.filter((r) => (selector.type === undefined || r.type === selector.type) &&
+            (selector.name === undefined || r.logicalId === selector.name)),
+    };
+}

package/dist/import/parser.js

@@ -0,0 +1,61 @@
+/**
+ * Config Connector YAML template parser.
+ *
+ * Parses Config Connector YAML manifests into the import IR
+ * for conversion to chant TypeScript.
+ */
+import { BaseValueParser } from "@intentius/chant/import/base-parser";
+import { parseYAML } from "@intentius/chant/yaml";
+import { gcpTypeName } from "../spec/parse.js";
+/**
+ * Parser for Config Connector YAML manifests.
+ */
+export class GcpParser extends BaseValueParser {
+    dispatchIntrinsic(_key, _value, _obj) {
+        // Config Connector YAML has no intrinsic functions
+        return null;
+    }
+    parse(input) {
+        const resources = [];
+        const documents = input
+            .split(/^---\s*$/m)
+            .map((d) => d.trim())
+            .filter((d) => d.length > 0);
+        for (const docStr of documents) {
+            const doc = parseYAML(docStr);
+            if (!doc)
+                continue;
+            const apiVersion = doc.apiVersion;
+            const kind = doc.kind;
+            if (!apiVersion || !kind)
+                continue;
+            // Only handle Config Connector resources
+            if (!apiVersion.includes("cnrm.cloud.google.com"))
+                continue;
+            const group = apiVersion.split("/")[0];
+            const typeName = gcpTypeName(group, kind);
+            const metadata = doc.metadata;
+            const spec = doc.spec;
+            const logicalId = metadata?.name ?? kind;
+            // Build properties from spec
+            const properties = {};
+            if (metadata) {
+                properties.metadata = this.parseValue(metadata);
+            }
+            if (spec) {
+                for (const [key, value] of Object.entries(spec)) {
+                    properties[key] = this.parseValue(value);
+                }
+            }
+            resources.push({
+                logicalId,
+                type: typeName,
+                properties,
+            });
+        }
+        return {
+            resources,
+            parameters: [],
+        };
+    }
+}

package/dist/index.js

@@ -0,0 +1,36 @@
+// Typed Op step-builder wrappers (chant #1288 Stage 2) — gcpApply/gcpDelete/
+// flociGcpUp/flociGcpDown with authoring-time types derived from this
+// lexicon's own *Args interfaces (see ./op/builders.ts's module doc for why
+// these live here rather than in core). Opt-in: `@intentius/chant/op`'s
+// same-named exports are core's original untyped builders, unchanged.
+export { gcpApply, gcpDelete, flociGcpUp, flociGcpDown } from "./op/builders.js";
+// Serializer
+export { gcpSerializer } from "./serializer.js";
+// Plugin
+export { gcpPlugin } from "./plugin.js";
+// Default labels & annotations
+export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
+export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
+// Pseudo-parameters
+export { GCP, ProjectId, Region, Zone } from "./pseudo.js";
+// Variables / annotation constants
+export { GcpAnnotations } from "./variables.js";
+// Generated entities — export everything from generated index
+// After running `npm run generate`, this re-exports all Config Connector resource classes
+export * from "./generated/index.js";
+// Composites
+export { GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork, PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject, MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GpuNodePool, GovernanceFoundation, LocationRestriction, OrganizationAuditConfig, } from "./composites/index.js";
+// GCP governance authoring: the desired-state config an external governance
+// reconciler applies, and the typed landing-zone authoring layer.
+export { landingZoneConfig, resourceLocationRestriction, DISABLE_SA_KEY_CREATION, SKIP_DEFAULT_NETWORK, AUDIT_ALL_SERVICES, FOUNDATION_FOLDERS, } from "./governance.js";
+// IAM role constants
+export { StorageRoles, ComputeRoles, ContainerRoles, IAMRoles, SQLRoles, RunRoles, PubSubRoles } from "./actions/index.js";
+// Spec utilities (for tooling)
+export { fetchCRDBundle, getCachePath, clearCache, KCC_VERSION } from "./spec/fetch.js";
+export { parseGcpCRD, gcpServiceName, gcpShortName, gcpTypeName, stripServicePrefix } from "./spec/parse.js";
+// Code generation pipeline
+export { generate, writeGeneratedFiles } from "./codegen/generate.js";
+export { packageLexicon } from "./codegen/package.js";
+// LSP providers
+export { gcpCompletions } from "./lsp/completions.js";
+export { gcpHover } from "./lsp/hover.js";

package/dist/integrity.json

@@ -1,14 +1,14 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "ae0eab325af048dc37c4bf874c2bacd1e1557e9de3b6f0414ee14f6074a98cf4",
+    "manifest.json": "7ae4134a4744904433410962da429f7de99f88088ba05ecf80d11f68f9686037",
     "meta.json": "475f10909854d059a2e2d4fb541c058803422e38b9c64bd4d6858c0623eedb8c",
     "types/index.d.ts": "5433b54c04b57d6fda8f3d81ef92ed0aca87f7e8e5dd3ea92d8de6e62a3ccfab",
     "rules/hardcoded-project.ts": "6d5ae9efa74d73800eebe1a0a0d43c619ee0fdebe3347195df93fcbe63b34f0d",
     "rules/hardcoded-region.ts": "d7f8c48571f37600cb583a08aef7eb07245fbcbdda048874bb074c94c849ae0f",
     "rules/public-iam.ts": "9c43b2d148dba1aea3494983e042d7b038d92a8309173e7e35bb17f6ee21db9e",
     "rules/gcp-helpers.ts": "0420adb73527b29a288e219b24742f4f29ef83859228d61fdaff83b1fb800bf1",
-    "rules/schema-registry.ts": "0d90aa97ca893478b4e0b7ac02fb017786929abd1f241b12c90915bffa8499d8",
+    "rules/schema-registry.ts": "fa9d8e3c1ebee2b95b3385044c7c24c50e71626f5b2936b9412aeb03b0ce7e7a",
     "rules/wgc101.ts": "679f245ea4665d687848382ff1b934ae133a3c320cc051011cc4d95802e66b38",
     "rules/wgc102.ts": "22cb997d40a59ce3e0ff833ce946a5571e13d4811b255d4b67db570d58575e07",
     "rules/wgc103.ts": "589741dbe5828508b5424a74f63f0202ba8452237c366173af283073f81e0317",
@@ -40,5 +40,5 @@
     "skills/chant-gcp-patterns.md": "4c6809fc7c37fa1879379ad4c0e2d114dec9497bc6eb9d1bca4e79fddea4f509",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "9225fc26ad4bedac00ce150ef40a6e26319d15ba91d73b04cdbda13f6b2d63ac"
+  "composite": "91088333d0ea3e2df519e219268dc206fc5438c63c163b37fbfbaf58967fbc43"
 }

package/dist/lint/audit-catalog.js

@@ -0,0 +1,38 @@
+/**
+ * The gcp lexicon's `chant audit` catalog — metadata for the WGC* Config
+ * Connector post-synth rules. Contributed via `gcpPlugin.auditCatalog()` (#687).
+ */
+import { auditRule, applyLineage } from "@intentius/chant/audit/catalog";
+import { gcpAuditLineage } from "./audit-lineage.js";
+const GCP_SEC = { name: "Google Cloud — Security best practices", url: "https://cloud.google.com/security/best-practices" };
+export const gcpAuditCatalog = {
+    WGC101: auditRule("WGC101", "merge-worthy", "guidance", "Storage/SQL without encryption configuration", "Configure encryption (e.g. a CMEK key) for data at rest.", { authority: [GCP_SEC] }),
+    WGC102: auditRule("WGC102", "merge-worthy", "guidance", "Public IAM member (allUsers/allAuthenticatedUsers)", "Remove allUsers/allAuthenticatedUsers bindings.", { authority: [GCP_SEC] }),
+    WGC103: auditRule("WGC103", "report-only", "guidance", "Missing project-id annotation", "Add the cnrm.cloud.google.com/project-id annotation.", { category: "best-practice" }),
+    WGC104: auditRule("WGC104", "merge-worthy", "guidance", "Bucket without uniform bucket-level access", "Enable uniformBucketLevelAccess.", { authority: [GCP_SEC] }),
+    WGC105: auditRule("WGC105", "merge-worthy", "guidance", "Cloud SQL open to 0.0.0.0/0", "Restrict authorizedNetworks to known sources.", { authority: [GCP_SEC] }),
+    WGC106: auditRule("WGC106", "report-only", "guidance", "Missing deletion-policy annotation", "Add the cnrm.cloud.google.com/deletion-policy annotation.", { category: "best-practice" }),
+    WGC107: auditRule("WGC107", "report-only", "guidance", "Bucket versioning disabled", "Enable object versioning.", { category: "best-practice" }),
+    WGC108: auditRule("WGC108", "report-only", "guidance", "Cloud SQL backups disabled", "Enable backup configuration.", { category: "best-practice" }),
+    WGC109: auditRule("WGC109", "merge-worthy", "guidance", "Firewall open to 0.0.0.0/0", "Restrict sourceRanges to known sources.", { authority: [GCP_SEC] }),
+    WGC110: auditRule("WGC110", "merge-worthy", "guidance", "KMS key without rotation", "Set a rotationPeriod on the CryptoKey.", { authority: [GCP_SEC] }),
+    WGC111: auditRule("WGC111", "merge-worthy", "guidance", "Reference to an undefined resource", "Point the reference at a resource in the output.", { category: "correctness" }),
+    WGC112: auditRule("WGC112", "merge-worthy", "guidance", "Missing or invalid apiVersion", "Set a valid cnrm.cloud.google.com apiVersion.", { category: "correctness" }),
+    WGC113: auditRule("WGC113", "report-only", "guidance", "Alpha API version", "Move to a beta/GA API version.", { category: "best-practice" }),
+    WGC201: auditRule("WGC201", "report-only", "guidance", "Missing managed-by label", "Add the app.kubernetes.io/managed-by label.", { category: "best-practice" }),
+    WGC202: auditRule("WGC202", "merge-worthy", "guidance", "Cluster without Workload Identity", "Enable Workload Identity on the ContainerCluster.", { authority: [GCP_SEC] }),
+    WGC203: auditRule("WGC203", "merge-worthy", "guidance", "Node pool uses broad cloud-platform scope", "Use narrowly-scoped OAuth scopes instead of cloud-platform.", { authority: [GCP_SEC] }),
+    WGC204: auditRule("WGC204", "report-only", "guidance", "Compute instance without Shielded VM", "Enable Shielded VM configuration.", { category: "best-practice" }),
+    WGC301: auditRule("WGC301", "report-only", "guidance", "No IAMAuditConfig found", "Configure audit logging via IAMAuditConfig.", { category: "best-practice" }),
+    WGC302: auditRule("WGC302", "report-only", "guidance", "No Service (enabled APIs) found", "Declare the GCP APIs you depend on.", { category: "best-practice" }),
+    WGC303: auditRule("WGC303", "report-only", "guidance", "No VPC Service Controls perimeter", "Consider an AccessContextManager ServicePerimeter.", { category: "best-practice" }),
+    WGC401: auditRule("WGC401", "merge-worthy", "guidance", "Unknown field in resource spec", "Remove the unknown spec field.", { category: "correctness" }),
+    WGC402: auditRule("WGC402", "merge-worthy", "guidance", "Missing required spec field", "Add the required spec field.", { category: "correctness" }),
+    WGC403: auditRule("WGC403", "merge-worthy", "guidance", "Spec field has wrong type/structure", "Fix the field's type/structure.", { category: "correctness" }),
+    // governance posture regressions.
+    WGC501: auditRule("WGC501", "merge-worthy", "guidance", "Org Policy guardrail not enforced", "Enable enforce on the rule (or remove the policy deliberately) — a disabled org policy constrains nothing.", { authority: [GCP_SEC] }),
+    WGC502: auditRule("WGC502", "merge-worthy", "guidance", "Org Policy guardrail defines no rules", "Add rules to the OrgPolicyPolicy — without them the constraint binds nothing.", { authority: [GCP_SEC] }),
+    WGC503: auditRule("WGC503", "merge-worthy", "guidance", "Audit logging dropped or scoped down", "Keep auditLogConfigs populated and remove exemptedMembers from the IAMAuditConfig.", { authority: [GCP_SEC] }),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(gcpAuditCatalog, gcpAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,63 @@
+export const gcpAuditLineage = {
+    WGC101: [
+        { tool: "gcp-policy-library", rule: "GCPStorageCMEKEncryptionConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_storage_cmek_encryption_v1.yaml", relation: "overlaps" },
+    ],
+    WGC102: [
+        { tool: "checkov", rule: "CKV_GCP_28", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "Cloud Storage Anonymous or Publicly Accessible", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/a6cd52a1-3056-4910-96a5-894de9f3f3b3/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPStorageBucketWorldReadableConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_storage_bucket_world_readable_v1.yaml", relation: "overlaps" },
+    ],
+    WGC104: [
+        { tool: "checkov", rule: "CKV_GCP_29", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "Google Storage Bucket Level Access Disabled", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/bb0db090-5509-4853-a827-75ced0b3caa0/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPStorageBucketPolicyOnlyConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_storage_bucket_policy_only_v1.yaml", relation: "overlaps" },
+    ],
+    WGC105: [
+        { tool: "checkov", rule: "CKV_GCP_11", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "SQL DB Instance Publicly Accessible", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/b187edca-b81e-4fdc-aff4-aab57db45edb/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPSQLWorldReadableConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_sql_world_readable_v1.yaml", relation: "overlaps" },
+    ],
+    WGC107: [
+        { tool: "checkov", rule: "CKV_GCP_78", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "Cloud Storage Bucket Versioning Disabled", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/e7e961ac-d17e-4413-84bc-8a1fbe242944/", relation: "overlaps" },
+    ],
+    WGC108: [
+        { tool: "checkov", rule: "CKV_GCP_14", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "SQL DB Instance Backup Disabled", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/cf3c7631-cd1e-42f3-8801-a561214a6e79/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPSQLBackupConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_sql_backup_v1.yaml", relation: "overlaps" },
+    ],
+    WGC109: [
+        { tool: "gcp-policy-library", rule: "GCPRestrictedFirewallRulesConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_restricted_firewall_rules_v1.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV2_GCP_12", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    ],
+    WGC110: [
+        { tool: "checkov", rule: "CKV_GCP_43", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "High Google KMS Crypto Key Rotation Period", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/d8c57c4e-bf6f-4e32-a2bf-8643532de77b/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPCMEKRotationConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_cmek_rotation_v1.yaml", relation: "overlaps" },
+    ],
+    WGC202: [
+        { tool: "gcp-policy-library", rule: "GCPGKEEnableWorkloadIdentityConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_gke_enable_workload_identity_v1.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_GCP_69", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    ],
+    WGC203: [
+        { tool: "gcp-policy-library", rule: "GCPGKEAllowedNodeSAConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_gke_allowed_node_sa_v1.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_GCP_31", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "VM With Full Cloud Access", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/bc280331-27b9-4acb-a010-018e8098aa5d/", relation: "overlaps" },
+    ],
+    WGC204: [
+        { tool: "checkov", rule: "CKV_GCP_39", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "Shielded VM Disabled", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/1b44e234-3d73-41a8-9954-0b154135280e/", relation: "overlaps" },
+    ],
+    WGC301: [
+        { tool: "gcp-policy-library", rule: "GCPIAMAuditLogConstraint", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_iam_audit_log.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV2_GCP_5", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    ],
+    WGC303: [
+        { tool: "gcp-policy-library", rule: "GCPVPCSCEnsureProjectConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_vpc_sc_ensure_project_v1.yaml", relation: "overlaps" },
+    ],
+    WGC503: [
+        { tool: "gcp-policy-library", rule: "GCPIAMAuditLogConstraint", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_iam_audit_log.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV2_GCP_5", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "IAM Audit Not Properly Configured", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/89fe890f-b480-460c-8b6b-7d8b1468adb4/", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/gcp-helpers.js

@@ -0,0 +1,91 @@
+/**
+ * Shared helpers for GCP Config Connector post-synthesis lint rules.
+ *
+ * Provides YAML parsing for multi-document Config Connector manifests
+ * and accessor utilities for common manifest fields.
+ */
+import { parseYAML } from "@intentius/chant/yaml";
+export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+/**
+ * Split a multi-document YAML string on `---` boundaries and parse each
+ * document into a GcpManifest.
+ */
+export function parseGcpManifests(yaml) {
+    const documents = yaml.split(/^---\s*$/m);
+    const manifests = [];
+    for (const doc of documents) {
+        const trimmed = doc.trim();
+        if (trimmed === "" || trimmed === "---")
+            continue;
+        try {
+            const parsed = parseYAML(trimmed);
+            if (typeof parsed === "object" && parsed !== null) {
+                manifests.push(parsed);
+            }
+        }
+        catch {
+            // Skip unparseable documents
+        }
+    }
+    return manifests;
+}
+/**
+ * Check if a manifest is a Config Connector resource
+ * (apiVersion contains cnrm.cloud.google.com).
+ */
+export function isConfigConnectorResource(manifest) {
+    return typeof manifest.apiVersion === "string" &&
+        manifest.apiVersion.includes("cnrm.cloud.google.com");
+}
+/**
+ * Safely extract the spec from a manifest.
+ */
+export function getSpec(manifest) {
+    return manifest.spec ?? undefined;
+}
+/**
+ * Safely extract annotations from a manifest's metadata.
+ */
+export function getAnnotations(manifest) {
+    return manifest.metadata?.annotations ?? undefined;
+}
+/**
+ * Get the resource name from metadata.
+ */
+export function getResourceName(manifest) {
+    return manifest.metadata?.name ?? "unknown";
+}
+/**
+ * Recursively walk a spec object looking for keys ending in `Ref`
+ * (e.g. `networkRef`, `topicRef`, `clusterRef`) that have a `name`
+ * sub-field. Returns the set of referenced names.
+ *
+ * Skips `external` refs (cross-project references outside the template).
+ */
+export function findResourceRefs(obj) {
+    const refs = new Set();
+    walkForRefs(obj, refs);
+    return refs;
+}
+function walkForRefs(value, refs) {
+    if (value === null || value === undefined)
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            walkForRefs(item, refs);
+        }
+        return;
+    }
+    if (typeof value === "object") {
+        const obj = value;
+        for (const [key, val] of Object.entries(obj)) {
+            if (key.endsWith("Ref") && typeof val === "object" && val !== null) {
+                const refObj = val;
+                if (typeof refObj.name === "string" && !refObj.external) {
+                    refs.add(refObj.name);
+                }
+            }
+            walkForRefs(val, refs);
+        }
+    }
+}

package/dist/lint/post-synth/index.js

@@ -0,0 +1,54 @@
+import { wgc101 } from "./wgc101.js";
+import { wgc102 } from "./wgc102.js";
+import { wgc103 } from "./wgc103.js";
+import { wgc104 } from "./wgc104.js";
+import { wgc105 } from "./wgc105.js";
+import { wgc106 } from "./wgc106.js";
+import { wgc107 } from "./wgc107.js";
+import { wgc108 } from "./wgc108.js";
+import { wgc109 } from "./wgc109.js";
+import { wgc110 } from "./wgc110.js";
+import { wgc111 } from "./wgc111.js";
+import { wgc112 } from "./wgc112.js";
+import { wgc113 } from "./wgc113.js";
+import { wgc201 } from "./wgc201.js";
+import { wgc202 } from "./wgc202.js";
+import { wgc203 } from "./wgc203.js";
+import { wgc204 } from "./wgc204.js";
+import { wgc301 } from "./wgc301.js";
+import { wgc302 } from "./wgc302.js";
+import { wgc303 } from "./wgc303.js";
+import { wgc401 } from "./wgc401.js";
+import { wgc402 } from "./wgc402.js";
+import { wgc403 } from "./wgc403.js";
+import { wgc501 } from "./wgc501.js";
+import { wgc502 } from "./wgc502.js";
+import { wgc503 } from "./wgc503.js";
+export const postSynthChecks = [
+    wgc101,
+    wgc102,
+    wgc103,
+    wgc104,
+    wgc105,
+    wgc106,
+    wgc107,
+    wgc108,
+    wgc109,
+    wgc110,
+    wgc111,
+    wgc112,
+    wgc113,
+    wgc201,
+    wgc202,
+    wgc203,
+    wgc204,
+    wgc301,
+    wgc302,
+    wgc303,
+    wgc401,
+    wgc402,
+    wgc403,
+    wgc501,
+    wgc502,
+    wgc503,
+];

package/dist/lint/post-synth/schema-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-registry.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/schema-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAUD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAoB/D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAiBxD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAavF"}
+{"version":3,"file":"schema-registry.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/schema-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAUD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAoB/D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAiBxD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAavF"}