@intentius/chant-lexicon-gcp 0.124.31 → 0.124.32

package/dist/lint/post-synth/wgc204.js

@@ -0,0 +1,33 @@
+/**
+ * WGC204: ComputeInstance without shielded VM config
+ */
+import { parseGcpManifests, getSpec, getResourceName } from "./gcp-helpers.js";
+export const wgc204 = {
+    id: "WGC204",
+    description: "ComputeInstance without shielded VM configuration",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "ComputeInstance")
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const shieldedConfig = spec.shieldedInstanceConfig;
+                if (!shieldedConfig) {
+                    diagnostics.push({
+                        checkId: "WGC204",
+                        severity: "info",
+                        message: `ComputeInstance "${getResourceName(manifest)}" has no shielded VM configuration — consider enabling secureboot, vtpm, and integrity monitoring`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc301.js

@@ -0,0 +1,28 @@
+/**
+ * WGC301: No audit logging config (IAMAuditConfig) in output
+ */
+import { parseGcpManifests } from "./gcp-helpers.js";
+export const wgc301 = {
+    id: "WGC301",
+    description: "No IAMAuditConfig resource found in output — audit logging may not be configured",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            if (manifests.length === 0)
+                continue;
+            const hasAuditConfig = manifests.some(m => m.kind === "IAMAuditConfig");
+            if (!hasAuditConfig) {
+                diagnostics.push({
+                    checkId: "WGC301",
+                    severity: "info",
+                    message: "No IAMAuditConfig resource found — consider adding audit logging for compliance",
+                    lexicon: "gcp",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc302.js

@@ -0,0 +1,28 @@
+/**
+ * WGC302: Service API not explicitly enabled
+ */
+import { parseGcpManifests } from "./gcp-helpers.js";
+export const wgc302 = {
+    id: "WGC302",
+    description: "No Service resource found — GCP APIs may not be explicitly enabled",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            if (manifests.length === 0)
+                continue;
+            const hasService = manifests.some(m => m.kind === "Service" && m.apiVersion?.includes("serviceusage.cnrm"));
+            if (!hasService) {
+                diagnostics.push({
+                    checkId: "WGC302",
+                    severity: "info",
+                    message: "No Service (serviceusage) resource found — consider explicitly enabling required GCP APIs",
+                    lexicon: "gcp",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc303.js

@@ -0,0 +1,29 @@
+/**
+ * WGC303: Missing VPC Service Controls perimeter
+ */
+import { parseGcpManifests } from "./gcp-helpers.js";
+export const wgc303 = {
+    id: "WGC303",
+    description: "No AccessContextManager ServicePerimeter found — VPC Service Controls not configured",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            if (manifests.length === 0)
+                continue;
+            const hasPerimeter = manifests.some(m => m.kind === "AccessContextManagerServicePerimeter" ||
+                (m.apiVersion?.includes("accesscontextmanager") && m.kind?.includes("ServicePerimeter")));
+            if (!hasPerimeter) {
+                diagnostics.push({
+                    checkId: "WGC303",
+                    severity: "info",
+                    message: "No VPC Service Controls perimeter found — consider adding for data exfiltration protection",
+                    lexicon: "gcp",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc401.js

@@ -0,0 +1,50 @@
+/**
+ * WGC401: Unknown spec field
+ *
+ * Flags fields in a Config Connector resource spec that are not defined
+ * in the CRD schema. Includes "did you mean?" suggestion via Levenshtein.
+ */
+import { parseGcpManifests, isConfigConnectorResource, getResourceName, getSpec } from "./gcp-helpers.js";
+import { getSchemaRegistry, suggestField } from "./schema-registry.js";
+export const wgc401 = {
+    id: "WGC401",
+    description: "Config Connector resource spec contains unknown field",
+    check(ctx) {
+        const diagnostics = [];
+        const registry = getSchemaRegistry();
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            for (const manifest of manifests) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const kind = manifest.kind;
+                if (!kind)
+                    continue;
+                const schema = registry.get(kind);
+                if (!schema)
+                    continue; // No schema available for this kind
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const knownFields = Object.keys(schema.fields);
+                const resourceName = getResourceName(manifest);
+                for (const field of Object.keys(spec)) {
+                    if (field in schema.fields)
+                        continue;
+                    const suggestion = suggestField(field, knownFields);
+                    const hint = suggestion ? ` — did you mean "${suggestion}"?` : "";
+                    diagnostics.push({
+                        checkId: "WGC401",
+                        severity: "error",
+                        message: `Resource "${resourceName}" (${kind}): unknown spec field "${field}"${hint}`,
+                        entity: resourceName,
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc402.js

@@ -0,0 +1,46 @@
+/**
+ * WGC402: Missing required spec field
+ *
+ * Flags Config Connector resources that are missing required fields
+ * according to their CRD schema.
+ */
+import { parseGcpManifests, isConfigConnectorResource, getResourceName, getSpec } from "./gcp-helpers.js";
+import { getSchemaRegistry } from "./schema-registry.js";
+export const wgc402 = {
+    id: "WGC402",
+    description: "Config Connector resource is missing a required spec field",
+    check(ctx) {
+        const diagnostics = [];
+        const registry = getSchemaRegistry();
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            for (const manifest of manifests) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const kind = manifest.kind;
+                if (!kind)
+                    continue;
+                const schema = registry.get(kind);
+                if (!schema)
+                    continue;
+                const spec = getSpec(manifest);
+                const specKeys = new Set(spec ? Object.keys(spec) : []);
+                const resourceName = getResourceName(manifest);
+                for (const requiredField of schema.required) {
+                    if (!specKeys.has(requiredField)) {
+                        diagnostics.push({
+                            checkId: "WGC402",
+                            severity: "error",
+                            message: `Resource "${resourceName}" (${kind}): missing required field "${requiredField}"`,
+                            entity: resourceName,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc403.js

@@ -0,0 +1,74 @@
+/**
+ * WGC403: Type/structure mismatch in spec field
+ *
+ * Flags spec fields where the value type doesn't match the CRD schema:
+ * - String where number expected (e.g. availableMemoryMb: "512")
+ * - Scalar string where resourceRef object expected (e.g. topicRef: "name")
+ */
+import { parseGcpManifests, isConfigConnectorResource, getResourceName, getSpec } from "./gcp-helpers.js";
+import { getSchemaRegistry } from "./schema-registry.js";
+export const wgc403 = {
+    id: "WGC403",
+    description: "Config Connector resource spec field has wrong type or structure",
+    check(ctx) {
+        const diagnostics = [];
+        const registry = getSchemaRegistry();
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            for (const manifest of manifests) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const kind = manifest.kind;
+                if (!kind)
+                    continue;
+                const schema = registry.get(kind);
+                if (!schema)
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const resourceName = getResourceName(manifest);
+                for (const [field, value] of Object.entries(spec)) {
+                    const fieldSchema = schema.fields[field];
+                    if (!fieldSchema)
+                        continue; // Unknown fields handled by WGC401
+                    // Check: resourceRef field expects an object, got a scalar
+                    if (fieldSchema.ref && typeof value === "string") {
+                        diagnostics.push({
+                            checkId: "WGC403",
+                            severity: "error",
+                            message: `Resource "${resourceName}" (${kind}): field "${field}" expects a resourceRef object (e.g. { name, kind }), got string "${value}"`,
+                            entity: resourceName,
+                            lexicon: "gcp",
+                        });
+                        continue;
+                    }
+                    // Check: number field got a string that looks numeric
+                    if (fieldSchema.type === "number" && typeof value === "string") {
+                        diagnostics.push({
+                            checkId: "WGC403",
+                            severity: "error",
+                            message: `Resource "${resourceName}" (${kind}): field "${field}" expects a number, got string "${value}"`,
+                            entity: resourceName,
+                            lexicon: "gcp",
+                        });
+                        continue;
+                    }
+                    // Check: boolean field got a string
+                    if (fieldSchema.type === "boolean" && typeof value === "string") {
+                        diagnostics.push({
+                            checkId: "WGC403",
+                            severity: "error",
+                            message: `Resource "${resourceName}" (${kind}): field "${field}" expects a boolean, got string "${value}"`,
+                            entity: resourceName,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc501.js

@@ -0,0 +1,63 @@
+/**
+ * WGC501: Org Policy Guardrail Not Enforced
+ *
+ * Flags OrgPolicyPolicy resources whose rules switch enforcement off or that
+ * reset the constraint to its default. A disabled org policy is the GCP
+ * shape of a weakened guardrail: the constraint stays visible in the tree
+ * while constraining nothing.
+ */
+import { parseGcpManifests, getResourceName } from "./gcp-helpers.js";
+/**
+ * OrgPolicyPolicy mirrors the API's own `spec` inside the CRD spec, so rules
+ * live at `spec.spec.rules`; accept `spec.rules` too for hand-written manifests.
+ */
+export function orgPolicySpec(manifest) {
+    const outer = manifest.spec ?? {};
+    const inner = outer.spec;
+    return typeof inner === "object" && inner !== null ? inner : outer;
+}
+export function orgPolicyRules(manifest) {
+    const rules = orgPolicySpec(manifest).rules;
+    return Array.isArray(rules) ? rules : [];
+}
+function isDisabled(rule) {
+    return rule.enforce === false || rule.enforce === "FALSE";
+}
+export const wgc501 = {
+    id: "WGC501",
+    description: "Org Policy guardrail not enforced — a disabled policy constrains nothing",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "OrgPolicyPolicy")
+                    continue;
+                const name = getResourceName(manifest);
+                if (orgPolicySpec(manifest).reset === true) {
+                    diagnostics.push({
+                        checkId: "WGC501",
+                        severity: "error",
+                        message: `OrgPolicyPolicy "${name}" resets the constraint to its default — the guardrail is switched off`,
+                        entity: name,
+                        lexicon: "gcp",
+                    });
+                    continue;
+                }
+                for (const rule of orgPolicyRules(manifest)) {
+                    if (isDisabled(rule)) {
+                        diagnostics.push({
+                            checkId: "WGC501",
+                            severity: "error",
+                            message: `OrgPolicyPolicy "${name}" has a rule with enforce disabled — the guardrail is declared but not enforced`,
+                            entity: name,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc502.js

@@ -0,0 +1,37 @@
+/**
+ * WGC502: Org Policy Guardrail Defines No Rules
+ *
+ * Flags OrgPolicyPolicy resources with no rules (and no reset). A rule-less
+ * org policy binds a constraint to nothing — the usual leftover of a
+ * guardrail whose rules were removed while the policy object was kept.
+ */
+import { parseGcpManifests, getResourceName } from "./gcp-helpers.js";
+import { orgPolicyRules, orgPolicySpec } from "./wgc501.js";
+export const wgc502 = {
+    id: "WGC502",
+    description: "Org Policy guardrail defines no rules — it binds its constraint to nothing",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "OrgPolicyPolicy")
+                    continue;
+                if (orgPolicySpec(manifest).reset === true)
+                    continue; // WGC501's finding
+                if (orgPolicyRules(manifest).length > 0)
+                    continue;
+                const name = getResourceName(manifest);
+                diagnostics.push({
+                    checkId: "WGC502",
+                    severity: "error",
+                    message: `OrgPolicyPolicy "${name}" defines no rules — the guardrail constrains nothing`,
+                    entity: name,
+                    lexicon: "gcp",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc503.js

@@ -0,0 +1,49 @@
+/**
+ * WGC503: Audit Logging Dropped or Scoped Down
+ *
+ * Flags IAMAuditConfig resources that capture nothing (no auditLogConfigs)
+ * or that carve identities out of the audit trail via exemptedMembers.
+ * WGC301 reports the absence of any IAMAuditConfig as hygiene; this check
+ * covers the declared-but-weakened sink, which is merge-worthy.
+ */
+import { parseGcpManifests, getResourceName, getSpec } from "./gcp-helpers.js";
+export const wgc503 = {
+    id: "WGC503",
+    description: "IAMAuditConfig captures nothing or exempts members — the audit sink is scoped down",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "IAMAuditConfig")
+                    continue;
+                const name = getResourceName(manifest);
+                const configs = getSpec(manifest)?.auditLogConfigs;
+                if (!Array.isArray(configs) || configs.length === 0) {
+                    diagnostics.push({
+                        checkId: "WGC503",
+                        severity: "error",
+                        message: `IAMAuditConfig "${name}" has no auditLogConfigs — the audit sink is declared but captures nothing`,
+                        entity: name,
+                        lexicon: "gcp",
+                    });
+                    continue;
+                }
+                for (const config of configs) {
+                    const exempted = config.exemptedMembers;
+                    if (Array.isArray(exempted) && exempted.length > 0) {
+                        diagnostics.push({
+                            checkId: "WGC503",
+                            severity: "error",
+                            message: `IAMAuditConfig "${name}" exempts members from ${String(config.logType ?? "audit")} logging — audit evidence is scoped down`,
+                            entity: name,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/hardcoded-project.js

@@ -0,0 +1,51 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WGC001: Hardcoded GCP Project ID
+ *
+ * Detects hardcoded GCP project IDs in code.
+ * Project IDs should use GCP.ProjectId pseudo-parameter instead.
+ */
+export const hardcodedProjectRule = {
+    id: "WGC001",
+    severity: "warning",
+    category: "security",
+    description: "Detects hardcoded GCP project IDs — use GCP.ProjectId pseudo-parameter instead",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        // GCP project ID pattern: lowercase letters, digits, hyphens, 6-30 chars
+        // We look for strings in annotation contexts like "cnrm.cloud.google.com/project-id"
+        const projectIdPattern = /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/;
+        // Common false positives
+        const falsePositives = new Set([
+            "chant", "default", "kube-system", "kube-public", "kube-node-lease",
+            "config-connector", "cnrm-system", "my-project",
+        ]);
+        function visit(node) {
+            if (ts.isPropertyAssignment(node) || ts.isPropertyDeclaration(node)) {
+                const propName = node.name?.getText(sourceFile) ?? "";
+                // Only flag project-id annotation values
+                if (propName.includes("project-id") || propName.includes("projectId") || propName === '"cnrm.cloud.google.com/project-id"') {
+                    const initializer = ts.isPropertyAssignment(node) ? node.initializer : undefined;
+                    if (initializer && ts.isStringLiteral(initializer)) {
+                        const value = initializer.text;
+                        if (projectIdPattern.test(value) && !falsePositives.has(value)) {
+                            const { line, character } = sourceFile.getLineAndCharacterOfPosition(initializer.getStart());
+                            diagnostics.push({
+                                file: sourceFile.fileName,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "WGC001",
+                                severity: "warning",
+                                message: `Hardcoded project ID "${value}" detected. Use GCP.ProjectId pseudo-parameter instead.`,
+                            });
+                        }
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/hardcoded-region.js

@@ -0,0 +1,51 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WGC002: Hardcoded GCP Region/Zone
+ *
+ * Detects hardcoded GCP region and zone strings in code.
+ * Regions/zones should use GCP.Region or GCP.Zone pseudo-parameters instead.
+ */
+export const hardcodedRegionRule = {
+    id: "WGC002",
+    severity: "warning",
+    category: "security",
+    description: "Detects hardcoded GCP region/zone strings — use GCP.Region/GCP.Zone pseudo-parameters instead",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        // GCP region pattern: continent-direction[N] (e.g., us-central1, europe-west4)
+        const regionPattern = /^(us|europe|asia|australia|southamerica|northamerica|me|africa)-(central|east|west|south|north|northeast|southeast|southwest|northwest)\d+$/;
+        // GCP zone pattern: region-[a-f] (e.g., us-central1-a)
+        const zonePattern = /^(us|europe|asia|australia|southamerica|northamerica|me|africa)-(central|east|west|south|north|northeast|southeast|southwest|northwest)\d+-[a-f]$/;
+        function visit(node) {
+            if (ts.isStringLiteral(node)) {
+                const value = node.text;
+                if (zonePattern.test(value)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "WGC002",
+                        severity: "warning",
+                        message: `Hardcoded zone "${value}" detected. Use GCP.Zone pseudo-parameter instead.`,
+                    });
+                }
+                else if (regionPattern.test(value)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "WGC002",
+                        severity: "warning",
+                        message: `Hardcoded region "${value}" detected. Use GCP.Region pseudo-parameter instead.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/index.js

@@ -0,0 +1,3 @@
+export { hardcodedProjectRule } from "./hardcoded-project.js";
+export { hardcodedRegionRule } from "./hardcoded-region.js";
+export { publicIamRule } from "./public-iam.js";

package/dist/lint/rules/public-iam.js

@@ -0,0 +1,37 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * WGC003: Public IAM Binding
+ *
+ * Warns on allUsers or allAuthenticatedUsers IAM bindings,
+ * which grant public access to GCP resources.
+ */
+export const publicIamRule = {
+    id: "WGC003",
+    severity: "warning",
+    category: "security",
+    description: "Warns on allUsers/allAuthenticatedUsers IAM members — grants public access",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        const publicMembers = new Set(["allUsers", "allAuthenticatedUsers"]);
+        function visit(node) {
+            if (ts.isStringLiteral(node)) {
+                const value = node.text;
+                if (publicMembers.has(value)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart());
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "WGC003",
+                        severity: "warning",
+                        message: `Public IAM member "${value}" detected. This grants access to everyone${value === "allAuthenticatedUsers" ? " with a Google account" : " on the internet"}.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lsp/completions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEvE"}
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF,wBAAgB,cAAc,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEvE"}

package/dist/lsp/completions.js

@@ -0,0 +1,15 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconCompletions } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-gcp.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+export function gcpCompletions(ctx) {
+    return lexiconCompletions(ctx, getIndex(), "GCP Config Connector resource");
+}

package/dist/lsp/hover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAqB1E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEjE"}
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAqB1E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAEjE"}

package/dist/lsp/hover.js

@@ -0,0 +1,46 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconHover } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-gcp.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+export function gcpHover(ctx) {
+    return lexiconHover(ctx, getIndex(), resourceHover);
+}
+function resourceHover(className, entry) {
+    const lines = [];
+    const gcpEntry = entry;
+    lines.push(`**${className}**`);
+    lines.push("");
+    lines.push(`GCP Config Connector resource: \`${entry.resourceType}\``);
+    if (gcpEntry.apiVersion) {
+        lines.push(`API Version: \`${gcpEntry.apiVersion}\``);
+    }
+    if (gcpEntry.gvkKind) {
+        lines.push(`Kind: \`${gcpEntry.gvkKind}\``);
+    }
+    const customAttrs = Object.entries(entry.attrs ?? {})
+        .filter(([k]) => k !== "apiVersion" && k !== "kind" && k !== "name" && k !== "namespace" && k !== "uid");
+    if (customAttrs.length > 0) {
+        lines.push("");
+        lines.push("**Attributes:**");
+        for (const [key, value] of customAttrs) {
+            lines.push(`- \`${key}\` → \`${value}\``);
+        }
+    }
+    // Link to Config Connector docs
+    const parts = entry.resourceType.split("::");
+    if (parts.length >= 3) {
+        const service = parts[1].toLowerCase();
+        const kind = parts[2].toLowerCase();
+        lines.push("");
+        lines.push(`[Config Connector docs](https://cloud.google.com/config-connector/docs/reference/resource-docs/${service}/${service}${kind})`);
+    }
+    return { contents: lines.join("\n") };
+}