@intentius/chant-lexicon-gcp 0.124.31 → 0.124.33

package/dist/lint/post-synth/gcp-helpers.js

@@ -0,0 +1,91 @@
+/**
+ * Shared helpers for GCP Config Connector post-synthesis lint rules.
+ *
+ * Provides YAML parsing for multi-document Config Connector manifests
+ * and accessor utilities for common manifest fields.
+ */
+import { parseYAML } from "@intentius/chant/yaml";
+export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+/**
+ * Split a multi-document YAML string on `---` boundaries and parse each
+ * document into a GcpManifest.
+ */
+export function parseGcpManifests(yaml) {
+    const documents = yaml.split(/^---\s*$/m);
+    const manifests = [];
+    for (const doc of documents) {
+        const trimmed = doc.trim();
+        if (trimmed === "" || trimmed === "---")
+            continue;
+        try {
+            const parsed = parseYAML(trimmed);
+            if (typeof parsed === "object" && parsed !== null) {
+                manifests.push(parsed);
+            }
+        }
+        catch {
+            // Skip unparseable documents
+        }
+    }
+    return manifests;
+}
+/**
+ * Check if a manifest is a Config Connector resource
+ * (apiVersion contains cnrm.cloud.google.com).
+ */
+export function isConfigConnectorResource(manifest) {
+    return typeof manifest.apiVersion === "string" &&
+        manifest.apiVersion.includes("cnrm.cloud.google.com");
+}
+/**
+ * Safely extract the spec from a manifest.
+ */
+export function getSpec(manifest) {
+    return manifest.spec ?? undefined;
+}
+/**
+ * Safely extract annotations from a manifest's metadata.
+ */
+export function getAnnotations(manifest) {
+    return manifest.metadata?.annotations ?? undefined;
+}
+/**
+ * Get the resource name from metadata.
+ */
+export function getResourceName(manifest) {
+    return manifest.metadata?.name ?? "unknown";
+}
+/**
+ * Recursively walk a spec object looking for keys ending in `Ref`
+ * (e.g. `networkRef`, `topicRef`, `clusterRef`) that have a `name`
+ * sub-field. Returns the set of referenced names.
+ *
+ * Skips `external` refs (cross-project references outside the template).
+ */
+export function findResourceRefs(obj) {
+    const refs = new Set();
+    walkForRefs(obj, refs);
+    return refs;
+}
+function walkForRefs(value, refs) {
+    if (value === null || value === undefined)
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            walkForRefs(item, refs);
+        }
+        return;
+    }
+    if (typeof value === "object") {
+        const obj = value;
+        for (const [key, val] of Object.entries(obj)) {
+            if (key.endsWith("Ref") && typeof val === "object" && val !== null) {
+                const refObj = val;
+                if (typeof refObj.name === "string" && !refObj.external) {
+                    refs.add(refObj.name);
+                }
+            }
+            walkForRefs(val, refs);
+        }
+    }
+}

package/dist/lint/post-synth/index.js

@@ -0,0 +1,54 @@
+import { wgc101 } from "./wgc101.js";
+import { wgc102 } from "./wgc102.js";
+import { wgc103 } from "./wgc103.js";
+import { wgc104 } from "./wgc104.js";
+import { wgc105 } from "./wgc105.js";
+import { wgc106 } from "./wgc106.js";
+import { wgc107 } from "./wgc107.js";
+import { wgc108 } from "./wgc108.js";
+import { wgc109 } from "./wgc109.js";
+import { wgc110 } from "./wgc110.js";
+import { wgc111 } from "./wgc111.js";
+import { wgc112 } from "./wgc112.js";
+import { wgc113 } from "./wgc113.js";
+import { wgc201 } from "./wgc201.js";
+import { wgc202 } from "./wgc202.js";
+import { wgc203 } from "./wgc203.js";
+import { wgc204 } from "./wgc204.js";
+import { wgc301 } from "./wgc301.js";
+import { wgc302 } from "./wgc302.js";
+import { wgc303 } from "./wgc303.js";
+import { wgc401 } from "./wgc401.js";
+import { wgc402 } from "./wgc402.js";
+import { wgc403 } from "./wgc403.js";
+import { wgc501 } from "./wgc501.js";
+import { wgc502 } from "./wgc502.js";
+import { wgc503 } from "./wgc503.js";
+export const postSynthChecks = [
+    wgc101,
+    wgc102,
+    wgc103,
+    wgc104,
+    wgc105,
+    wgc106,
+    wgc107,
+    wgc108,
+    wgc109,
+    wgc110,
+    wgc111,
+    wgc112,
+    wgc113,
+    wgc201,
+    wgc202,
+    wgc203,
+    wgc204,
+    wgc301,
+    wgc302,
+    wgc303,
+    wgc401,
+    wgc402,
+    wgc403,
+    wgc501,
+    wgc502,
+    wgc503,
+];

package/dist/lint/post-synth/schema-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-registry.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/schema-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAUD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAoB/D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAiBxD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAavF"}
+{"version":3,"file":"schema-registry.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/schema-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAUD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAoB/D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAiBxD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAavF"}

package/dist/lint/post-synth/schema-registry.js

@@ -0,0 +1,69 @@
+/**
+ * Schema registry for GCP Config Connector resources.
+ *
+ * Loads lexicon-gcp.json and builds a lookup from CRD kind to field schema,
+ * used by post-synth rules to validate YAML against known CRD schemas.
+ */
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+let cachedRegistry = null;
+/**
+ * Get the schema registry: Map<gvkKind, ResourceSchema>.
+ */
+export function getSchemaRegistry() {
+    if (cachedRegistry)
+        return cachedRegistry;
+    cachedRegistry = new Map();
+    try {
+        // Built lazily (not at module load) so importing this module stays edge-safe:
+        // `createRequire(import.meta.url)` throws where import.meta.url is undefined
+        // (bundled Workers); there it's caught here and the registry is just empty.
+        const require = createRequire(moduleSourceUrl(import.meta.url));
+        const lexicon = require("../../generated/lexicon-gcp.json");
+        for (const entry of Object.values(lexicon)) {
+            if (entry.kind === "resource" && entry.gvkKind && entry.schema) {
+                cachedRegistry.set(entry.gvkKind, entry.schema);
+            }
+        }
+    }
+    catch {
+        // Lexicon JSON not yet generated — return empty registry
+    }
+    return cachedRegistry;
+}
+/**
+ * Levenshtein distance between two strings.
+ */
+export function levenshtein(a, b) {
+    const m = a.length;
+    const n = b.length;
+    const dp = Array.from({ length: m + 1 }, () => Array(n + 1).fill(0));
+    for (let i = 0; i <= m; i++)
+        dp[i][0] = i;
+    for (let j = 0; j <= n; j++)
+        dp[0][j] = j;
+    for (let i = 1; i <= m; i++) {
+        for (let j = 1; j <= n; j++) {
+            dp[i][j] = a[i - 1] === b[j - 1]
+                ? dp[i - 1][j - 1]
+                : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
+        }
+    }
+    return dp[m][n];
+}
+/**
+ * Find the closest field name by Levenshtein distance.
+ * Returns the suggestion if distance ≤ 3, otherwise undefined.
+ */
+export function suggestField(unknown, knownFields) {
+    let best;
+    let bestDist = 4; // threshold
+    for (const field of knownFields) {
+        const dist = levenshtein(unknown.toLowerCase(), field.toLowerCase());
+        if (dist < bestDist) {
+            bestDist = dist;
+            best = field;
+        }
+    }
+    return best;
+}

package/dist/lint/post-synth/wgc101.js

@@ -0,0 +1,47 @@
+/**
+ * WGC101: Missing encryption on StorageBucket or SQLInstance
+ */
+import { parseYAML } from "@intentius/chant/yaml";
+export const wgc101 = {
+    id: "WGC101",
+    description: "StorageBucket or SQLInstance without encryption configuration",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const documents = output.split(/^---\s*$/m).filter((d) => d.trim().length > 0);
+            for (const docStr of documents) {
+                const doc = parseYAML(docStr);
+                if (!doc)
+                    continue;
+                const kind = doc.kind;
+                const metadata = doc.metadata;
+                const spec = doc.spec;
+                const name = metadata?.name ?? "unknown";
+                if (kind === "StorageBucket" && spec && !spec.encryption) {
+                    diagnostics.push({
+                        checkId: "WGC101",
+                        severity: "warning",
+                        message: `StorageBucket "${name}" has no encryption configuration — consider adding spec.encryption.kmsKeyRef`,
+                        entity: name,
+                        lexicon: "gcp",
+                    });
+                }
+                if (kind === "SQLInstance" && spec) {
+                    const settings = spec.settings;
+                    if (!settings?.ipConfiguration || !settings.backupConfiguration) {
+                        diagnostics.push({
+                            checkId: "WGC101",
+                            severity: "warning",
+                            message: `SQLInstance "${name}" may be missing encryption or backup configuration`,
+                            entity: name,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc102.js

@@ -0,0 +1,29 @@
+/**
+ * WGC102: Public IAM in serialized output
+ */
+export const wgc102 = {
+    id: "WGC102",
+    description: "allUsers/allAuthenticatedUsers detected in serialized Config Connector YAML",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const lines = output.split("\n");
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (line.includes("allUsers") || line.includes("allAuthenticatedUsers")) {
+                    const member = line.includes("allUsers") ? "allUsers" : "allAuthenticatedUsers";
+                    diagnostics.push({
+                        checkId: "WGC102",
+                        severity: "warning",
+                        message: `Public IAM member "${member}" found in output (line ${i + 1}) — this grants public access`,
+                        entity: `line:${i + 1}`,
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc103.js

@@ -0,0 +1,37 @@
+/**
+ * WGC103: Missing project annotation
+ */
+import { parseYAML } from "@intentius/chant/yaml";
+export const wgc103 = {
+    id: "WGC103",
+    description: "Config Connector resource without cnrm.cloud.google.com/project-id annotation",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const documents = output.split(/^---\s*$/m).filter((d) => d.trim().length > 0);
+            for (const docStr of documents) {
+                const doc = parseYAML(docStr);
+                if (!doc)
+                    continue;
+                const apiVersion = doc.apiVersion;
+                if (!apiVersion?.includes("cnrm.cloud.google.com"))
+                    continue;
+                const metadata = doc.metadata;
+                const annotations = metadata?.annotations;
+                const name = metadata?.name ?? "unknown";
+                if (!annotations?.["cnrm.cloud.google.com/project-id"]) {
+                    diagnostics.push({
+                        checkId: "WGC103",
+                        severity: "info",
+                        message: `Resource "${name}" has no cnrm.cloud.google.com/project-id annotation — will use namespace default`,
+                        entity: name,
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc104.js

@@ -0,0 +1,34 @@
+/**
+ * WGC104: Missing uniform bucket-level access
+ */
+import { parseYAML } from "@intentius/chant/yaml";
+export const wgc104 = {
+    id: "WGC104",
+    description: "StorageBucket without uniformBucketLevelAccess enabled",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const documents = output.split(/^---\s*$/m).filter((d) => d.trim().length > 0);
+            for (const docStr of documents) {
+                const doc = parseYAML(docStr);
+                if (!doc || doc.kind !== "StorageBucket")
+                    continue;
+                const metadata = doc.metadata;
+                const spec = doc.spec;
+                const name = metadata?.name ?? "unknown";
+                if (spec && spec.uniformBucketLevelAccess !== true) {
+                    diagnostics.push({
+                        checkId: "WGC104",
+                        severity: "warning",
+                        message: `StorageBucket "${name}" does not have uniformBucketLevelAccess enabled — recommended for consistent access control`,
+                        entity: name,
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc105.js

@@ -0,0 +1,39 @@
+/**
+ * WGC105: Public Cloud SQL — authorizedNetworks with 0.0.0.0/0
+ */
+import { parseGcpManifests, getSpec, getResourceName } from "./gcp-helpers.js";
+export const wgc105 = {
+    id: "WGC105",
+    description: "Cloud SQL instance with public 0.0.0.0/0 in authorizedNetworks",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "SQLInstance")
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const settings = spec.settings;
+                const ipConfig = settings?.ipConfiguration;
+                const networks = ipConfig?.authorizedNetworks;
+                if (Array.isArray(networks)) {
+                    for (const net of networks) {
+                        if (net.value === "0.0.0.0/0") {
+                            diagnostics.push({
+                                checkId: "WGC105",
+                                severity: "warning",
+                                message: `SQLInstance "${getResourceName(manifest)}" allows connections from 0.0.0.0/0 — this exposes the database to the public internet`,
+                                entity: getResourceName(manifest),
+                                lexicon: "gcp",
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc106.js

@@ -0,0 +1,30 @@
+/**
+ * WGC106: Missing deletion policy annotation
+ */
+import { parseGcpManifests, isConfigConnectorResource, getAnnotations, getResourceName } from "./gcp-helpers.js";
+export const wgc106 = {
+    id: "WGC106",
+    description: "Config Connector resource without cnrm.cloud.google.com/deletion-policy annotation",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const annotations = getAnnotations(manifest);
+                if (!annotations?.["cnrm.cloud.google.com/deletion-policy"]) {
+                    diagnostics.push({
+                        checkId: "WGC106",
+                        severity: "info",
+                        message: `Resource "${getResourceName(manifest)}" has no deletion-policy annotation — defaults to "delete" which removes the GCP resource on kubectl delete`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc107.js

@@ -0,0 +1,33 @@
+/**
+ * WGC107: StorageBucket missing versioning
+ */
+import { parseGcpManifests, getSpec, getResourceName } from "./gcp-helpers.js";
+export const wgc107 = {
+    id: "WGC107",
+    description: "StorageBucket without versioning enabled",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "StorageBucket")
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const versioning = spec.versioning;
+                if (!versioning || versioning.enabled !== true) {
+                    diagnostics.push({
+                        checkId: "WGC107",
+                        severity: "info",
+                        message: `StorageBucket "${getResourceName(manifest)}" does not have versioning enabled — consider enabling for data protection`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc108.js

@@ -0,0 +1,34 @@
+/**
+ * WGC108: SQLInstance missing backup configuration
+ */
+import { parseGcpManifests, getSpec, getResourceName } from "./gcp-helpers.js";
+export const wgc108 = {
+    id: "WGC108",
+    description: "SQLInstance without backup configuration enabled",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "SQLInstance")
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const settings = spec.settings;
+                const backupConfig = settings?.backupConfiguration;
+                if (!backupConfig || backupConfig.enabled !== true) {
+                    diagnostics.push({
+                        checkId: "WGC108",
+                        severity: "warning",
+                        message: `SQLInstance "${getResourceName(manifest)}" does not have backup configuration enabled — data loss risk`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc109.js

@@ -0,0 +1,33 @@
+/**
+ * WGC109: ComputeFirewall allowing all sources (0.0.0.0/0)
+ */
+import { parseGcpManifests, getSpec, getResourceName } from "./gcp-helpers.js";
+export const wgc109 = {
+    id: "WGC109",
+    description: "ComputeFirewall with sourceRanges containing 0.0.0.0/0",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "ComputeFirewall")
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                const sourceRanges = spec.sourceRanges;
+                if (Array.isArray(sourceRanges) && sourceRanges.includes("0.0.0.0/0")) {
+                    diagnostics.push({
+                        checkId: "WGC109",
+                        severity: "warning",
+                        message: `ComputeFirewall "${getResourceName(manifest)}" allows traffic from 0.0.0.0/0 — this opens the firewall to the entire internet`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc110.js

@@ -0,0 +1,32 @@
+/**
+ * WGC110: KMS CryptoKey missing rotation period
+ */
+import { parseGcpManifests, getSpec, getResourceName } from "./gcp-helpers.js";
+export const wgc110 = {
+    id: "WGC110",
+    description: "KMS CryptoKey without rotation period configured",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            for (const manifest of parseGcpManifests(output)) {
+                if (manifest.kind !== "KMSCryptoKey")
+                    continue;
+                const spec = getSpec(manifest);
+                if (!spec)
+                    continue;
+                if (!spec.rotationPeriod) {
+                    diagnostics.push({
+                        checkId: "WGC110",
+                        severity: "warning",
+                        message: `KMSCryptoKey "${getResourceName(manifest)}" has no rotation period configured — consider setting rotationPeriod for key hygiene`,
+                        entity: getResourceName(manifest),
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc111.js

@@ -0,0 +1,47 @@
+/**
+ * WGC111: Dangling resource reference
+ *
+ * Checks that every `resourceRef.name` in a Config Connector resource's spec
+ * references a `metadata.name` that exists in the output.
+ */
+import { parseGcpManifests, isConfigConnectorResource, getResourceName, findResourceRefs } from "./gcp-helpers.js";
+export const wgc111 = {
+    id: "WGC111",
+    description: "Resource reference points to a name not defined in the output",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            // Collect all defined resource names
+            const definedNames = new Set();
+            for (const manifest of manifests) {
+                if (isConfigConnectorResource(manifest)) {
+                    const name = manifest.metadata?.name;
+                    if (name)
+                        definedNames.add(name);
+                }
+            }
+            // Check each resource's refs
+            for (const manifest of manifests) {
+                if (!isConfigConnectorResource(manifest))
+                    continue;
+                const resourceName = getResourceName(manifest);
+                const refs = findResourceRefs(manifest.spec);
+                for (const refName of refs) {
+                    if (!definedNames.has(refName)) {
+                        diagnostics.push({
+                            checkId: "WGC111",
+                            severity: "warning",
+                            message: `Resource "${resourceName}" references "${refName}" via resourceRef, but no resource with that metadata.name exists in the output`,
+                            entity: resourceName,
+                            lexicon: "gcp",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/wgc112.js

@@ -0,0 +1,46 @@
+/**
+ * WGC112: Missing or invalid apiVersion
+ *
+ * Every Config Connector resource must have an apiVersion matching
+ * `<service>.cnrm.cloud.google.com/v<version>`.
+ */
+import { parseGcpManifests, getResourceName } from "./gcp-helpers.js";
+const VALID_API_VERSION = /^[a-z]+\.cnrm\.cloud\.google\.com\/v\d+(?:alpha\d+|beta\d+)?$/;
+export const wgc112 = {
+    id: "WGC112",
+    description: "Config Connector resource has missing or invalid apiVersion",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            if (typeof output !== "string")
+                continue;
+            const manifests = parseGcpManifests(output);
+            for (const manifest of manifests) {
+                // Only check resources that look like Config Connector (have a kind)
+                if (!manifest.kind)
+                    continue;
+                const resourceName = getResourceName(manifest);
+                if (!manifest.apiVersion) {
+                    diagnostics.push({
+                        checkId: "WGC112",
+                        severity: "error",
+                        message: `Resource "${resourceName}" (kind: ${manifest.kind}) is missing apiVersion`,
+                        entity: resourceName,
+                        lexicon: "gcp",
+                    });
+                    continue;
+                }
+                if (!VALID_API_VERSION.test(manifest.apiVersion)) {
+                    diagnostics.push({
+                        checkId: "WGC112",
+                        severity: "error",
+                        message: `Resource "${resourceName}" has invalid apiVersion "${manifest.apiVersion}" — expected format: <service>.cnrm.cloud.google.com/v<version>`,
+                        entity: resourceName,
+                        lexicon: "gcp",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};