@intentius/chant-lexicon-gcp 0.124.31 → 0.124.33

package/dist/generated/runtime.js

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/dist/governance.js

@@ -0,0 +1,98 @@
+/**
+ * GCP governance authoring: the desired-state config
+ * shape an external governance reconciler reconciles, and `landingZoneConfig()` — the
+ * typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven folder tree walker cannot be one. The split mirrors the AWS
+ * slice (lexicons/aws/src/governance.ts): authoring emits config (this
+ * module, arbitrary cardinality); resources for greenfield bootstrap are the
+ * fixed-shape composites in `composites/landing-zone.ts`; the reconciler
+ * consumes only the config.
+ *
+ * GCP has no OrganizationRoot analog — organizations are created through
+ * Cloud Identity / Workspace, never through the resource API.
+ */
+// ---------------------------------------------------------------------------
+// Baseline guardrails (shared with the bootstrap composites)
+// ---------------------------------------------------------------------------
+export const DISABLE_SA_KEY_CREATION = {
+    description: "User-managed service account keys cannot be created.",
+    constraint: "iam.disableServiceAccountKeyCreation",
+    rules: [{ enforce: "TRUE" }],
+};
+export const SKIP_DEFAULT_NETWORK = {
+    description: "New projects do not get the auto-mode default VPC.",
+    constraint: "compute.skipDefaultNetworkCreation",
+    rules: [{ enforce: "TRUE" }],
+};
+/** Allow resource creation only in `locations` (value-group syntax like "in:us-locations" works too). */
+export function resourceLocationRestriction(locations) {
+    return {
+        description: `Resources may only be created in [${locations.join(", ")}].`,
+        constraint: "gcp.resourceLocations",
+        rules: [{ values: { allowedValues: [...locations] } }],
+    };
+}
+/** The audit-log coverage `auditAllServices` declares. */
+export const AUDIT_ALL_SERVICES = {
+    service: "allServices",
+    logTypes: ["ADMIN_READ", "DATA_READ", "DATA_WRITE"],
+};
+/**
+ * The recommended foundation folder structure. Exported so callers can
+ * extend it rather than restate it.
+ */
+export const FOUNDATION_FOLDERS = {
+    Security: {},
+    Infrastructure: {},
+    Sandbox: {},
+    Workloads: {},
+};
+/**
+ * Author the desired-state tree an external governance reconciler reconciles. Pure.
+ * Throws when the tree attaches an org-policy name with no definition; only
+ * policies the tree actually attaches are included in the output.
+ */
+export function landingZoneConfig(props = {}) {
+    const foundation = props.foundation ?? true;
+    const orgPolicies = {
+        ...(foundation
+            ? { "disable-sa-key-creation": DISABLE_SA_KEY_CREATION, "skip-default-network": SKIP_DEFAULT_NETWORK }
+            : {}),
+        ...(props.allowedLocations?.length
+            ? { "resource-location-restriction": resourceLocationRestriction(props.allowedLocations) }
+            : {}),
+        ...props.orgPolicies,
+    };
+    const folders = { ...(foundation ? FOUNDATION_FOLDERS : {}), ...props.folders };
+    const rootOrgPolicies = [
+        ...(foundation ? ["disable-sa-key-creation", "skip-default-network"] : []),
+        ...(props.allowedLocations?.length ? ["resource-location-restriction"] : []),
+        ...(props.rootOrgPolicies ?? []),
+    ];
+    const attached = new Set(rootOrgPolicies);
+    const collect = (tree) => {
+        for (const node of Object.values(tree)) {
+            for (const p of node.orgPolicies ?? [])
+                attached.add(p);
+            if (node.children)
+                collect(node.children);
+        }
+    };
+    collect(folders);
+    for (const name of attached) {
+        if (!orgPolicies[name]) {
+            throw new Error(`landingZoneConfig: org policy "${name}" is attached but not defined in orgPolicies`);
+        }
+    }
+    return {
+        organization: rootOrgPolicies.length ? { orgPolicies: rootOrgPolicies } : {},
+        folders,
+        orgPolicies: Object.fromEntries(Object.entries(orgPolicies).filter(([n]) => attached.has(n))),
+        ...(props.auditAllServices
+            ? { auditSinks: { auditConfig: { service: AUDIT_ALL_SERVICES.service, logTypes: [...AUDIT_ALL_SERVICES.logTypes] } } }
+            : {}),
+    };
+}

package/dist/health.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Runtime health for GCP (#4177): Cloud Run services.
+ *
+ * A Cloud Run v2 service carries its `Ready` condition as `terminalCondition`
+ * (`CONDITION_SUCCEEDED`, `CONDITION_FAILED`, pending or reconciling). The v1
+ * and Config Connector shape carries it in `status.conditions` with
+ * `status: "True" | "False" | "Unknown"`; both are read. Same transport,
+ * project resolution and endpoint rule as `describe-resources.ts`, so
+ * `GCP_ENDPOINT_URL` (floci-gcp) answers.
+ */
+import type { HealthEntry, HealthReadOptions, HealthReadResult } from "@intentius/chant/lexicon";
+import { type GcpReadHttp } from "./api/read-client.js";
+export declare const GCP_HEALTH_TYPES: readonly ["GCP::Run::Service"];
+export interface GcpHealthOptions extends HealthReadOptions {
+    http?: GcpReadHttp;
+    now?: () => Date;
+}
+interface Condition {
+    type?: string;
+    state?: string;
+    status?: string;
+    reason?: string;
+    message?: string;
+    lastTransitionTime?: string;
+}
+/** The parts of a Cloud Run service body that decide health. */
+export interface CloudRunServiceState {
+    terminalCondition?: Condition;
+    conditions?: Condition[];
+    reconciling?: boolean;
+    latestReadyRevision?: string;
+    uri?: string;
+    status?: {
+        conditions?: Condition[];
+        url?: string;
+    };
+}
+/** The `Ready` condition's verdict. No condition at all is `unknown`. */
+export declare function cloudRunEntry(body: CloudRunServiceState, observedAt: string): HealthEntry;
+export declare function observeHealthGcp(options: GcpHealthOptions): Promise<HealthReadResult>;
+export {};
+//# sourceMappingURL=health.d.ts.map

package/dist/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AACnH,OAAO,EAAyC,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAG5F,eAAO,MAAM,gBAAgB,YAAI,mBAAmB,CAAU,CAAC;AAE/D,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,UAAU,SAAS;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,gEAAgE;AAChE,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAOD,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAqBzF;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoD3F"}

package/dist/health.js

@@ -0,0 +1,87 @@
+/**
+ * Runtime health for GCP (#4177): Cloud Run services.
+ *
+ * A Cloud Run v2 service carries its `Ready` condition as `terminalCondition`
+ * (`CONDITION_SUCCEEDED`, `CONDITION_FAILED`, pending or reconciling). The v1
+ * and Config Connector shape carries it in `status.conditions` with
+ * `status: "True" | "False" | "Unknown"`; both are read. Same transport,
+ * project resolution and endpoint rule as `describe-resources.ts`, so
+ * `GCP_ENDPOINT_URL` (floci-gcp) answers.
+ */
+import { getResource, GcpReadError, isNotFound } from "./api/read-client.js";
+import { deriveGVK, manifestProjectAnnotations, resolveReadProject } from "./describe-resources.js";
+export const GCP_HEALTH_TYPES = ["GCP::Run::Service"];
+function readyCondition(body) {
+    if (body.terminalCondition && (body.terminalCondition.type ?? "Ready") === "Ready")
+        return body.terminalCondition;
+    return body.conditions?.find((c) => c.type === "Ready") ?? body.status?.conditions?.find((c) => c.type === "Ready");
+}
+/** The `Ready` condition's verdict. No condition at all is `unknown`. */
+export function cloudRunEntry(body, observedAt) {
+    const type = "GCP::Run::Service";
+    const ready = readyCondition(body);
+    if (!ready)
+        return { type, state: "unknown", detail: "no Ready condition", observedAt };
+    const value = (ready.state ?? ready.status ?? "").toUpperCase();
+    const state = value === "CONDITION_SUCCEEDED" || value === "TRUE"
+        ? "healthy"
+        : value === "CONDITION_FAILED" || value === "FALSE"
+            ? "unhealthy"
+            : "unknown";
+    const why = ready.message || ready.reason;
+    const revision = body.latestReadyRevision ? `, latest ready ${body.latestReadyRevision.split("/").pop()}` : "";
+    const reconciling = body.reconciling ? ", reconciling" : "";
+    return {
+        type,
+        state,
+        detail: `Ready ${ready.state ?? ready.status ?? "unset"}${why ? `: ${why}` : ""}${revision}${reconciling}`,
+        observedAt,
+        ...(ready.lastTransitionTime ? { checkedAt: ready.lastTransitionTime } : {}),
+    };
+}
+export async function observeHealthGcp(options) {
+    const observedAt = (options.now?.() ?? new Date()).toISOString();
+    const endpoint = process.env.GCP_ENDPOINT_URL;
+    const manifestProjects = manifestProjectAnnotations(options.buildOutput);
+    const entities = {};
+    const unobserved = {};
+    const absent = [];
+    await Promise.all([...options.entities].map(async ([entityName, { entityType, props }]) => {
+        const gvk = deriveGVK(entityType);
+        const metadata = props.metadata;
+        const name = metadata?.name;
+        if (!gvk || !name) {
+            unobserved[entityName] = {
+                type: entityType,
+                reason: "read-failed",
+                detail: gvk ? "declared entity has no metadata.name to query by" : `cannot derive a GCP kind from ${entityType}`,
+            };
+            return;
+        }
+        let project;
+        try {
+            project = resolveReadProject(gvk.kind, name, metadata, manifestProjects);
+        }
+        catch (err) {
+            unobserved[entityName] = { type: entityType, reason: "no-binding", detail: err instanceof Error ? err.message : String(err) };
+            return;
+        }
+        try {
+            const body = await getResource({ project, ...(endpoint ? { endpoint } : {}), ...(options.http ? { http: options.http } : {}) }, gvk.kind, name, props);
+            entities[entityName] = cloudRunEntry(body, observedAt);
+        }
+        catch (err) {
+            if (isNotFound(err)) {
+                absent.push(entityName);
+                return;
+            }
+            const status = err instanceof GcpReadError ? err.status : undefined;
+            unobserved[entityName] = {
+                type: entityType,
+                reason: status === 401 || status === 403 ? "no-credentials" : "read-failed",
+                detail: (err instanceof Error ? err.message : String(err)).slice(0, 200),
+            };
+        }
+    }));
+    return { entities, unobserved, absent };
+}

package/dist/import/generator.js

@@ -0,0 +1,68 @@
+/**
+ * Config Connector TypeScript generator.
+ *
+ * Converts import IR from the parser into typed chant TypeScript code.
+ */
+export class GcpGenerator {
+    generate(ir) {
+        const lines = [];
+        const imports = new Set();
+        // Collect imports
+        for (const resource of ir.resources) {
+            const parts = resource.type.split("::");
+            if (parts.length >= 3) {
+                // Use the short name for the import
+                imports.add(parts[2]);
+            }
+        }
+        if (imports.size > 0) {
+            lines.push(`import { ${[...imports].sort().join(", ")} } from "@intentius/chant-lexicon-gcp";`);
+            lines.push("");
+        }
+        // Generate resource declarations
+        for (const resource of ir.resources) {
+            const parts = resource.type.split("::");
+            const className = parts.length >= 3 ? parts[2] : resource.type;
+            const varName = camelCase(resource.logicalId);
+            lines.push(`export const ${varName} = new ${className}(${formatProps(resource.properties, 0)});`);
+            lines.push("");
+        }
+        return [{ path: "main.ts", content: lines.join("\n") + "\n" }];
+    }
+}
+function camelCase(str) {
+    return str
+        .replace(/[-_](.)/g, (_, c) => c.toUpperCase())
+        .replace(/^(.)/, (_, c) => c.toLowerCase());
+}
+function formatProps(props, indent) {
+    const entries = Object.entries(props);
+    if (entries.length === 0)
+        return "{}";
+    const pad = "  ".repeat(indent + 1);
+    const closePad = "  ".repeat(indent);
+    const lines = entries.map(([key, value]) => {
+        return `${pad}${key}: ${formatValue(value, indent + 1)},`;
+    });
+    return `{\n${lines.join("\n")}\n${closePad}}`;
+}
+function formatValue(value, indent) {
+    if (value === null || value === undefined)
+        return "undefined";
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    if (Array.isArray(value)) {
+        if (value.length === 0)
+            return "[]";
+        const pad = "  ".repeat(indent + 1);
+        const closePad = "  ".repeat(indent);
+        const items = value.map((v) => `${pad}${formatValue(v, indent + 1)},`);
+        return `[\n${items.join("\n")}\n${closePad}]`;
+    }
+    if (typeof value === "object") {
+        return formatProps(value, indent);
+    }
+    return String(value);
+}

package/dist/import/live-export.js

@@ -0,0 +1,73 @@
+import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
+import { GcpParser } from "./parser.js";
+/** Server-written metadata fields, stripped unless `verbatim`. */
+const SERVER_METADATA_FIELDS = [
+    "managedFields",
+    "uid",
+    "resourceVersion",
+    "generation",
+    "creationTimestamp",
+    "selfLink",
+    "ownerReferences",
+    "finalizers",
+];
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Strip `status` and server-written metadata to reach the declared shape of a
+ * Config Connector object. Config Connector writes back several
+ * `cnrm.cloud.google.com/*` annotations that are not authored config; those are
+ * dropped too. Returns a new object; the input is not mutated.
+ */
+export function stripServerFields(obj) {
+    const clone = JSON.parse(JSON.stringify(obj));
+    delete clone.status;
+    if (isRecord(clone.metadata)) {
+        const md = clone.metadata;
+        for (const f of SERVER_METADATA_FIELDS)
+            delete md[f];
+        if (isRecord(md.annotations)) {
+            for (const key of Object.keys(md.annotations)) {
+                // Config Connector's own bookkeeping annotations, plus the apply
+                // round-trip annotation — none are authored config.
+                if (key.startsWith("cnrm.cloud.google.com/") ||
+                    key === "kubectl.kubernetes.io/last-applied-configuration") {
+                    delete md.annotations[key];
+                }
+            }
+            if (Object.keys(md.annotations).length === 0)
+                delete md.annotations;
+        }
+    }
+    return clone;
+}
+/**
+ * Build full-fidelity export IR from a list of live Config Connector objects
+ * (each live object is already its manifest). Reuses the import GcpParser by
+ * feeding cleaned objects as JSON documents. Pure: all I/O stays in the caller.
+ */
+export function buildExportFromObjects(objects, opts = {}) {
+    const owning = opts.owned
+        ? objects.filter((o) => {
+            if (!isRecord(o))
+                return false;
+            const labels = isRecord(o.metadata) ? o.metadata.labels : undefined;
+            return hasOwnershipMarker(labels, LABEL_OWNERSHIP_KEYS);
+        })
+        : objects;
+    const cleaned = owning
+        .filter(isRecord)
+        .map((o) => (opts.verbatim ? o : stripServerFields(o)));
+    const content = cleaned.map((o) => JSON.stringify(o, null, 2)).join("\n---\n");
+    const ir = new GcpParser().parse(content);
+    const selector = opts.selector;
+    if (!selector || (selector.type === undefined && selector.name === undefined)) {
+        return ir;
+    }
+    return {
+        ...ir,
+        resources: ir.resources.filter((r) => (selector.type === undefined || r.type === selector.type) &&
+            (selector.name === undefined || r.logicalId === selector.name)),
+    };
+}

package/dist/import/parser.js

@@ -0,0 +1,61 @@
+/**
+ * Config Connector YAML template parser.
+ *
+ * Parses Config Connector YAML manifests into the import IR
+ * for conversion to chant TypeScript.
+ */
+import { BaseValueParser } from "@intentius/chant/import/base-parser";
+import { parseYAML } from "@intentius/chant/yaml";
+import { gcpTypeName } from "../spec/parse.js";
+/**
+ * Parser for Config Connector YAML manifests.
+ */
+export class GcpParser extends BaseValueParser {
+    dispatchIntrinsic(_key, _value, _obj) {
+        // Config Connector YAML has no intrinsic functions
+        return null;
+    }
+    parse(input) {
+        const resources = [];
+        const documents = input
+            .split(/^---\s*$/m)
+            .map((d) => d.trim())
+            .filter((d) => d.length > 0);
+        for (const docStr of documents) {
+            const doc = parseYAML(docStr);
+            if (!doc)
+                continue;
+            const apiVersion = doc.apiVersion;
+            const kind = doc.kind;
+            if (!apiVersion || !kind)
+                continue;
+            // Only handle Config Connector resources
+            if (!apiVersion.includes("cnrm.cloud.google.com"))
+                continue;
+            const group = apiVersion.split("/")[0];
+            const typeName = gcpTypeName(group, kind);
+            const metadata = doc.metadata;
+            const spec = doc.spec;
+            const logicalId = metadata?.name ?? kind;
+            // Build properties from spec
+            const properties = {};
+            if (metadata) {
+                properties.metadata = this.parseValue(metadata);
+            }
+            if (spec) {
+                for (const [key, value] of Object.entries(spec)) {
+                    properties[key] = this.parseValue(value);
+                }
+            }
+            resources.push({
+                logicalId,
+                type: typeName,
+                properties,
+            });
+        }
+        return {
+            resources,
+            parameters: [],
+        };
+    }
+}

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotation
 export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
 export { GCP, ProjectId, Region, Zone } from "./pseudo.js";
 export { GcpAnnotations } from "./variables.js";
+export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon-output";
 export * from "./generated/index.js";
 export { GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork, PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject, MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GpuNodePool, GovernanceFoundation, LocationRestriction, OrganizationAuditConfig, } from "./composites/index.js";
 export type { GkeClusterProps, CloudRunServiceProps, CloudSqlInstanceProps, GcsBucketProps, VpcNetworkProps, VpcSubnet, PubSubPipelineProps, CloudFunctionWithTriggerProps, PrivateServiceProps, ManagedCertificateProps, SecureProjectProps, MemorystoreRedisProps, MultiRegionVpcConfig, MultiRegionVpcRegion, GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig, GpuNodePoolProps, GpuNodePoolTaint, GovernanceFoundationProps, LocationRestrictionProps, OrganizationAuditConfigProps, } from "./composites/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7C,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,UAAU,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAC7E,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAC3F,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAC5D,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,GACnE,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EAAE,SAAS,EAC1B,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAAE,oBAAoB,EAC1C,mBAAmB,EAAE,uBAAuB,EAC5C,gBAAgB,EAAE,gBAAgB,EAClC,yBAAyB,EAAE,wBAAwB,EAAE,4BAA4B,GAClF,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,2BAA2B,EAC9C,uBAAuB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,kBAAkB,GACtF,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG9H,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGxH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAIzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,UAAU,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAC7E,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAC3F,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAC5D,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,GACnE,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EAAE,SAAS,EAC1B,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAAE,oBAAoB,EAC1C,mBAAmB,EAAE,uBAAuB,EAC5C,gBAAgB,EAAE,gBAAgB,EAClC,yBAAyB,EAAE,wBAAwB,EAAE,4BAA4B,GAClF,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,2BAA2B,EAC9C,uBAAuB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,kBAAkB,GACtF,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG9H,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGxH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,38 @@
+// Typed Op step-builder wrappers (chant #1288 Stage 2) — gcpApply/gcpDelete/
+// flociGcpUp/flociGcpDown with authoring-time types derived from this
+// lexicon's own *Args interfaces (see ./op/builders.ts's module doc for why
+// these live here rather than in core). Opt-in: `@intentius/chant/op`'s
+// same-named exports are core's original untyped builders, unchanged.
+export { gcpApply, gcpDelete, flociGcpUp, flociGcpDown } from "./op/builders.js";
+// Serializer
+export { gcpSerializer } from "./serializer.js";
+// Plugin
+export { gcpPlugin } from "./plugin.js";
+// Default labels & annotations
+export { defaultLabels, defaultAnnotations, isDefaultLabels, isDefaultAnnotations } from "./default-labels.js";
+export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-labels.js";
+// Pseudo-parameters
+export { GCP, ProjectId, Region, Zone } from "./pseudo.js";
+// Variables / annotation constants
+export { GcpAnnotations } from "./variables.js";
+// Outputs (#4181): the build warns that Config Connector YAML can't carry them.
+export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon-output";
+// Generated entities — export everything from generated index
+// After running `npm run generate`, this re-exports all Config Connector resource classes
+export * from "./generated/index.js";
+// Composites
+export { GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork, PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject, MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GpuNodePool, GovernanceFoundation, LocationRestriction, OrganizationAuditConfig, } from "./composites/index.js";
+// GCP governance authoring: the desired-state config an external governance
+// reconciler applies, and the typed landing-zone authoring layer.
+export { landingZoneConfig, resourceLocationRestriction, DISABLE_SA_KEY_CREATION, SKIP_DEFAULT_NETWORK, AUDIT_ALL_SERVICES, FOUNDATION_FOLDERS, } from "./governance.js";
+// IAM role constants
+export { StorageRoles, ComputeRoles, ContainerRoles, IAMRoles, SQLRoles, RunRoles, PubSubRoles } from "./actions/index.js";
+// Spec utilities (for tooling)
+export { fetchCRDBundle, getCachePath, clearCache, KCC_VERSION } from "./spec/fetch.js";
+export { parseGcpCRD, gcpServiceName, gcpShortName, gcpTypeName, stripServicePrefix } from "./spec/parse.js";
+// Code generation pipeline
+export { generate, writeGeneratedFiles } from "./codegen/generate.js";
+export { packageLexicon } from "./codegen/package.js";
+// LSP providers
+export { gcpCompletions } from "./lsp/completions.js";
+export { gcpHover } from "./lsp/hover.js";

package/dist/integrity.json

@@ -1,14 +1,14 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "f18724bb2524380c0a50809a8605a22da93c4f0bc3bf6e21c964d0a12047b112",
-    "meta.json": "475f10909854d059a2e2d4fb541c058803422e38b9c64bd4d6858c0623eedb8c",
-    "types/index.d.ts": "5433b54c04b57d6fda8f3d81ef92ed0aca87f7e8e5dd3ea92d8de6e62a3ccfab",
+    "manifest.json": "257df817d4b1ad04f71ff75c28b578dcff2a2921fe07100da54974937b645941",
+    "meta.json": "75643660010c044c6f465bef2688a864ab30cc96fd9b68111969749748ac64ca",
+    "types/index.d.ts": "da1ebc6bcf83e1a018a773b59714194aeeb74ae1d5c1252b737b7e730ca98bd5",
     "rules/hardcoded-project.ts": "6d5ae9efa74d73800eebe1a0a0d43c619ee0fdebe3347195df93fcbe63b34f0d",
     "rules/hardcoded-region.ts": "d7f8c48571f37600cb583a08aef7eb07245fbcbdda048874bb074c94c849ae0f",
     "rules/public-iam.ts": "9c43b2d148dba1aea3494983e042d7b038d92a8309173e7e35bb17f6ee21db9e",
     "rules/gcp-helpers.ts": "0420adb73527b29a288e219b24742f4f29ef83859228d61fdaff83b1fb800bf1",
-    "rules/schema-registry.ts": "0d90aa97ca893478b4e0b7ac02fb017786929abd1f241b12c90915bffa8499d8",
+    "rules/schema-registry.ts": "fa9d8e3c1ebee2b95b3385044c7c24c50e71626f5b2936b9412aeb03b0ce7e7a",
     "rules/wgc101.ts": "679f245ea4665d687848382ff1b934ae133a3c320cc051011cc4d95802e66b38",
     "rules/wgc102.ts": "22cb997d40a59ce3e0ff833ce946a5571e13d4811b255d4b67db570d58575e07",
     "rules/wgc103.ts": "589741dbe5828508b5424a74f63f0202ba8452237c366173af283073f81e0317",
@@ -40,5 +40,5 @@
     "skills/chant-gcp-patterns.md": "4c6809fc7c37fa1879379ad4c0e2d114dec9497bc6eb9d1bca4e79fddea4f509",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "1270f8e7a0f06edb9f0547a2a46819139876078a3823cd914ee5ffc619da3dd0"
+  "composite": "2947c3fa4c9b3e3407d761cb6302036cbdc49736886f5bb16407aac326ff42d9"
 }

package/dist/lint/audit-catalog.js

@@ -0,0 +1,38 @@
+/**
+ * The gcp lexicon's `chant audit` catalog — metadata for the WGC* Config
+ * Connector post-synth rules. Contributed via `gcpPlugin.auditCatalog()` (#687).
+ */
+import { auditRule, applyLineage } from "@intentius/chant/audit/catalog";
+import { gcpAuditLineage } from "./audit-lineage.js";
+const GCP_SEC = { name: "Google Cloud — Security best practices", url: "https://cloud.google.com/security/best-practices" };
+export const gcpAuditCatalog = {
+    WGC101: auditRule("WGC101", "merge-worthy", "guidance", "Storage/SQL without encryption configuration", "Configure encryption (e.g. a CMEK key) for data at rest.", { authority: [GCP_SEC] }),
+    WGC102: auditRule("WGC102", "merge-worthy", "guidance", "Public IAM member (allUsers/allAuthenticatedUsers)", "Remove allUsers/allAuthenticatedUsers bindings.", { authority: [GCP_SEC] }),
+    WGC103: auditRule("WGC103", "report-only", "guidance", "Missing project-id annotation", "Add the cnrm.cloud.google.com/project-id annotation.", { category: "best-practice" }),
+    WGC104: auditRule("WGC104", "merge-worthy", "guidance", "Bucket without uniform bucket-level access", "Enable uniformBucketLevelAccess.", { authority: [GCP_SEC] }),
+    WGC105: auditRule("WGC105", "merge-worthy", "guidance", "Cloud SQL open to 0.0.0.0/0", "Restrict authorizedNetworks to known sources.", { authority: [GCP_SEC] }),
+    WGC106: auditRule("WGC106", "report-only", "guidance", "Missing deletion-policy annotation", "Add the cnrm.cloud.google.com/deletion-policy annotation.", { category: "best-practice" }),
+    WGC107: auditRule("WGC107", "report-only", "guidance", "Bucket versioning disabled", "Enable object versioning.", { category: "best-practice" }),
+    WGC108: auditRule("WGC108", "report-only", "guidance", "Cloud SQL backups disabled", "Enable backup configuration.", { category: "best-practice" }),
+    WGC109: auditRule("WGC109", "merge-worthy", "guidance", "Firewall open to 0.0.0.0/0", "Restrict sourceRanges to known sources.", { authority: [GCP_SEC] }),
+    WGC110: auditRule("WGC110", "merge-worthy", "guidance", "KMS key without rotation", "Set a rotationPeriod on the CryptoKey.", { authority: [GCP_SEC] }),
+    WGC111: auditRule("WGC111", "merge-worthy", "guidance", "Reference to an undefined resource", "Point the reference at a resource in the output.", { category: "correctness" }),
+    WGC112: auditRule("WGC112", "merge-worthy", "guidance", "Missing or invalid apiVersion", "Set a valid cnrm.cloud.google.com apiVersion.", { category: "correctness" }),
+    WGC113: auditRule("WGC113", "report-only", "guidance", "Alpha API version", "Move to a beta/GA API version.", { category: "best-practice" }),
+    WGC201: auditRule("WGC201", "report-only", "guidance", "Missing managed-by label", "Add the app.kubernetes.io/managed-by label.", { category: "best-practice" }),
+    WGC202: auditRule("WGC202", "merge-worthy", "guidance", "Cluster without Workload Identity", "Enable Workload Identity on the ContainerCluster.", { authority: [GCP_SEC] }),
+    WGC203: auditRule("WGC203", "merge-worthy", "guidance", "Node pool uses broad cloud-platform scope", "Use narrowly-scoped OAuth scopes instead of cloud-platform.", { authority: [GCP_SEC] }),
+    WGC204: auditRule("WGC204", "report-only", "guidance", "Compute instance without Shielded VM", "Enable Shielded VM configuration.", { category: "best-practice" }),
+    WGC301: auditRule("WGC301", "report-only", "guidance", "No IAMAuditConfig found", "Configure audit logging via IAMAuditConfig.", { category: "best-practice" }),
+    WGC302: auditRule("WGC302", "report-only", "guidance", "No Service (enabled APIs) found", "Declare the GCP APIs you depend on.", { category: "best-practice" }),
+    WGC303: auditRule("WGC303", "report-only", "guidance", "No VPC Service Controls perimeter", "Consider an AccessContextManager ServicePerimeter.", { category: "best-practice" }),
+    WGC401: auditRule("WGC401", "merge-worthy", "guidance", "Unknown field in resource spec", "Remove the unknown spec field.", { category: "correctness" }),
+    WGC402: auditRule("WGC402", "merge-worthy", "guidance", "Missing required spec field", "Add the required spec field.", { category: "correctness" }),
+    WGC403: auditRule("WGC403", "merge-worthy", "guidance", "Spec field has wrong type/structure", "Fix the field's type/structure.", { category: "correctness" }),
+    // governance posture regressions.
+    WGC501: auditRule("WGC501", "merge-worthy", "guidance", "Org Policy guardrail not enforced", "Enable enforce on the rule (or remove the policy deliberately) — a disabled org policy constrains nothing.", { authority: [GCP_SEC] }),
+    WGC502: auditRule("WGC502", "merge-worthy", "guidance", "Org Policy guardrail defines no rules", "Add rules to the OrgPolicyPolicy — without them the constraint binds nothing.", { authority: [GCP_SEC] }),
+    WGC503: auditRule("WGC503", "merge-worthy", "guidance", "Audit logging dropped or scoped down", "Keep auditLogConfigs populated and remove exemptedMembers from the IAMAuditConfig.", { authority: [GCP_SEC] }),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(gcpAuditCatalog, gcpAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,63 @@
+export const gcpAuditLineage = {
+    WGC101: [
+        { tool: "gcp-policy-library", rule: "GCPStorageCMEKEncryptionConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_storage_cmek_encryption_v1.yaml", relation: "overlaps" },
+    ],
+    WGC102: [
+        { tool: "checkov", rule: "CKV_GCP_28", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "Cloud Storage Anonymous or Publicly Accessible", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/a6cd52a1-3056-4910-96a5-894de9f3f3b3/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPStorageBucketWorldReadableConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_storage_bucket_world_readable_v1.yaml", relation: "overlaps" },
+    ],
+    WGC104: [
+        { tool: "checkov", rule: "CKV_GCP_29", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "Google Storage Bucket Level Access Disabled", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/bb0db090-5509-4853-a827-75ced0b3caa0/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPStorageBucketPolicyOnlyConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_storage_bucket_policy_only_v1.yaml", relation: "overlaps" },
+    ],
+    WGC105: [
+        { tool: "checkov", rule: "CKV_GCP_11", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "SQL DB Instance Publicly Accessible", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/b187edca-b81e-4fdc-aff4-aab57db45edb/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPSQLWorldReadableConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_sql_world_readable_v1.yaml", relation: "overlaps" },
+    ],
+    WGC107: [
+        { tool: "checkov", rule: "CKV_GCP_78", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "Cloud Storage Bucket Versioning Disabled", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/e7e961ac-d17e-4413-84bc-8a1fbe242944/", relation: "overlaps" },
+    ],
+    WGC108: [
+        { tool: "checkov", rule: "CKV_GCP_14", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "SQL DB Instance Backup Disabled", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/cf3c7631-cd1e-42f3-8801-a561214a6e79/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPSQLBackupConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_sql_backup_v1.yaml", relation: "overlaps" },
+    ],
+    WGC109: [
+        { tool: "gcp-policy-library", rule: "GCPRestrictedFirewallRulesConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_restricted_firewall_rules_v1.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV2_GCP_12", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    ],
+    WGC110: [
+        { tool: "checkov", rule: "CKV_GCP_43", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "High Google KMS Crypto Key Rotation Period", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/d8c57c4e-bf6f-4e32-a2bf-8643532de77b/", relation: "overlaps" },
+        { tool: "gcp-policy-library", rule: "GCPCMEKRotationConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_cmek_rotation_v1.yaml", relation: "overlaps" },
+    ],
+    WGC202: [
+        { tool: "gcp-policy-library", rule: "GCPGKEEnableWorkloadIdentityConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_gke_enable_workload_identity_v1.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_GCP_69", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    ],
+    WGC203: [
+        { tool: "gcp-policy-library", rule: "GCPGKEAllowedNodeSAConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_gke_allowed_node_sa_v1.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV_GCP_31", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "VM With Full Cloud Access", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/bc280331-27b9-4acb-a010-018e8098aa5d/", relation: "overlaps" },
+    ],
+    WGC204: [
+        { tool: "checkov", rule: "CKV_GCP_39", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "Shielded VM Disabled", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/1b44e234-3d73-41a8-9954-0b154135280e/", relation: "overlaps" },
+    ],
+    WGC301: [
+        { tool: "gcp-policy-library", rule: "GCPIAMAuditLogConstraint", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_iam_audit_log.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV2_GCP_5", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+    ],
+    WGC303: [
+        { tool: "gcp-policy-library", rule: "GCPVPCSCEnsureProjectConstraintV1", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_vpc_sc_ensure_project_v1.yaml", relation: "overlaps" },
+    ],
+    WGC503: [
+        { tool: "gcp-policy-library", rule: "GCPIAMAuditLogConstraint", url: "https://github.com/GoogleCloudPlatform/policy-library/blob/master/policies/templates/gcp_iam_audit_log.yaml", relation: "overlaps" },
+        { tool: "checkov", rule: "CKV2_GCP_5", url: "https://www.checkov.io/5.Policy%20Index/terraform.html", relation: "overlaps" },
+        { tool: "kics", rule: "IAM Audit Not Properly Configured", url: "https://docs.kics.io/latest/queries/terraform-queries/gcp/89fe890f-b480-460c-8b6b-7d8b1468adb4/", relation: "overlaps" },
+    ],
+};