@intentius/chant-lexicon-gcp 0.14.0 → 0.15.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "f9ab027da53df059c9c8011f71a8413ae2534f19fa825817f4833ae6cfc5aabb",
+    "manifest.json": "83a16761b52ff3f8ad88e37eccca05dfc72a28e6e290d7aa0bba0e2d53911ca9",
     "meta.json": "475f10909854d059a2e2d4fb541c058803422e38b9c64bd4d6858c0623eedb8c",
     "types/index.d.ts": "5433b54c04b57d6fda8f3d81ef92ed0aca87f7e8e5dd3ea92d8de6e62a3ccfab",
     "rules/hardcoded-project.ts": "228631d3159e1ffcce2359c66073d4ae59bb0285f378e46e446f416aec50481c",
@@ -37,5 +37,5 @@
     "skills/chant-gcp-patterns.md": "a7ef31c1eb2f7244d3f73952c300472ef94c1eb09bd7a1003281b89299b6b704",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "4fa9a48ba397cd8269bad70d116812f6fdda84d6e8f2b82081763426ed752ab0"
+  "composite": "1debcc99b19499e7ec9f42ec39eeafe752a818018119869dc2cef6e31419bd34"
 }

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The gcp lexicon's `chant audit` catalog — metadata for the WGC* Config
+ * Connector post-synth rules. Contributed via `gcpPlugin.auditCatalog()` (#687).
+ */
+import { type RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const gcpAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAI1F,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAwBpD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/dist/op/activities/gcp-apply.d.ts

@@ -0,0 +1,278 @@
+/** The GCP labels chant stamps on resources it creates. */
+export declare function chantOwnershipLabels(): Record<string, string>;
+/** True when a live resource's labels carry chant's ownership marker. */
+export declare function isChantOwned(labels: Record<string, string> | null | undefined): boolean;
+/** Minimal shape of a serialized CNRM resource (`*.cnrm.cloud.google.com`). */
+export interface GcpResource {
+    apiVersion?: string;
+    kind?: string;
+    metadata?: {
+        name?: string;
+        labels?: Record<string, string>;
+        annotations?: Record<string, string>;
+    };
+    spec?: Record<string, unknown>;
+}
+/** A CNRM StorageBucket (`storage.cnrm.cloud.google.com`). */
+export interface CnrmStorageBucket extends GcpResource {
+    spec?: {
+        location?: string;
+        storageClass?: string;
+        uniformBucketLevelAccess?: boolean;
+        versioning?: {
+            enabled?: boolean;
+        };
+        lifecycleRule?: Array<{
+            action?: Record<string, unknown>;
+            condition?: Record<string, unknown>;
+        }>;
+    };
+}
+/** GCS Buckets:insert request body (the subset chant emits). */
+export interface BucketInsertBody {
+    name: string;
+    location?: string;
+    storageClass?: string;
+    iamConfiguration?: {
+        uniformBucketLevelAccess: {
+            enabled: boolean;
+        };
+    };
+    versioning?: {
+        enabled: boolean;
+    };
+    lifecycle?: {
+        rule: Array<{
+            action: Record<string, unknown>;
+            condition?: Record<string, unknown>;
+        }>;
+    };
+}
+/** Pub/Sub Topic resource body (subset). */
+export interface PubSubTopicBody {
+    labels?: Record<string, string>;
+    messageRetentionDuration?: string;
+}
+/**
+ * One HTTP plan: an idempotency `GET` (200 = exists), the create request, and —
+ * when the resource supports in-place reconcile — the update request. A mapper
+ * that omits `update` leaves an existing resource untouched (skip-if-exists).
+ */
+export interface ApplyPlan {
+    getUrl: string;
+    create: {
+        method: "POST" | "PUT";
+        url: string;
+        body: unknown;
+    };
+    update?: {
+        method: "PATCH" | "PUT";
+        url: string;
+        body: unknown;
+    };
+}
+/**
+ * Handles an async create whose response is a long-running operation. Present
+ * only on mappers for resources that provision asynchronously (Cloud Run, GKE,
+ * Cloud SQL, …); synchronous resources (buckets, topics) omit it.
+ */
+export interface OperationSpec {
+    /**
+     * URL to poll from the create response, or `undefined` when the create
+     * completed synchronously (returned the resource, not an operation).
+     */
+    pollUrl(createResponseBody: unknown, ctx: {
+        base: string;
+        project: string;
+    }): string | undefined;
+    /** True once the polled operation body reports completion. */
+    isDone(operationBody: unknown): boolean;
+    /** An error message from a completed-with-error operation, else undefined. */
+    error(operationBody: unknown): string | undefined;
+}
+/** How to list live resources of a kind, so `prune` can find chant-owned orphans. */
+export interface ListSpec {
+    /** LIST endpoint for the kind. */
+    url(ctx: {
+        base: string;
+        project: string;
+    }): string;
+    /** Extract `{ name, labels }` for each item from the LIST response body. */
+    items(responseBody: unknown): Array<{
+        name: string;
+        labels?: Record<string, string> | null;
+    }>;
+}
+/** Maps one CNRM kind to its GCP REST operations. The unit of the dispatch table. */
+export interface ResourceMapper {
+    /** CNRM kind this handles. */
+    kind: string;
+    /** Real-GCP API host, used when no `endpoint` override is given. */
+    defaultHost: string;
+    /** Build the GET + create plan for one resource against `base`. */
+    plan(resource: GcpResource, ctx: {
+        base: string;
+        project: string;
+    }): ApplyPlan;
+    /** Present for async resources whose create returns a long-running operation. */
+    operation?: OperationSpec;
+    /** Present when the kind can be pruned (list live → delete chant-owned orphans). */
+    list?: ListSpec;
+}
+/**
+ * A standard `google.longrunning` operation spec: the create response carries an
+ * operation `name` (`projects/…/operations/…`), polled at `{base}/{version}/{name}`
+ * until `done: true`. Reused by every service that follows the pattern.
+ */
+export declare function longRunningOperation(version: string): OperationSpec;
+/**
+ * Map a CNRM StorageBucket to a GCS Buckets:insert body. Pure. CNRM mirrors the
+ * Terraform google provider which mirrors the GCS API, so most fields are
+ * field-for-field; the renames are `uniformBucketLevelAccess` →
+ * `iamConfiguration.uniformBucketLevelAccess.enabled` and `lifecycleRule` →
+ * `lifecycle.rule`.
+ */
+export declare function bucketInsertBody(cnrm: CnrmStorageBucket): BucketInsertBody;
+/** Map a CNRM PubSubTopic to a Pub/Sub Topic body. Pure. Name travels in the URL. */
+export declare function pubSubTopicBody(resource: GcpResource): PubSubTopicBody;
+export declare const storageBucketMapper: ResourceMapper;
+export declare const pubSubTopicMapper: ResourceMapper;
+/** Map a CNRM RunService to a Cloud Run v2 Service body. Pure. */
+export declare function cloudRunServiceBody(resource: GcpResource): {
+    template?: unknown;
+};
+export declare const cloudRunServiceMapper: ResourceMapper;
+/**
+ * Map a CNRM PubSubSubscription to a Pub/Sub Subscription body, resolving the
+ * `topicRef` to a full topic path. Pure.
+ */
+export declare function pubSubSubscriptionBody(resource: GcpResource, project: string): Record<string, unknown>;
+export declare const pubSubSubscriptionMapper: ResourceMapper;
+/** Map a CNRM SecretManagerSecret to a Secret Manager create body. Pure. */
+export declare function secretBody(resource: GcpResource): Record<string, unknown>;
+export declare const secretManagerSecretMapper: ResourceMapper;
+/** Map a CNRM IAMServiceAccount to a service-account create body. Pure. */
+export declare function serviceAccountBody(resource: GcpResource, accountId: string): Record<string, unknown>;
+export declare const gcpServiceAccountMapper: ResourceMapper;
+/** The kind → mapper dispatch table. Adding a resource type is a new entry here. */
+export declare const MAPPERS: Record<string, ResourceMapper>;
+/**
+ * Collect the local resource names this resource references via CNRM `*Ref`
+ * fields (`topicRef: { name }`, `subnetworkRefs: [{ name }]`, …). `external`
+ * refs point outside the manifest and are ignored for ordering. Pure.
+ */
+export declare function referencedNames(resource: GcpResource): string[];
+/**
+ * Topologically order resources so a referenced resource comes before the
+ * resource that references it (apply order; reverse for delete). Refs to names
+ * not in the manifest are left to exist already. Throws on a reference cycle.
+ * Pure — a DFS post-order.
+ */
+export declare function orderByReferences(resources: GcpResource[]): GcpResource[];
+/** Resolve the project: `GOOGLE_CLOUD_PROJECT` env, else the CNRM project-id annotation. Pure. */
+export declare function resolveGcpProject(resource: GcpResource, env?: NodeJS.ProcessEnv): string;
+/** Injectable HTTP client — mirrors argo's injectable fetcher so tests avoid the network. */
+export type GcpHttp = (method: string, url: string, body?: unknown, signal?: AbortSignal) => Promise<{
+    status: number;
+    text: string;
+}>;
+/**
+ * Reconcile one resource via its mapper: `GET` it; if present, PATCH it to the
+ * desired state (when the mapper supports `update`, else leave it); if absent,
+ * create it. Async create/update return an operation that is polled to
+ * completion. `http` is injectable for tests.
+ */
+export declare function applyResource(mapper: ResourceMapper, resource: GcpResource, ctx: {
+    base: string;
+    project: string;
+}, http?: GcpHttp, signal?: AbortSignal): Promise<{
+    kind: string;
+    name: string;
+    created: boolean;
+    updated: boolean;
+}>;
+/**
+ * Poll a long-running operation until it reports done (or errors / times out).
+ * `http` and the interval are injectable so tests drive it without real waits.
+ */
+export declare function waitForOperation(op: OperationSpec, pollUrl: string, http?: GcpHttp, signal?: AbortSignal, opts?: {
+    intervalMs?: number;
+    timeoutMs?: number;
+}): Promise<void>;
+/** Parse a built manifest into CNRM resource objects — YAML (multi-doc) or JSON. Pure. */
+export declare function parseManifest(content: string, path: string): GcpResource[];
+export interface GcpApplyArgs {
+    /** Path to a built CNRM manifest (YAML multi-doc or JSON). */
+    manifestPath: string;
+    /** GCS/GCP endpoint override for all kinds (e.g. floci-gcp `:4588`). Default: each kind's real-GCP host. */
+    endpoint?: string;
+    /** Project override. Default: `GOOGLE_CLOUD_PROJECT` env / CNRM annotation. */
+    project?: string;
+    /**
+     * Delete chant-owned resources of a manifested kind that are no longer in the
+     * manifest (owned-only prune). Destructive — off by default. Only kinds with a
+     * `list` mapper are pruned; foreign (non-chant) resources are never touched.
+     */
+    prune?: boolean;
+}
+/**
+ * Owned-only prune: for each manifested kind with `list` support, delete the
+ * chant-owned live resources whose name is not in `desiredByKind`. Foreign
+ * resources (no ownership label) are left alone.
+ */
+export declare function pruneOrphans(desired: GcpResource[], resolve: (mapper: ResourceMapper, resource?: GcpResource) => {
+    base: string;
+    project: string;
+}, http?: GcpHttp, signal?: AbortSignal): Promise<Array<{
+    kind: string;
+    name: string;
+    deleted: boolean;
+}>>;
+/**
+ * The native GCP applier (#706) — read a built CNRM manifest and apply each
+ * resource directly to its GCP REST API, targeting a local floci-gcp emulator or
+ * real GCP by endpoint override. Unlike AWS/Azure/k8s, GCP has no native deploy
+ * service to shell out to, so chant maps each `kind` to a REST call itself (the
+ * `MAPPERS` dispatch table). Unknown kinds are skipped. Uses longInfra profile.
+ * `http` is injectable for tests.
+ */
+export declare function gcpApply(args: GcpApplyArgs, signal?: AbortSignal, http?: GcpHttp): Promise<{
+    applied: Array<{
+        kind: string;
+        name: string;
+        created: boolean;
+        updated: boolean;
+    }>;
+    pruned: Array<{
+        kind: string;
+        name: string;
+        deleted: boolean;
+    }>;
+}>;
+/**
+ * Idempotently delete one resource: `DELETE` its resource URL. A 404 means it is
+ * already gone. For async resources, `DELETE` returns a long-running operation
+ * that is polled to completion. `http` is injectable for tests.
+ */
+export declare function deleteResource(mapper: ResourceMapper, resource: GcpResource, ctx: {
+    base: string;
+    project: string;
+}, http?: GcpHttp, signal?: AbortSignal): Promise<{
+    kind: string;
+    name: string;
+    deleted: boolean;
+}>;
+/**
+ * The inverse of {@link gcpApply} — read a built CNRM manifest and delete the
+ * resources it declares (in reverse order, so dependents go before their
+ * dependencies). Idempotent: already-absent resources are a no-op. Uses
+ * longInfra profile. `http` is injectable for tests.
+ */
+export declare function gcpDelete(args: GcpApplyArgs, signal?: AbortSignal, http?: GcpHttp): Promise<{
+    deleted: Array<{
+        kind: string;
+        name: string;
+        deleted: boolean;
+    }>;
+}>;
+//# sourceMappingURL=gcp-apply.d.ts.map

package/dist/op/activities/gcp-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gcp-apply.ts"],"names":[],"mappings":"AAYA,2DAA2D;AAC3D,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEvF;AAQD,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,IAAI,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,wBAAwB,CAAC,EAAE,OAAO,CAAC;QACnC,UAAU,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QACnC,aAAa,CAAC,EAAE,KAAK,CAAC;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAC;KAClG,CAAC;CACH;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE;QAAE,wBAAwB,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IACtE,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACvG;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAID;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/D,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,SAAS,CAAC;IACjG,8DAA8D;IAC9D,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC;IACxC,8EAA8E;IAC9E,KAAK,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,kCAAkC;IAClC,GAAG,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC;IACpD,4EAA4E;IAC5E,KAAK,CAAC,YAAY,EAAE,OAAO,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/E,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAcnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,CAsB1E;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,eAAe,CAOtE;AAED,eAAO,MAAM,mBAAmB,EAAE,cAmBjC,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,cA0B/B,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAKjF;AAED,eAAO,MAAM,qBAAqB,EAAE,cAuBnC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtG;AAED,eAAO,MAAM,wBAAwB,EAAE,cAStC,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzE;AAED,eAAO,MAAM,yBAAyB,EAAE,cAuBvC,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpG;AAED,eAAO,MAAM,uBAAuB,EAAE,cAerC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAOlD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,EAAE,CAiB/D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAuBzE;AAID,kGAAkG;AAClG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAQrG;AAED,6FAA6F;AAC7F,MAAM,MAAM,OAAO,GAAG,CACpB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAY/C;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACtC,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAwB7E;AA4BD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,aAAa,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAU1E;AAED,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EAAE,EACtB,OAAO,EAAE,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,WAAW,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC9F,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAyBlE;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnF,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACjE,CAAC,CAwBD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EACtC,IAAI,GAAE,OAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAiB3D;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,YAAY,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,OAAqB,GAC1B,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAmB/E"}

package/dist/op/activities/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * GCP Op activities — resolved by the core activity registry when a project's
+ * `chant.config.ts` lists the `gcp` lexicon. Contributes the native GCP applier
+ * (`gcpApply`), which maps CNRM resources to GCP REST calls since GCP has no
+ * native deployment service to shell out to.
+ */
+export { gcpApply, gcpDelete, applyResource, deleteResource, waitForOperation, longRunningOperation, bucketInsertBody, pubSubTopicBody, pubSubSubscriptionBody, cloudRunServiceBody, secretBody, serviceAccountBody, storageBucketMapper, pubSubTopicMapper, pubSubSubscriptionMapper, cloudRunServiceMapper, secretManagerSecretMapper, gcpServiceAccountMapper, MAPPERS, referencedNames, orderByReferences, pruneOrphans, chantOwnershipLabels, isChantOwned, resolveGcpProject, parseManifest, } from "./gcp-apply.js";
+export type { GcpApplyArgs, GcpResource, CnrmStorageBucket, BucketInsertBody, PubSubTopicBody, ResourceMapper, OperationSpec, ListSpec, ApplyPlan, GcpHttp, } from "./gcp-apply.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,aAAa,EACb,QAAQ,EACR,SAAS,EACT,OAAO,GACR,MAAM,aAAa,CAAC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAmBjG,eAAO,MAAM,SAAS,EAAE,aA+VvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAqC,MAAM,0BAA0B,CAAC;AAoBjG,eAAO,MAAM,SAAS,EAAE,aAuWvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -44,6 +44,11 @@
       "types": "./dist/detect.d.ts",
       "default": "./src/detect.ts"
     },
+    "./op/activities": {
+      "development": "./src/op/activities/index.ts",
+      "types": "./dist/op/activities/index.d.ts",
+      "default": "./src/op/activities/index.ts"
+    },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
@@ -71,6 +76,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.13.1"
+    "@intentius/chant": "^0.15.0"
   }
 }

package/src/describe-resources.ts

@@ -15,7 +15,7 @@
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 import type { ResourceMetadata } from "@intentius/chant/lexicon";
-import { hasOwnershipMarker, classifyOwnership } from "@intentius/chant/ownership";
+import { hasOwnershipMarker, classifyOwnership, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 
 const execAsync = promisify(exec);
 
@@ -101,7 +101,7 @@ export async function describeResources(options: {
       const { stdout } = await execAsync(cmd);
       const obj: KubectlResponse = JSON.parse(stdout);
       // owned filter: skip resources not carrying chant's marker label.
-      if (options.owned && !hasOwnershipMarker(obj.metadata?.labels, "label")) {
+      if (options.owned && !hasOwnershipMarker(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS)) {
         continue;
       }
       result[entityName] = {
@@ -109,7 +109,7 @@ export async function describeResources(options: {
         physicalId: obj.metadata?.uid,
         status: statusFromCC(obj),
         lastUpdated: obj.metadata?.creationTimestamp,
-        ownership: classifyOwnership(obj.metadata?.labels, "label"),
+        ownership: classifyOwnership(obj.metadata?.labels, LABEL_OWNERSHIP_KEYS),
         attributes: pruneUndefined({
           namespace: obj.metadata?.namespace,
           labels: obj.metadata?.labels,

package/src/import/live-export.ts

@@ -1,5 +1,5 @@
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
-import { hasOwnershipMarker } from "@intentius/chant/ownership";
+import { hasOwnershipMarker, LABEL_OWNERSHIP_KEYS } from "@intentius/chant/ownership";
 import { GcpParser } from "./parser";
 
 /** Server-written metadata fields, stripped unless `verbatim`. */
@@ -61,7 +61,7 @@ export function buildExportFromObjects(
     ? objects.filter((o) => {
         if (!isRecord(o)) return false;
         const labels = isRecord(o.metadata) ? (o.metadata.labels as Record<string, unknown>) : undefined;
-        return hasOwnershipMarker(labels, "label");
+        return hasOwnershipMarker(labels, LABEL_OWNERSHIP_KEYS);
       })
     : objects;
 

package/src/lint/audit-catalog.ts

@@ -0,0 +1,33 @@
+/**
+ * The gcp lexicon's `chant audit` catalog — metadata for the WGC* Config
+ * Connector post-synth rules. Contributed via `gcpPlugin.auditCatalog()` (#687).
+ */
+import { auditRule, type RuleMeta, type Authority } from "@intentius/chant/audit/catalog";
+
+const GCP_SEC: Authority = { name: "Google Cloud — Security best practices", url: "https://cloud.google.com/security/best-practices" };
+
+export const gcpAuditCatalog: Record<string, RuleMeta> = {
+  WGC101: auditRule("WGC101", "merge-worthy", "guidance", "Storage/SQL without encryption configuration", "Configure encryption (e.g. a CMEK key) for data at rest.", { authority: [GCP_SEC] }),
+  WGC102: auditRule("WGC102", "merge-worthy", "guidance", "Public IAM member (allUsers/allAuthenticatedUsers)", "Remove allUsers/allAuthenticatedUsers bindings.", { authority: [GCP_SEC] }),
+  WGC103: auditRule("WGC103", "report-only", "guidance", "Missing project-id annotation", "Add the cnrm.cloud.google.com/project-id annotation.", { category: "best-practice" }),
+  WGC104: auditRule("WGC104", "merge-worthy", "guidance", "Bucket without uniform bucket-level access", "Enable uniformBucketLevelAccess.", { authority: [GCP_SEC] }),
+  WGC105: auditRule("WGC105", "merge-worthy", "guidance", "Cloud SQL open to 0.0.0.0/0", "Restrict authorizedNetworks to known sources.", { authority: [GCP_SEC] }),
+  WGC106: auditRule("WGC106", "report-only", "guidance", "Missing deletion-policy annotation", "Add the cnrm.cloud.google.com/deletion-policy annotation.", { category: "best-practice" }),
+  WGC107: auditRule("WGC107", "report-only", "guidance", "Bucket versioning disabled", "Enable object versioning.", { category: "best-practice" }),
+  WGC108: auditRule("WGC108", "report-only", "guidance", "Cloud SQL backups disabled", "Enable backup configuration.", { category: "best-practice" }),
+  WGC109: auditRule("WGC109", "merge-worthy", "guidance", "Firewall open to 0.0.0.0/0", "Restrict sourceRanges to known sources.", { authority: [GCP_SEC] }),
+  WGC110: auditRule("WGC110", "merge-worthy", "guidance", "KMS key without rotation", "Set a rotationPeriod on the CryptoKey.", { authority: [GCP_SEC] }),
+  WGC111: auditRule("WGC111", "merge-worthy", "guidance", "Reference to an undefined resource", "Point the reference at a resource in the output.", { category: "correctness" }),
+  WGC112: auditRule("WGC112", "merge-worthy", "guidance", "Missing or invalid apiVersion", "Set a valid cnrm.cloud.google.com apiVersion.", { category: "correctness" }),
+  WGC113: auditRule("WGC113", "report-only", "guidance", "Alpha API version", "Move to a beta/GA API version.", { category: "best-practice" }),
+  WGC201: auditRule("WGC201", "report-only", "guidance", "Missing managed-by label", "Add the app.kubernetes.io/managed-by label.", { category: "best-practice" }),
+  WGC202: auditRule("WGC202", "merge-worthy", "guidance", "Cluster without Workload Identity", "Enable Workload Identity on the ContainerCluster.", { authority: [GCP_SEC] }),
+  WGC203: auditRule("WGC203", "merge-worthy", "guidance", "Node pool uses broad cloud-platform scope", "Use narrowly-scoped OAuth scopes instead of cloud-platform.", { authority: [GCP_SEC] }),
+  WGC204: auditRule("WGC204", "report-only", "guidance", "Compute instance without Shielded VM", "Enable Shielded VM configuration.", { category: "best-practice" }),
+  WGC301: auditRule("WGC301", "report-only", "guidance", "No IAMAuditConfig found", "Configure audit logging via IAMAuditConfig.", { category: "best-practice" }),
+  WGC302: auditRule("WGC302", "report-only", "guidance", "No Service (enabled APIs) found", "Declare the GCP APIs you depend on.", { category: "best-practice" }),
+  WGC303: auditRule("WGC303", "report-only", "guidance", "No VPC Service Controls perimeter", "Consider an AccessContextManager ServicePerimeter.", { category: "best-practice" }),
+  WGC401: auditRule("WGC401", "merge-worthy", "guidance", "Unknown field in resource spec", "Remove the unknown spec field.", { category: "correctness" }),
+  WGC402: auditRule("WGC402", "merge-worthy", "guidance", "Missing required spec field", "Add the required spec field.", { category: "correctness" }),
+  WGC403: auditRule("WGC403", "merge-worthy", "guidance", "Spec field has wrong type/structure", "Fix the field's type/structure.", { category: "correctness" }),
+};