@intentius/chant-lexicon-gcp 0.41.20 → 0.44.1

package/dist/composites/index.d.ts

@@ -1,3 +1,5 @@
+export { GovernanceFoundation, LocationRestriction, OrganizationAuditConfig } from "./landing-zone.js";
+export type { GovernanceFoundationProps, LocationRestrictionProps, OrganizationAuditConfigProps, } from "./landing-zone.js";
 export { GkeCluster } from "./gke-cluster.js";
 export type { GkeClusterProps } from "./gke-cluster.js";
 export { CloudRunServiceComposite } from "./cloud-run-service.js";

package/dist/composites/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACpG,YAAY,EACV,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,YAAY,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/composites/landing-zone.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Landing-zone bootstrap composites (#791, epic #787 C1) — the GCP slice.
+ *
+ * Fixed-shape resources for greenfield creation of the recommended
+ * governance foundation through a Config Connector management stack. The
+ * evaluability rules (EVL002/004) require composites to declare a fixed set
+ * of resources, so these carry the foundation only; arbitrary folder/project
+ * trees are authored as config with `landingZoneConfig()` (../governance.ts)
+ * and reconciled by the GCP cloud warden, and further folders/projects are
+ * declared as ordinary resources.
+ *
+ * The pieces compose:
+ *   const lz = GovernanceFoundation({ orgId: "123456789012" });
+ *   const lr = LocationRestriction({ orgId: "123456789012", locations: ["in:eu-locations"] });
+ *   const ac = OrganizationAuditConfig({ orgId: "123456789012" });
+ * There is no OrganizationRoot analog — GCP organizations come from Cloud
+ * Identity / Workspace, not the resource API, so greenfield and brownfield
+ * both start from an existing org id.
+ */
+import { IAMAuditConfig, OrgpolicyPolicy, ResourcemanagerFolder } from "../generated/index.js";
+export interface GovernanceFoundationProps {
+    /** The organization to hang the foundation off ("123456789012" or "organizations/123456789012"). */
+    orgId: string;
+    /** Namespace for all resources. */
+    namespace?: string;
+}
+export type GovernanceFoundationResult = {
+    folderSecurity: InstanceType<typeof ResourcemanagerFolder>;
+    folderInfrastructure: InstanceType<typeof ResourcemanagerFolder>;
+    folderSandbox: InstanceType<typeof ResourcemanagerFolder>;
+    folderWorkloads: InstanceType<typeof ResourcemanagerFolder>;
+    policyDisableSaKeyCreation: InstanceType<typeof OrgpolicyPolicy>;
+    policySkipDefaultNetwork: InstanceType<typeof OrgpolicyPolicy>;
+};
+/**
+ * Security / Infrastructure / Sandbox / Workloads folders with
+ * `disable-sa-key-creation` and `skip-default-network` enforced at the
+ * organization root — the same baseline `landingZoneConfig()` declares.
+ */
+export declare const GovernanceFoundation: import("@intentius/chant").CompositeDefinition<GovernanceFoundationProps, GovernanceFoundationResult>;
+export interface LocationRestrictionProps {
+    /** The organization the policy binds to. */
+    orgId: string;
+    /** The only locations resources may be created in (value groups like "in:eu-locations" work). */
+    locations: string[];
+    /** Namespace for all resources. */
+    namespace?: string;
+}
+export type LocationRestrictionResult = {
+    policyResourceLocations: InstanceType<typeof OrgpolicyPolicy>;
+};
+export declare const LocationRestriction: import("@intentius/chant").CompositeDefinition<LocationRestrictionProps, LocationRestrictionResult>;
+export interface OrganizationAuditConfigProps {
+    /** The organization audit logging is enabled on. */
+    orgId: string;
+    /** Defaults to "allServices". */
+    service?: string;
+    /** Defaults to ADMIN_READ / DATA_READ / DATA_WRITE. */
+    logTypes?: string[];
+    /** Namespace for all resources. */
+    namespace?: string;
+}
+export type OrganizationAuditConfigResult = {
+    auditConfig: InstanceType<typeof IAMAuditConfig>;
+};
+export declare const OrganizationAuditConfig: import("@intentius/chant").CompositeDefinition<OrganizationAuditConfigProps, OrganizationAuditConfigResult>;
+//# sourceMappingURL=landing-zone.d.ts.map

package/dist/composites/landing-zone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"landing-zone.d.ts","sourceRoot":"","sources":["../../src/composites/landing-zone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AA2CtF,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,cAAc,EAAE,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;IAC3D,oBAAoB,EAAE,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;IACjE,aAAa,EAAE,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;IAC1D,eAAe,EAAE,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;IAC5D,0BAA0B,EAAE,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;IACjE,wBAAwB,EAAE,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;CAChE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,uGAqBP,CAAC;AAM3B,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,uBAAuB,EAAE,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;CAC/D,CAAC;AAEF,eAAO,MAAM,mBAAmB,qGAQP,CAAC;AAM1B,MAAM,WAAW,4BAA4B;IAC3C,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,WAAW,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;CAClD,CAAC;AAEF,eAAO,MAAM,uBAAuB,6GAkBnC,CAAC"}

package/dist/deep-observe-hooks.d.ts

@@ -1,6 +1,6 @@
 /**
- * GCP deep-observation noise rules (#1209) — for REST payloads, not Config
- * Connector objects.
+ * GCP deep-observation noise rules (#1209, #1210) — for REST payloads, not
+ * Config Connector objects.
  *
  * ## What this replaced, and why it had to
  *
@@ -22,6 +22,16 @@
  * provider populates. It is hand-maintained, which is the honest cost: a
  * server-set field nobody has listed reads as drift until it is. That is
  * visible and fixable, where an over-broad rule silently hides real drift.
+ *
+ * ## The declared side is CNRM, and some of it never reaches GCP
+ *
+ * The declared tree is a Config Connector spec, and a few of its fields are
+ * instructions to the CNRM machinery rather than resource configuration —
+ * `projectRef`, `resourceID`, the `cnrm.cloud.google.com/*`
+ * annotations. No REST payload will ever echo them (the project is in the
+ * URL), so left alone each one reports `absent` drift on every clean apply.
+ * They are pruned as declared-side envelope, the mirror image of the
+ * live-side server fields.
  */
 import type { DeepNormalizationHooks } from "@intentius/chant/deep-observation";
 /**
@@ -33,7 +43,10 @@ import type { DeepNormalizationHooks } from "@intentius/chant/deep-observation";
  */
 export declare const GCP_READ_ONLY_NAMES: ReadonlySet<string>;
 /**
- * Per-kind values GCP fills in when the request omits them.
+ * Per-kind values GCP fills in when the request omits them, keyed by the
+ * index-erased pattern from the tree root (the declared-props shape
+ * `./deep-observe.ts` reshapes the live payload into — spec fields at the
+ * root, so `storageClass`, not `spec.storageClass`).
  *
  * Unlike {@link GCP_READ_ONLY_NAMES} these are only noise where **source never
  * declared the property** — a default somebody explicitly wrote is a fact worth

package/dist/deep-observe-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAY,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAE1F;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAelD,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CA4B5F,CAAC;AAeF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBAiBvC,CAAC"}
+{"version":3,"file":"deep-observe-hooks.d.ts","sourceRoot":"","sources":["../src/deep-observe-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,KAAK,EAAY,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAK1F;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAyBlD,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CA2B5F,CAAC;AAsCF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,sBA4BvC,CAAC"}

package/dist/deep-observe.d.ts

@@ -1,119 +1,49 @@
 /**
- * GCP deep observation (#1087) — the GCP row of the deep-observe contract
- * (#1014), reusing the k8s row (#1076) rather than writing a second one, per
- * the issue and #1173's own per-row checklist: "A Config Connector resource
- * *is* a Kubernetes object, so it carries managed-fields for the same
- * reason. Share the hooks rather than writing a second implementation."
- *
- * ## A Config Connector CR is a Kubernetes object
- *
- * `kubectl get <kind>.<group> -o json` against a Config Connector-enabled
- * cluster (`./describe-resources.ts`'s own transport, reused here) returns a
- * real Kubernetes API object: `metadata.managedFields`, `status`,
- * `metadata.{uid,resourceVersion,generation,creationTimestamp}` are all
- * present for the identical reason they're present on a Deployment — the API
- * server that served the read is the same kind of API server. The epic's own
- * table lists `metadata.managedFields` under GCP's "field noise" to prune; it
- * is the opposite of noise, and it is available here for exactly the reason
- * chant #1076 reads it on the k8s row.
- *
- * So this reader reuses, unchanged, from `@intentius/chant/managed-fields`:
- *
- * - `K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS` — the generic Kubernetes object
- *   envelope (`status`, `metadata.{uid,resourceVersion,generation,
- *   creationTimestamp,managedFields,selfLink}`).
- * - `k8sListMapOrderKey` — Kubernetes' own list-map-key conventions, needed
- *   because some CNRM kinds embed genuinely k8s-shaped substructures (Cloud
- *   Run's `RunService` wraps a Knative pod spec with
- *   `containers`/`env`/`ports`, keyed the same way a Deployment's are).
- * - `buildOwnershipSets`/`pruneByOwnership` — the managed-fields ownership
- *   walk itself: chant #1076's actual contribution, and the piece this row
- *   exists to reuse rather than reimplement.
- *
- * These live in core, not in the k8s lexicon, specifically so this file can
- * reuse them without adding a dependency on the k8s lexicon package or (never,
- * per the issue) on `@intentius/chant-k8s-client` — this reader shells
- * `kubectl` exactly like `./describe-resources.ts` already does. Chant
- * #1177/#1180 kept GCP off the typed client deliberately ("a separate
- * lexicon and a separate decision"); this row does not revisit that.
- *
- * ## The GCP twist: who is "chant" on this path?
- *
- * Chant #1076's rule treats a field as always-diffable when *any* chant field
- * manager (`chant`, `chant:<stack>` — chant #1075's SSA identity) owns it.
- * That identity is only ever set by the k8s lexicon's typed client, applying
- * with an explicit `--field-manager`. GCP has no equivalent apply activity:
- * every gcp example's own deploy script (e.g.
- * `examples/cockroachdb-multi-region-gke/scripts/deploy.sh`) runs plain
- * `kubectl apply -f dist/*.yaml` — classic client-side apply, no
- * `--server-side`, no `--field-manager`. kubectl's own hardcoded default
- * field manager for that command is `kubectl-client-side-apply`, identical
- * to what a human's `kubectl apply -f their-own-file.yaml` would record.
- * **There is no field-manager name on GCP's real deploy path that
- * distinguishes "chant applied this" from "a person applied this".**
- * (Config Connector's own controller is distinguishable — its reconciler
- * records itself as `cnrm-controller-manager`, per the k8s-config-connector
- * source's own `ControllerManagedFieldManager` constant — just chant isn't,
- * on this path.)
- *
- * That sounds like it breaks question 1 of the three-question rule
- * (`isChantManager`) below. It doesn't, because question 3 already covers
- * it: chant's own kubectl apply always applies the *exact* built manifest, so
- * any field chant's own most recent apply set is, by construction, also in
- * `declaredRoot` (`props`) on the very next read — chant never authors a
- * field it does not also declare. Working through what that means per field:
- *
- * - A field only chant's own applies have ever touched: not recognized as
- *   `chantOwned` (its manager is `kubectl-client-side-apply`, not `chant`),
- *   but foreign-owned *and* declared → contested → kept diffable anyway.
- *   Same outcome as being chant-owned would have been.
- * - A field CNRM's controller sets and chant never declares: foreign-owned,
- *   undeclared → pruned. Correct regardless of whether "chant" is recognized.
- * - A field a human sets by hand (`kubectl edit`, or their own `kubectl apply
- *   -f`) that chant *does* declare: foreign-owned (manager is `kubectl-edit`
- *   or `kubectl-client-side-apply`) and declared → contested → surfaces as
- *   drift. This is #1087's acceptance criterion 1.
- *
- * `isGcpChantFieldManager` below still checks the `chant`/`chant:<stack>`
- * family, so a future GCP apply path that *does* route through server-side
- * apply with an explicit chant field manager (matching the k8s lexicon's own
- * path) is recognized with no change needed here. On today's plain-apply
- * path it is inert — proven inert by this module's own test suite (the
- * "managers-specific case") — and the contested-field rule (question 3) is
- * what actually keeps GCP's drift semantics correct without it.
- *
- * ## What's genuinely GCP-specific
- *
- * - No typed operation surface (chant #1177's `operationFor` is a k8s
- *   lexicon/typed-client concept, generated from cluster discovery this
- *   reader never touches) — `./describe-resources.ts`'s `deriveGVK` stands in.
- * - CNRM's own observed-state annotations (`./deep-observe-hooks.ts`'s
- *   `gcpDeepNormalizationHooks`) — bookkeeping the controller writes into
- *   `metadata.annotations` for GCP-side properties the CRD schema has no
- *   field for. See that module's doc for why the list is narrow.
- *
- * ## Deliberately out of scope
- *
- * `status.conditions` staleness as its own signal — the issue's own
- * "Proposed" section floats this as worth *deciding*, not worth doing here.
- * `status` is pruned outright (matching k8s, and the acceptance criteria),
- * and a CNRM projection lagging real GCP state is a genuine gap, but
- * detecting it means reading the actual GCP API, not the CR — a different
- * read than this contract's "normalize what Kubernetes reports" scope.
- * Flagged, not papered over.
+ * GCP deep observation (#1087, re-landed on direct REST by #1209/#1210) — the
+ * GCP row of the deep-observe contract (#1014).
+ *
+ * ## The reader is the applier's transport, pointed at reads
+ *
+ * chant applies GCP cluster-free over direct REST (#706), and since #1209 it
+ * observes the same way: every GET here is built by the same
+ * `ResourceMapper.plan().getUrl` the applier writes through (see
+ * ./api/read-client.ts), so reader and applier cannot disagree about where a
+ * resource lives. `GCP_ENDPOINT_URL` redirects the whole reader at a local
+ * floci-gcp; unset means real GCP, exactly as it does for the applier.
+ * Coverage is the applier's own dispatch table — a kind with no mapper cannot
+ * be applied either, and reports NOT-OBSERVED with `unsupported-kind` (#1089)
+ * rather than being dropped.
+ *
+ * ## Two shapes, one diff
+ *
+ * The declared side is a CNRM spec as a declarable authors it (`{ metadata:
+ * { name }, location, storageClass }`); the REST APIs return their own shapes
+ * (`name` is usually the full resource path, a bucket's `iamConfiguration`
+ * nests what CNRM flattens, a subscription's `topic` is a path where CNRM
+ * writes `topicRef`). Diffed raw, every such field drifts twice: once as
+ * `declared -> <absent>` and once as `<undeclared> -> live`.
+ * {@link restToCnrmShape} plus the per-kind {@link CNRM_REFINERS} put the live
+ * payload into the declared vocabulary before the diff runs — the same move
+ * the AWS row makes with its per-type `toModel` (#1207/#1269), and it lives
+ * next to the read for the same reason: translation is the price of the
+ * richer read, and it does not belong inside the diff.
+ *
+ * ## Noise is a static table, not an ownership walk
+ *
+ * The kubectl-era reader pruned by CNRM `metadata.managedFields`. A REST
+ * payload never says who wrote a field, so the noise rules are static
+ * (./deep-observe-hooks.ts): server-assigned names, chant's own ownership
+ * labels, CNRM-only declared fields, and per-kind provider defaults gated on
+ * "source never declared it". Core applies the same hooks to both trees.
  *
  * ## The build-path boundary
  *
- * This module imports `./describe-resources.ts` for the live kubectl
- * transport, which imports `node:child_process`. `gcpPlugin.ts` reaches this
- * file only via `await import("./deep-observe.js")` inside
- * `observeResourcesDeep` — never statically — the same way it already
- * dynamic-imports `describeResources`/`exportResources`, so `chant build`
- * never resolves a process-spawning module just to synthesize a template.
- * `deepNormalizationHooks` is plain data with no such dependency
- * (`./deep-observe-hooks.ts`) and is imported statically from `plugin.ts`,
- * because core normalizes the *declared* tree with it whether or not a
- * cluster read ever happens.
+ * `gcpPlugin.ts` reaches this file only via `await import("./deep-observe.js")`
+ * inside `observeResourcesDeep` — never statically — so `chant build` never
+ * resolves the live transport just to synthesize a template.
+ * `deepNormalizationHooks` is plain data (./deep-observe-hooks.ts) and is
+ * imported statically from `plugin.ts`, because core normalizes the
+ * *declared* tree with it whether or not a live read ever happens.
  */
 import type { DeepObservationResult } from "@intentius/chant/lexicon";
 import { gcpDeepNormalizationHooks } from "./deep-observe-hooks.js";
@@ -130,36 +60,35 @@ export interface GcpDeepObserveOptions {
     owned?: boolean;
 }
 /**
- * Reshape a GCP REST body into the CNRM shape the declared source is written in.
- *
- * This is the half of the port that is not transport (#1209). chant's GCP
- * source declares Config Connector custom resources — `{ metadata: { name },
- * spec: { location, storageClass } }` — while the REST APIs return their own
- * flat shape, `{ name, location, storageClass }`. Diffing one against the other
- * makes every field drift twice: once as `spec.location: US -> <absent>` and
- * again as `location: <undeclared> -> US`.
- *
- * Verified against floci-gcp before this existed: a bucket that matched its
- * declaration exactly reported **7 property drifts**, all of them shape.
- *
- * chant has met this before. #1207 records it for AWS: Cloud Control returns
- * the CloudFormation resource model and lines up for free, while the EC2 API
- * returns the EC2 shape and needs mapping onto the declared shape before the
- * diff can compare. GCP is the EC2 case.
- *
- * The mapping is CNRM's own convention rather than a per-kind table: identity
- * and labels live under `metadata`, everything else is `spec`. That holds for
- * every kind the applier can write, and a per-kind table would be a second
- * place to forget a field.
+ * Reshape a GCP REST body into the shape the declared props are written in:
+ * identity and labels under `metadata`, everything else at the root — a CNRM
+ * spec as a chant declarable authors it (`new StorageBucket({ metadata,
+ * location, storageClass })`). Kind-specific vocabulary differences on top of
+ * it are {@link CNRM_REFINERS}' job. Verified against floci-gcp: diffed raw, a
+ * bucket that matched its declaration exactly reported every field as drift
+ * twice, once per shape.
  */
 export declare function restToCnrmShape(body: Record<string, unknown>): Record<string, unknown>;
+/** What a refiner may need beyond the tree: the read's project, and the REST
+ * payload's own full resource name (`projects/p/locations/l/services/s`). */
+interface RefineContext {
+    project: string;
+    restName?: string;
+}
+/**
+ * A REST payload as a CNRM-shaped property tree, in the declared side's
+ * vocabulary. The generic reshape runs first, then the full resource path is
+ * shortened to the declared `metadata.name` (`projects/p/topics/t` -> `t`),
+ * then the kind's own refiner translates what the two schemas name
+ * differently.
+ */
+export declare function toCnrmTree(kind: string, body: Record<string, unknown>, ctx: RefineContext): Record<string, unknown>;
 /**
- * Read the live property tree for each declared entity via `kubectl get
- * <kind>.<group> -o json`, pruning by `metadata.managedFields` (see the
- * module doc). Reuses `./describe-resources.ts`'s exact cluster-binding
- * resolution and kubectl mechanics — the binding check (chant #1100) still
- * refuses before any resource is touched, and a connect failure still
- * becomes NOT-OBSERVED for every declared entity rather than an empty result.
+ * Read the live property tree for each declared entity over the applier's
+ * REST transport, normalized into the declared CNRM shape (see the module
+ * doc). A connect failure becomes NOT-OBSERVED for every declared entity
+ * rather than an empty result, and a 404 is a real absence the thin read
+ * already reports.
  */
 export declare function observeResourcesDeepGcp(options: GcpDeepObserveOptions): Promise<DeepObservationResult>;
 //# sourceMappingURL=deep-observe.d.ts.map

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoHG;AAEH,OAAO,KAAK,EAEV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0F5G"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAajE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AAUD;6EAC6E;AAC7E,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA+DD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnH;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4F5G"}

package/dist/describe-resources.d.ts

@@ -58,14 +58,38 @@ interface GcpRestResponse {
     };
 }
 /**
- * Mirror of `lexicons/gcp/src/serializer.ts:deriveGVKFromType` — keeping the
- * derivation logic local so describeResources can compute the kubectl resource
- * name without importing serializer internals.
+ * The CNRM group/kind for an entity type, resolved through the serializer's
+ * own GVK map so the reader and the manifest agree on the kind's casing —
+ * `GCP::Pubsub::Topic` is `PubSubTopic` in CNRM and in the applier's mapper
+ * table, while a naive `${service}${shortKind}` concatenation would produce
+ * `PubsubTopic` and silently miss the mapper for 4 of the 6 appliable kinds.
  */
 export declare function deriveGVK(entityType: string): {
     group: string;
     kind: string;
 } | null;
+/**
+ * The `cnrm.cloud.google.com/project-id` annotations in the built manifest,
+ * keyed `kind/name`.
+ *
+ * The declared entities the observe paths receive are discovery output, and a
+ * project-wide `defaultAnnotations({"cnrm.cloud.google.com/project-id": …})`
+ * is a separate declarable the serializer merges into each document at
+ * synthesis — the entity's own props never see it. The applier resolves its
+ * project from the manifest for exactly that reason, so the readers do too:
+ * without this, every entity relying on the default annotation reports
+ * `no-binding` unless the shell happens to export GOOGLE_CLOUD_PROJECT.
+ */
+export declare function manifestProjectAnnotations(buildOutput: string | undefined): Map<string, string>;
+/**
+ * The project a read should target: `GOOGLE_CLOUD_PROJECT` / the entity's own
+ * annotation (via `resolveGcpProject`, the applier's rule), then the built
+ * manifest's merged annotation. Throws the applier's own error when nothing
+ * resolves, so the `no-binding` detail names both knobs.
+ */
+export declare function resolveReadProject(kind: string, name: string, metadata: {
+    annotations?: Record<string, string>;
+} | undefined, manifestProjects: Map<string, string>): string;
 /**
  * Status from a REST payload.
  *

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAqBtG;;gCAEgC;AAChC,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASpF;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAY3D;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmH7B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,MAAM,0BAA0B,CAAC;AAsBtG;;gCAEgC;AAChC,UAAU,eAAe;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxF,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACtB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIpF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB/F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,SAAS,EAC9D,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACpC,MAAM,CAQR;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAY3D;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqH7B"}

package/dist/governance.d.ts

@@ -0,0 +1,101 @@
+/**
+ * GCP governance authoring (#791, epic #787 C1): the desired-state config
+ * shape the GCP cloud warden reconciles, and `landingZoneConfig()` — the
+ * typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven folder tree walker cannot be one. The split mirrors the AWS
+ * slice (lexicons/aws/src/governance.ts): authoring emits config (this
+ * module, arbitrary cardinality); resources for greenfield bootstrap are the
+ * fixed-shape composites in `composites/landing-zone.ts`; the warden
+ * consumes only the config.
+ *
+ * GCP has no OrganizationRoot analog — organizations are created through
+ * Cloud Identity / Workspace, never through the resource API.
+ */
+/** An org-policy definition, keyed by name in `GcpGovernanceConfig.orgPolicies`. */
+export interface OrgPolicyConfig {
+    description?: string;
+    /** The constraint the policy binds, e.g. "iam.disableServiceAccountKeyCreation". */
+    constraint: string;
+    /** OrgPolicyPolicy `spec.rules` entries (enforce / values.allowedValues / …). */
+    rules: Array<Record<string, unknown>>;
+}
+/** A project declared inside a folder. */
+export interface ProjectConfig {
+    name: string;
+    /** Defaults to `name`. */
+    projectId?: string;
+}
+/** One folder: its guardrails, projects, and child folders, keyed by display name. */
+export interface FolderConfig {
+    /** Names of org policies (from `orgPolicies`) attached to this folder. */
+    orgPolicies?: string[];
+    projects?: ProjectConfig[];
+    children?: Record<string, FolderConfig>;
+}
+/**
+ * The desired-state governance tree for one GCP organization. This is the
+ * shape the GCP cloud warden loads as config — the GCP counterpart of
+ * `AwsGovernanceConfig`. Cycles map onto the governance verbs (#790): the
+ * folder/project tree is `org-unit`, org policies are `policy-guardrail`,
+ * audit configuration is `audit-sink`.
+ */
+export interface GcpGovernanceConfig {
+    organization: {
+        /** Org-policy names enforced at the organization root. */
+        orgPolicies?: string[];
+    };
+    /** Top-level folders under the organization, keyed by display name. */
+    folders: Record<string, FolderConfig>;
+    /** Org-policy definitions, keyed by the names the tree attaches. */
+    orgPolicies: Record<string, OrgPolicyConfig>;
+    /** Where audit evidence flows. */
+    auditSinks?: {
+        auditConfig?: {
+            service: string;
+            logTypes: string[];
+        };
+    };
+}
+export declare const DISABLE_SA_KEY_CREATION: OrgPolicyConfig;
+export declare const SKIP_DEFAULT_NETWORK: OrgPolicyConfig;
+/** Allow resource creation only in `locations` (value-group syntax like "in:us-locations" works too). */
+export declare function resourceLocationRestriction(locations: readonly string[]): OrgPolicyConfig;
+/** The audit-log coverage `auditAllServices` declares. */
+export declare const AUDIT_ALL_SERVICES: {
+    readonly service: "allServices";
+    readonly logTypes: readonly ["ADMIN_READ", "DATA_READ", "DATA_WRITE"];
+};
+/**
+ * The recommended foundation folder structure. Exported so callers can
+ * extend it rather than restate it.
+ */
+export declare const FOUNDATION_FOLDERS: Record<string, FolderConfig>;
+export interface LandingZoneConfigProps {
+    /**
+     * Start from the recommended foundation: Security / Infrastructure /
+     * Sandbox / Workloads folders with `disable-sa-key-creation` and
+     * `skip-default-network` enforced at the organization root. Default true;
+     * your `folders`/`orgPolicies` merge over it (same-name keys win).
+     */
+    foundation?: boolean;
+    /** Adds a root resource-location org policy allowing only these locations. */
+    allowedLocations?: string[];
+    /** Folder tree, merged over the foundation's. Greenfield (full tree) and brownfield (partial subtree) are both just this map. */
+    folders?: Record<string, FolderConfig>;
+    /** Org-policy definitions, merged over the foundation's. */
+    orgPolicies?: Record<string, OrgPolicyConfig>;
+    /** Extra org-policy names to enforce at the organization root. */
+    rootOrgPolicies?: string[];
+    /** Declare organization-wide audit logging (allServices, all three log types). */
+    auditAllServices?: boolean;
+}
+/**
+ * Author the desired-state tree the GCP cloud warden reconciles. Pure.
+ * Throws when the tree attaches an org-policy name with no definition; only
+ * policies the tree actually attaches are included in the output.
+ */
+export declare function landingZoneConfig(props?: LandingZoneConfigProps): GcpGovernanceConfig;
+//# sourceMappingURL=governance.d.ts.map

package/dist/governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvC;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC3B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACzC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE;QACZ,0DAA0D;QAC1D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC7C,kCAAkC;IAClC,UAAU,CAAC,EAAE;QACX,WAAW,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KACvD,CAAC;CACH;AAMD,eAAO,MAAM,uBAAuB,EAAE,eAIrC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,eAIlC,CAAC;AAEF,yGAAyG;AACzG,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAMzF;AAED,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB;;;CAGrB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAK3D,CAAC;AAMF,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iIAAiI;IACjI,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC9C,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,sBAA2B,GAAG,mBAAmB,CAwCzF"}

package/dist/index.d.ts

@@ -5,8 +5,10 @@ export { DEFAULT_LABELS_MARKER, DEFAULT_ANNOTATIONS_MARKER } from "./default-lab
 export { GCP, ProjectId, Region, Zone } from "./pseudo.js";
 export { GcpAnnotations } from "./variables.js";
 export * from "./generated/index.js";
-export { GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork, PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject, MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, } from "./composites/index.js";
-export type { GkeClusterProps, CloudRunServiceProps, CloudSqlInstanceProps, GcsBucketProps, VpcNetworkProps, VpcSubnet, PubSubPipelineProps, CloudFunctionWithTriggerProps, PrivateServiceProps, ManagedCertificateProps, SecureProjectProps, MemorystoreRedisProps, MultiRegionVpcConfig, MultiRegionVpcRegion, GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig, } from "./composites/index.js";
+export { GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork, PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject, MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GovernanceFoundation, LocationRestriction, OrganizationAuditConfig, } from "./composites/index.js";
+export type { GkeClusterProps, CloudRunServiceProps, CloudSqlInstanceProps, GcsBucketProps, VpcNetworkProps, VpcSubnet, PubSubPipelineProps, CloudFunctionWithTriggerProps, PrivateServiceProps, ManagedCertificateProps, SecureProjectProps, MemorystoreRedisProps, MultiRegionVpcConfig, MultiRegionVpcRegion, GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig, GovernanceFoundationProps, LocationRestrictionProps, OrganizationAuditConfigProps, } from "./composites/index.js";
+export { landingZoneConfig, resourceLocationRestriction, DISABLE_SA_KEY_CREATION, SKIP_DEFAULT_NETWORK, AUDIT_ALL_SERVICES, FOUNDATION_FOLDERS, } from "./governance.js";
+export type { GcpGovernanceConfig, LandingZoneConfigProps, FolderConfig, OrgPolicyConfig, ProjectConfig } from "./governance.js";
 export { StorageRoles, ComputeRoles, ContainerRoles, IAMRoles, SQLRoles, RunRoles, PubSubRoles } from "./actions/index.js";
 export { fetchCRDBundle, getCachePath, clearCache, KCC_VERSION } from "./spec/fetch.js";
 export { parseGcpCRD, gcpServiceName, gcpShortName, gcpTypeName, stripServicePrefix } from "./spec/parse.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7C,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,UAAU,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAC7E,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAC3F,gBAAgB,EAAE,cAAc,EAAE,aAAa,GAChD,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EAAE,SAAS,EAC1B,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAAE,oBAAoB,EAC1C,mBAAmB,EAAE,uBAAuB,GAC7C,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGxH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAGrF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAI7C,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,UAAU,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAC7E,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAC3F,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAC/C,oBAAoB,EAAE,mBAAmB,EAAE,uBAAuB,GACnE,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,eAAe,EAAE,SAAS,EAC1B,mBAAmB,EACnB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EAAE,oBAAoB,EAC1C,mBAAmB,EAAE,uBAAuB,EAC5C,yBAAyB,EAAE,wBAAwB,EAAE,4BAA4B,GAClF,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,2BAA2B,EAC9C,uBAAuB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,kBAAkB,GACtF,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG9H,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAGxH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1G,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrI,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "e5af48d634795be138922171429f6d971b4c7e6dc8d758b420a00f4c9368bcaf",
+    "manifest.json": "a77b96031861d35097dbe5d31f4e5fd6a709f5992c20e887bdc6b8db3680c145",
     "meta.json": "475f10909854d059a2e2d4fb541c058803422e38b9c64bd4d6858c0623eedb8c",
     "types/index.d.ts": "5433b54c04b57d6fda8f3d81ef92ed0aca87f7e8e5dd3ea92d8de6e62a3ccfab",
     "rules/hardcoded-project.ts": "228631d3159e1ffcce2359c66073d4ae59bb0285f378e46e446f416aec50481c",
@@ -32,10 +32,13 @@
     "rules/wgc401.ts": "287a28258a6987eacf4228df8e57cdc6d5357d5efcb35a732fb01e4b7b8ce797",
     "rules/wgc402.ts": "4dacefea0ead25987ded5f8f5b83d02d2aa957f3816a7d0cc602cc9872257458",
     "rules/wgc403.ts": "156a8af8f8e419d36e740f4fc6f2ed7576a1692e3286e4c9ca6f9e9ccf772965",
+    "rules/wgc501.ts": "9684ce2c6aa6585aad72eba06386623cffc7790c8c5e928c53677cb2ea6a0160",
+    "rules/wgc502.ts": "d82bea32a0d21c715f59b6ee2343357bd15ffb1a2fc18d4fb5102593595c0d46",
+    "rules/wgc503.ts": "bbd1a2ba8189ef07ba921b46b57be507b62bca0342f86c3ec0292ba250406991",
     "skills/chant-gcp.md": "6fd732fb5df2fd6561b4b704379f6779ff4ac12e3069ea4f641d9b222e0c3c81",
     "skills/chant-gcp-security.md": "39a1c97b7425ed43b081257132449d11ce9d12f2d4755fc30d8b14bbc38f60bd",
     "skills/chant-gcp-patterns.md": "a7ef31c1eb2f7244d3f73952c300472ef94c1eb09bd7a1003281b89299b6b704",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "722b80ea5c02b4272d296c6fe65732c4381ba11655a3be692d7e6cda044270a7"
+  "composite": "09c15cce67a44ee4ad75992a765d524d07f8dc97edc20c166dc3f3c92b5d0506"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAI1F,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAwBpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAI1F,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6BpD,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAyBvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAwB3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA4BvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA2B3C,CAAC"}

package/dist/lint/post-synth/wgc501.d.ts

@@ -0,0 +1,18 @@
+/**
+ * WGC501: Org Policy Guardrail Not Enforced (#793, epic #787 C3)
+ *
+ * Flags OrgPolicyPolicy resources whose rules switch enforcement off or that
+ * reset the constraint to its default. A disabled org policy is the GCP
+ * shape of a weakened guardrail: the constraint stays visible in the tree
+ * while constraining nothing.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { type GcpManifest } from "./gcp-helpers.js";
+/**
+ * OrgPolicyPolicy mirrors the API's own `spec` inside the CRD spec, so rules
+ * live at `spec.spec.rules`; accept `spec.rules` too for hand-written manifests.
+ */
+export declare function orgPolicySpec(manifest: GcpManifest): Record<string, unknown>;
+export declare function orgPolicyRules(manifest: GcpManifest): Array<Record<string, unknown>>;
+export declare const wgc501: PostSynthCheck;
+//# sourceMappingURL=wgc501.d.ts.map

package/dist/lint/post-synth/wgc501.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wgc501.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/wgc501.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAC9G,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAErF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI5E;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAGpF;AAMD,eAAO,MAAM,MAAM,EAAE,cAyCpB,CAAC"}