@intentius/chant-lexicon-gcp 0.41.20 → 0.44.1

package/dist/okf/types/VertexaiIndex.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: VertexaiIndex
+description: gcp resource type GCP::Vertexai::Index
+name: VertexaiIndex
+lexicon: gcp
+resource_type: GCP::Vertexai::Index
+---
+`GCP::Vertexai::Index`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/VirtualMachine.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: VirtualMachine
+description: gcp resource type GCP::Tpu::VirtualMachine
+name: VirtualMachine
+lexicon: gcp
+resource_type: GCP::Tpu::VirtualMachine
+---
+`GCP::Tpu::VirtualMachine`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/VmwareengineNetwork.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: VmwareengineNetwork
+description: gcp resource type GCP::Vmwareengine::Network
+name: VmwareengineNetwork
+lexicon: gcp
+resource_type: GCP::Vmwareengine::Network
+---
+`GCP::Vmwareengine::Network`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/VmwareengineNetworkPeering.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: VmwareengineNetworkPeering
+description: gcp resource type GCP::Vmwareengine::NetworkPeering
+name: VmwareengineNetworkPeering
+lexicon: gcp
+resource_type: GCP::Vmwareengine::NetworkPeering
+---
+`GCP::Vmwareengine::NetworkPeering`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/VpnConnection.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: VpnConnection
+description: gcp resource type GCP::Edgecontainer::VpnConnection
+name: VpnConnection
+lexicon: gcp
+resource_type: GCP::Edgecontainer::VpnConnection
+---
+`GCP::Edgecontainer::VpnConnection`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WasmPlugin.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WasmPlugin
+description: gcp resource type GCP::Networkservices::WasmPlugin
+name: WasmPlugin
+lexicon: gcp
+resource_type: GCP::Networkservices::WasmPlugin
+---
+`GCP::Networkservices::WasmPlugin`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WebApp.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WebApp
+description: gcp resource type GCP::Firebase::WebApp
+name: WebApp
+lexicon: gcp
+resource_type: GCP::Firebase::WebApp
+---
+`GCP::Firebase::WebApp`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/Webhook.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: Webhook
+description: gcp resource type GCP::Dialogflowcx::Webhook
+name: Webhook
+lexicon: gcp
+resource_type: GCP::Dialogflowcx::Webhook
+---
+`GCP::Dialogflowcx::Webhook`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WorkerPool.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WorkerPool
+description: gcp resource type GCP::Cloudbuild::WorkerPool
+name: WorkerPool
+lexicon: gcp
+resource_type: GCP::Cloudbuild::WorkerPool
+---
+`GCP::Cloudbuild::WorkerPool`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/Workflow.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: Workflow
+description: gcp resource type GCP::Workflows::Workflow
+name: Workflow
+lexicon: gcp
+resource_type: GCP::Workflows::Workflow
+---
+`GCP::Workflows::Workflow`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WorkflowTemplate.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WorkflowTemplate
+description: gcp resource type GCP::Dataproc::WorkflowTemplate
+name: WorkflowTemplate
+lexicon: gcp
+resource_type: GCP::Dataproc::WorkflowTemplate
+---
+`GCP::Dataproc::WorkflowTemplate`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WorkflowsExecution.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WorkflowsExecution
+description: gcp resource type GCP::Workflowexecutions::WorkflowsExecution
+name: WorkflowsExecution
+lexicon: gcp
+resource_type: GCP::Workflowexecutions::WorkflowsExecution
+---
+`GCP::Workflowexecutions::WorkflowsExecution`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WorkforcePool.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WorkforcePool
+description: gcp resource type GCP::Iam::WorkforcePool
+name: WorkforcePool
+lexicon: gcp
+resource_type: GCP::Iam::WorkforcePool
+---
+`GCP::Iam::WorkforcePool`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WorkforcePoolProvider.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WorkforcePoolProvider
+description: gcp resource type GCP::Iam::WorkforcePoolProvider
+name: WorkforcePoolProvider
+lexicon: gcp
+resource_type: GCP::Iam::WorkforcePoolProvider
+---
+`GCP::Iam::WorkforcePoolProvider`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/Workload.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: Workload
+description: gcp resource type GCP::Assuredworkloads::Workload
+name: Workload
+lexicon: gcp
+resource_type: GCP::Assuredworkloads::Workload
+---
+`GCP::Assuredworkloads::Workload`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WorkloadIdentityPool.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WorkloadIdentityPool
+description: gcp resource type GCP::Iam::WorkloadIdentityPool
+name: WorkloadIdentityPool
+lexicon: gcp
+resource_type: GCP::Iam::WorkloadIdentityPool
+---
+`GCP::Iam::WorkloadIdentityPool`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WorkloadIdentityPoolProvider.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WorkloadIdentityPoolProvider
+description: gcp resource type GCP::Iam::WorkloadIdentityPoolProvider
+name: WorkloadIdentityPoolProvider
+lexicon: gcp
+resource_type: GCP::Iam::WorkloadIdentityPoolProvider
+---
+`GCP::Iam::WorkloadIdentityPoolProvider`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/Workstation.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: Workstation
+description: gcp resource type GCP::Workstations::Workstation
+name: Workstation
+lexicon: gcp
+resource_type: GCP::Workstations::Workstation
+---
+`GCP::Workstations::Workstation`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WorkstationCluster.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WorkstationCluster
+description: gcp resource type GCP::Workstations::WorkstationCluster
+name: WorkstationCluster
+lexicon: gcp
+resource_type: GCP::Workstations::WorkstationCluster
+---
+`GCP::Workstations::WorkstationCluster`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/WorkstationConfig.md

@@ -0,0 +1,15 @@
+---
+type: resource-type
+title: WorkstationConfig
+description: gcp resource type GCP::Workstations::WorkstationConfig
+name: WorkstationConfig
+lexicon: gcp
+resource_type: GCP::Workstations::WorkstationConfig
+---
+`GCP::Workstations::WorkstationConfig`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`

package/dist/okf/types/Zone.md

@@ -0,0 +1,19 @@
+---
+type: resource-type
+title: Zone
+description: gcp resource type GCP::Dataplex::Zone
+name: Zone
+lexicon: gcp
+resource_type: GCP::Dataplex::Zone
+---
+`GCP::Dataplex::Zone`, a resource type of the gcp lexicon.
+
+## Attributes
+
+- `string`
+- `string`
+- `string`
+
+## Governed by
+
+- [WGC002](/rules/WGC002.md): Hardcoded GCP Region/Zone

package/dist/rules/wgc501.ts

@@ -0,0 +1,73 @@
+/**
+ * WGC501: Org Policy Guardrail Not Enforced (#793, epic #787 C3)
+ *
+ * Flags OrgPolicyPolicy resources whose rules switch enforcement off or that
+ * reset the constraint to its default. A disabled org policy is the GCP
+ * shape of a weakened guardrail: the constraint stays visible in the tree
+ * while constraining nothing.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseGcpManifests, getResourceName, type GcpManifest } from "./gcp-helpers";
+
+/**
+ * OrgPolicyPolicy mirrors the API's own `spec` inside the CRD spec, so rules
+ * live at `spec.spec.rules`; accept `spec.rules` too for hand-written manifests.
+ */
+export function orgPolicySpec(manifest: GcpManifest): Record<string, unknown> {
+  const outer = manifest.spec ?? {};
+  const inner = outer.spec;
+  return typeof inner === "object" && inner !== null ? (inner as Record<string, unknown>) : outer;
+}
+
+export function orgPolicyRules(manifest: GcpManifest): Array<Record<string, unknown>> {
+  const rules = orgPolicySpec(manifest).rules;
+  return Array.isArray(rules) ? (rules as Array<Record<string, unknown>>) : [];
+}
+
+function isDisabled(rule: Record<string, unknown>): boolean {
+  return rule.enforce === false || rule.enforce === "FALSE";
+}
+
+export const wgc501: PostSynthCheck = {
+  id: "WGC501",
+  description: "Org Policy guardrail not enforced — a disabled policy constrains nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      if (typeof output !== "string") continue;
+
+      for (const manifest of parseGcpManifests(output)) {
+        if (manifest.kind !== "OrgPolicyPolicy") continue;
+        const name = getResourceName(manifest);
+
+        if (orgPolicySpec(manifest).reset === true) {
+          diagnostics.push({
+            checkId: "WGC501",
+            severity: "error",
+            message: `OrgPolicyPolicy "${name}" resets the constraint to its default — the guardrail is switched off`,
+            entity: name,
+            lexicon: "gcp",
+          });
+          continue;
+        }
+
+        for (const rule of orgPolicyRules(manifest)) {
+          if (isDisabled(rule)) {
+            diagnostics.push({
+              checkId: "WGC501",
+              severity: "error",
+              message: `OrgPolicyPolicy "${name}" has a rule with enforce disabled — the guardrail is declared but not enforced`,
+              entity: name,
+              lexicon: "gcp",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgc502.ts

@@ -0,0 +1,41 @@
+/**
+ * WGC502: Org Policy Guardrail Defines No Rules (#793, epic #787 C3)
+ *
+ * Flags OrgPolicyPolicy resources with no rules (and no reset). A rule-less
+ * org policy binds a constraint to nothing — the usual leftover of a
+ * guardrail whose rules were removed while the policy object was kept.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseGcpManifests, getResourceName } from "./gcp-helpers";
+import { orgPolicyRules, orgPolicySpec } from "./wgc501";
+
+export const wgc502: PostSynthCheck = {
+  id: "WGC502",
+  description: "Org Policy guardrail defines no rules — it binds its constraint to nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      if (typeof output !== "string") continue;
+
+      for (const manifest of parseGcpManifests(output)) {
+        if (manifest.kind !== "OrgPolicyPolicy") continue;
+        if (orgPolicySpec(manifest).reset === true) continue; // WGC501's finding
+        if (orgPolicyRules(manifest).length > 0) continue;
+
+        const name = getResourceName(manifest);
+        diagnostics.push({
+          checkId: "WGC502",
+          severity: "error",
+          message: `OrgPolicyPolicy "${name}" defines no rules — the guardrail constrains nothing`,
+          entity: name,
+          lexicon: "gcp",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/wgc503.ts

@@ -0,0 +1,56 @@
+/**
+ * WGC503: Audit Logging Dropped or Scoped Down (#793, epic #787 C3)
+ *
+ * Flags IAMAuditConfig resources that capture nothing (no auditLogConfigs)
+ * or that carve identities out of the audit trail via exemptedMembers.
+ * WGC301 reports the absence of any IAMAuditConfig as hygiene; this check
+ * covers the declared-but-weakened sink, which is merge-worthy.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseGcpManifests, getResourceName, getSpec } from "./gcp-helpers";
+
+export const wgc503: PostSynthCheck = {
+  id: "WGC503",
+  description: "IAMAuditConfig captures nothing or exempts members — the audit sink is scoped down",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [, output] of ctx.outputs) {
+      if (typeof output !== "string") continue;
+
+      for (const manifest of parseGcpManifests(output)) {
+        if (manifest.kind !== "IAMAuditConfig") continue;
+        const name = getResourceName(manifest);
+        const configs = getSpec(manifest)?.auditLogConfigs;
+
+        if (!Array.isArray(configs) || configs.length === 0) {
+          diagnostics.push({
+            checkId: "WGC503",
+            severity: "error",
+            message: `IAMAuditConfig "${name}" has no auditLogConfigs — the audit sink is declared but captures nothing`,
+            entity: name,
+            lexicon: "gcp",
+          });
+          continue;
+        }
+
+        for (const config of configs as Array<Record<string, unknown>>) {
+          const exempted = config.exemptedMembers;
+          if (Array.isArray(exempted) && exempted.length > 0) {
+            diagnostics.push({
+              checkId: "WGC503",
+              severity: "error",
+              message: `IAMAuditConfig "${name}" exempts members from ${String(config.logType ?? "audit")} logging — audit evidence is scoped down`,
+              entity: name,
+              lexicon: "gcp",
+            });
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/serializer.d.ts

@@ -5,6 +5,18 @@
  * for Config Connector resources with apiVersion, kind, metadata, and spec.
  */
 import type { Serializer } from "@intentius/chant/serializer";
+/**
+ * Resolve entityType to apiVersion and kind.
+ *
+ * Exported for the read paths (./describe-resources.ts): the CNRM kind is the
+ * key into the applier's mapper table, and the packaged map is the only place
+ * that knows `GCP::Pubsub::Topic` is `PubSubTopic` rather than the naive
+ * `PubsubTopic` the fallback derivation would produce.
+ */
+export declare function resolveGVK(entityType: string): {
+    apiVersion: string;
+    kind: string;
+} | null;
 /**
  * GCP Config Connector YAML serializer implementation.
  */

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAsGlG;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA2F3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAiClG;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW1F;AAuDD;;GAEG;AACH,eAAO,MAAM,aAAa,EAAE,UA2F3B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.41.20",
+  "version": "0.44.1",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.41.20",
+    "@intentius/chant": "^0.44.1",
     "typescript": "^5.9.3"
   }
 }

package/src/composites/index.ts

@@ -1,3 +1,9 @@
+export { GovernanceFoundation, LocationRestriction, OrganizationAuditConfig } from "./landing-zone";
+export type {
+  GovernanceFoundationProps,
+  LocationRestrictionProps,
+  OrganizationAuditConfigProps,
+} from "./landing-zone";
 export { GkeCluster } from "./gke-cluster";
 export type { GkeClusterProps } from "./gke-cluster";
 export { CloudRunServiceComposite } from "./cloud-run-service";

package/src/composites/landing-zone.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, test } from "vitest";
+import { expandComposite } from "@intentius/chant";
+import { GovernanceFoundation, LocationRestriction, OrganizationAuditConfig } from "./landing-zone";
+
+/** Helper to extract props from a Declarable member. */
+function p(member: unknown): Record<string, any> {
+  return (member as any).props;
+}
+
+describe("GovernanceFoundation (#791)", () => {
+  test("declares the foundation folders and baseline org policies", () => {
+    const lz = GovernanceFoundation({ orgId: "123456789012" });
+    expect(Object.keys(lz.members)).toEqual([
+      "folderSecurity",
+      "folderInfrastructure",
+      "folderSandbox",
+      "folderWorkloads",
+      "policyDisableSaKeyCreation",
+      "policySkipDefaultNetwork",
+    ]);
+  });
+
+  test("folders hang off the organization; policies bind their constraints at the root", () => {
+    const lz = GovernanceFoundation({ orgId: "123456789012" });
+    expect(p(lz.folderSecurity).displayName).toBe("Security");
+    expect(p(lz.folderSecurity).organizationRef).toEqual({ external: "123456789012" });
+    expect(p(lz.policyDisableSaKeyCreation).resourceID).toBe("iam.disableServiceAccountKeyCreation");
+    expect(p(lz.policyDisableSaKeyCreation).organizationRef).toEqual({ external: "123456789012" });
+    expect(p(lz.policyDisableSaKeyCreation).spec.rules).toEqual([{ enforce: "TRUE" }]);
+    expect(p(lz.policySkipDefaultNetwork).resourceID).toBe("compute.skipDefaultNetworkCreation");
+  });
+
+  test("orgId accepts both the bare number and the organizations/ prefix", () => {
+    const prefixed = GovernanceFoundation({ orgId: "organizations/123456789012" });
+    expect(p(prefixed.folderSandbox).organizationRef).toEqual({ external: "123456789012" });
+  });
+
+  test("namespace flows to every member", () => {
+    const lz = GovernanceFoundation({ orgId: "123456789012", namespace: "governance" });
+    expect(p(lz.folderWorkloads).metadata.namespace).toBe("governance");
+    expect(p(lz.policySkipDefaultNetwork).metadata.namespace).toBe("governance");
+  });
+
+  test("expandComposite produces prefixed logical names", () => {
+    const expanded = expandComposite("lz", GovernanceFoundation({ orgId: "123456789012" }));
+    expect([...expanded.keys()]).toContain("lzFolderSecurity");
+    expect([...expanded.keys()]).toContain("lzPolicyDisableSaKeyCreation");
+    expect(expanded.size).toBe(6);
+  });
+
+  test("LocationRestriction and OrganizationAuditConfig carry the optional guardrails", () => {
+    const lr = LocationRestriction({ orgId: "123456789012", locations: ["in:eu-locations"] });
+    expect(p(lr.policyResourceLocations).resourceID).toBe("gcp.resourceLocations");
+    expect(JSON.stringify(p(lr.policyResourceLocations).spec.rules)).toContain("in:eu-locations");
+
+    const ac = OrganizationAuditConfig({ orgId: "organizations/123456789012" });
+    expect(p(ac.auditConfig)).toMatchObject({
+      resourceRef: { kind: "Organization", external: "organizations/123456789012" },
+      service: "allServices",
+    });
+    expect(p(ac.auditConfig).auditLogConfigs).toEqual([
+      { logType: "ADMIN_READ" },
+      { logType: "DATA_READ" },
+      { logType: "DATA_WRITE" },
+    ]);
+  });
+});