@intentius/chant-lexicon-gcp 0.44.1 → 0.44.2

package/dist/composites/landing-zone.d.ts

@@ -1,12 +1,12 @@
 /**
- * Landing-zone bootstrap composites (#791, epic #787 C1) — the GCP slice.
+ * Landing-zone bootstrap composites — the GCP slice.
  *
  * Fixed-shape resources for greenfield creation of the recommended
  * governance foundation through a Config Connector management stack. The
  * evaluability rules (EVL002/004) require composites to declare a fixed set
  * of resources, so these carry the foundation only; arbitrary folder/project
  * trees are authored as config with `landingZoneConfig()` (../governance.ts)
- * and reconciled by the GCP cloud warden, and further folders/projects are
+ * and reconciled by an external governance reconciler, and further folders/projects are
  * declared as ordinary resources.
  *
  * The pieces compose:

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
 /**
- * GCP governance authoring (#791, epic #787 C1): the desired-state config
- * shape the GCP cloud warden reconciles, and `landingZoneConfig()` — the
+ * GCP governance authoring: the desired-state config
+ * shape an external governance reconciler reconciles, and `landingZoneConfig()` — the
  * typed authoring layer that emits it.
  *
  * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
@@ -8,7 +8,7 @@
  * data-driven folder tree walker cannot be one. The split mirrors the AWS
  * slice (lexicons/aws/src/governance.ts): authoring emits config (this
  * module, arbitrary cardinality); resources for greenfield bootstrap are the
- * fixed-shape composites in `composites/landing-zone.ts`; the warden
+ * fixed-shape composites in `composites/landing-zone.ts`; the reconciler
  * consumes only the config.
  *
  * GCP has no OrganizationRoot analog — organizations are created through
@@ -37,8 +37,8 @@ export interface FolderConfig {
 }
 /**
  * The desired-state governance tree for one GCP organization. This is the
- * shape the GCP cloud warden loads as config — the GCP counterpart of
- * `AwsGovernanceConfig`. Cycles map onto the governance verbs (#790): the
+ * shape an external governance reconciler loads as config — the GCP counterpart of
+ * `AwsGovernanceConfig`. Cycles map onto the governance verbs: the
  * folder/project tree is `org-unit`, org policies are `policy-guardrail`,
  * audit configuration is `audit-sink`.
  */
@@ -93,7 +93,7 @@ export interface LandingZoneConfigProps {
     auditAllServices?: boolean;
 }
 /**
- * Author the desired-state tree the GCP cloud warden reconciles. Pure.
+ * Author the desired-state tree an external governance reconciler reconciles. Pure.
  * Throws when the tree attaches an org-policy name with no definition; only
  * policies the tree actually attaches are included in the output.
  */

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "a77b96031861d35097dbe5d31f4e5fd6a709f5992c20e887bdc6b8db3680c145",
+    "manifest.json": "aa850a2fa5518536aa451e735570ad0a7a633ee97f1b5e5d26979495768a3a95",
     "meta.json": "475f10909854d059a2e2d4fb541c058803422e38b9c64bd4d6858c0623eedb8c",
     "types/index.d.ts": "5433b54c04b57d6fda8f3d81ef92ed0aca87f7e8e5dd3ea92d8de6e62a3ccfab",
     "rules/hardcoded-project.ts": "228631d3159e1ffcce2359c66073d4ae59bb0285f378e46e446f416aec50481c",
@@ -32,13 +32,13 @@
     "rules/wgc401.ts": "287a28258a6987eacf4228df8e57cdc6d5357d5efcb35a732fb01e4b7b8ce797",
     "rules/wgc402.ts": "4dacefea0ead25987ded5f8f5b83d02d2aa957f3816a7d0cc602cc9872257458",
     "rules/wgc403.ts": "156a8af8f8e419d36e740f4fc6f2ed7576a1692e3286e4c9ca6f9e9ccf772965",
-    "rules/wgc501.ts": "9684ce2c6aa6585aad72eba06386623cffc7790c8c5e928c53677cb2ea6a0160",
-    "rules/wgc502.ts": "d82bea32a0d21c715f59b6ee2343357bd15ffb1a2fc18d4fb5102593595c0d46",
-    "rules/wgc503.ts": "bbd1a2ba8189ef07ba921b46b57be507b62bca0342f86c3ec0292ba250406991",
+    "rules/wgc501.ts": "bf99d8dc97537687fdfe9a8d5eb420172bf3279a4147311037f9c1d1f5fd4c85",
+    "rules/wgc502.ts": "6460a028f73ef31a66653954e67142079130112b70fa01a79f80464968a1b9f6",
+    "rules/wgc503.ts": "44dc51efbf9f9384b61a4e19b173b4c182557143cb59fbaf4da087e70a38f916",
     "skills/chant-gcp.md": "6fd732fb5df2fd6561b4b704379f6779ff4ac12e3069ea4f641d9b222e0c3c81",
     "skills/chant-gcp-security.md": "39a1c97b7425ed43b081257132449d11ce9d12f2d4755fc30d8b14bbc38f60bd",
     "skills/chant-gcp-patterns.md": "a7ef31c1eb2f7244d3f73952c300472ef94c1eb09bd7a1003281b89299b6b704",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "09c15cce67a44ee4ad75992a765d524d07f8dc97edc20c166dc3f3c92b5d0506"
+  "composite": "aa9608e822f035c8219ca487c3a3dc85d29f4ea9b081853df4436aa2fe784107"
 }

package/dist/lint/post-synth/wgc501.d.ts

@@ -1,5 +1,5 @@
 /**
- * WGC501: Org Policy Guardrail Not Enforced (#793, epic #787 C3)
+ * WGC501: Org Policy Guardrail Not Enforced
  *
  * Flags OrgPolicyPolicy resources whose rules switch enforcement off or that
  * reset the constraint to its default. A disabled org policy is the GCP

package/dist/lint/post-synth/wgc502.d.ts

@@ -1,5 +1,5 @@
 /**
- * WGC502: Org Policy Guardrail Defines No Rules (#793, epic #787 C3)
+ * WGC502: Org Policy Guardrail Defines No Rules
  *
  * Flags OrgPolicyPolicy resources with no rules (and no reset). A rule-less
  * org policy binds a constraint to nothing — the usual leftover of a

package/dist/lint/post-synth/wgc503.d.ts

@@ -1,5 +1,5 @@
 /**
- * WGC503: Audit Logging Dropped or Scoped Down (#793, epic #787 C3)
+ * WGC503: Audit Logging Dropped or Scoped Down
  *
  * Flags IAMAuditConfig resources that capture nothing (no auditLogConfigs)
  * or that carve identities out of the audit trail via exemptedMembers.

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.44.1",
+  "version": "0.44.2",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/dist/rules/wgc501.ts

@@ -1,5 +1,5 @@
 /**
- * WGC501: Org Policy Guardrail Not Enforced (#793, epic #787 C3)
+ * WGC501: Org Policy Guardrail Not Enforced 
  *
  * Flags OrgPolicyPolicy resources whose rules switch enforcement off or that
  * reset the constraint to its default. A disabled org policy is the GCP

package/dist/rules/wgc502.ts

@@ -1,5 +1,5 @@
 /**
- * WGC502: Org Policy Guardrail Defines No Rules (#793, epic #787 C3)
+ * WGC502: Org Policy Guardrail Defines No Rules 
  *
  * Flags OrgPolicyPolicy resources with no rules (and no reset). A rule-less
  * org policy binds a constraint to nothing — the usual leftover of a

package/dist/rules/wgc503.ts

@@ -1,5 +1,5 @@
 /**
- * WGC503: Audit Logging Dropped or Scoped Down (#793, epic #787 C3)
+ * WGC503: Audit Logging Dropped or Scoped Down 
  *
  * Flags IAMAuditConfig resources that capture nothing (no auditLogConfigs)
  * or that carve identities out of the audit trail via exemptedMembers.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.44.1",
+  "version": "0.44.2",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.44.1",
+    "@intentius/chant": "^0.44.2",
     "typescript": "^5.9.3"
   }
 }

package/src/composites/landing-zone.test.ts

@@ -7,7 +7,7 @@ function p(member: unknown): Record<string, any> {
   return (member as any).props;
 }
 
-describe("GovernanceFoundation (#791)", () => {
+describe("GovernanceFoundation", () => {
   test("declares the foundation folders and baseline org policies", () => {
     const lz = GovernanceFoundation({ orgId: "123456789012" });
     expect(Object.keys(lz.members)).toEqual([

package/src/composites/landing-zone.ts

@@ -1,12 +1,12 @@
 /**
- * Landing-zone bootstrap composites (#791, epic #787 C1) — the GCP slice.
+ * Landing-zone bootstrap composites — the GCP slice.
  *
  * Fixed-shape resources for greenfield creation of the recommended
  * governance foundation through a Config Connector management stack. The
  * evaluability rules (EVL002/004) require composites to declare a fixed set
  * of resources, so these carry the foundation only; arbitrary folder/project
  * trees are authored as config with `landingZoneConfig()` (../governance.ts)
- * and reconciled by the GCP cloud warden, and further folders/projects are
+ * and reconciled by an external governance reconciler, and further folders/projects are
  * declared as ordinary resources.
  *
  * The pieces compose:

package/src/governance.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "vitest";
 import { landingZoneConfig, FOUNDATION_FOLDERS } from "./governance";
 
-describe("landingZoneConfig (#791)", () => {
+describe("landingZoneConfig", () => {
   test("the default is the recommended foundation", () => {
     const cfg = landingZoneConfig();
     expect(Object.keys(cfg.folders)).toEqual(["Security", "Infrastructure", "Sandbox", "Workloads"]);

package/src/governance.ts

@@ -1,6 +1,6 @@
 /**
- * GCP governance authoring (#791, epic #787 C1): the desired-state config
- * shape the GCP cloud warden reconciles, and `landingZoneConfig()` — the
+ * GCP governance authoring: the desired-state config
+ * shape an external governance reconciler reconciles, and `landingZoneConfig()` — the
  * typed authoring layer that emits it.
  *
  * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
@@ -8,7 +8,7 @@
  * data-driven folder tree walker cannot be one. The split mirrors the AWS
  * slice (lexicons/aws/src/governance.ts): authoring emits config (this
  * module, arbitrary cardinality); resources for greenfield bootstrap are the
- * fixed-shape composites in `composites/landing-zone.ts`; the warden
+ * fixed-shape composites in `composites/landing-zone.ts`; the reconciler
  * consumes only the config.
  *
  * GCP has no OrganizationRoot analog — organizations are created through
@@ -16,7 +16,7 @@
  */
 
 // ---------------------------------------------------------------------------
-// The desired-state config shape the GCP cloud warden consumes
+// The desired-state config shape an external governance reconciler consumes
 // ---------------------------------------------------------------------------
 
 /** An org-policy definition, keyed by name in `GcpGovernanceConfig.orgPolicies`. */
@@ -45,8 +45,8 @@ export interface FolderConfig {
 
 /**
  * The desired-state governance tree for one GCP organization. This is the
- * shape the GCP cloud warden loads as config — the GCP counterpart of
- * `AwsGovernanceConfig`. Cycles map onto the governance verbs (#790): the
+ * shape an external governance reconciler loads as config — the GCP counterpart of
+ * `AwsGovernanceConfig`. Cycles map onto the governance verbs: the
  * folder/project tree is `org-unit`, org policies are `policy-guardrail`,
  * audit configuration is `audit-sink`.
  */
@@ -132,7 +132,7 @@ export interface LandingZoneConfigProps {
 }
 
 /**
- * Author the desired-state tree the GCP cloud warden reconciles. Pure.
+ * Author the desired-state tree an external governance reconciler reconciles. Pure.
  * Throws when the tree attaches an org-policy name with no definition; only
  * policies the tree actually attaches are included in the output.
  */

package/src/index.ts

@@ -42,8 +42,8 @@ export type {
   GovernanceFoundationProps, LocationRestrictionProps, OrganizationAuditConfigProps,
 } from "./composites/index";
 
-// GCP governance authoring (#791): the desired-state config the GCP cloud
-// warden reconciles, and the typed landing-zone authoring layer.
+// GCP governance authoring: the desired-state config an external governance
+// reconciler applies, and the typed landing-zone authoring layer.
 export {
   landingZoneConfig, resourceLocationRestriction,
   DISABLE_SA_KEY_CREATION, SKIP_DEFAULT_NETWORK, AUDIT_ALL_SERVICES, FOUNDATION_FOLDERS,

package/src/lint/audit-catalog.ts

@@ -31,7 +31,7 @@ export const gcpAuditCatalog: Record<string, RuleMeta> = {
   WGC402: auditRule("WGC402", "merge-worthy", "guidance", "Missing required spec field", "Add the required spec field.", { category: "correctness" }),
   WGC403: auditRule("WGC403", "merge-worthy", "guidance", "Spec field has wrong type/structure", "Fix the field's type/structure.", { category: "correctness" }),
 
-  // #793 — governance posture regressions (epic #787 C3).
+  // governance posture regressions.
   WGC501: auditRule("WGC501", "merge-worthy", "guidance", "Org Policy guardrail not enforced", "Enable enforce on the rule (or remove the policy deliberately) — a disabled org policy constrains nothing.", { authority: [GCP_SEC] }),
   WGC502: auditRule("WGC502", "merge-worthy", "guidance", "Org Policy guardrail defines no rules", "Add rules to the OrgPolicyPolicy — without them the constraint binds nothing.", { authority: [GCP_SEC] }),
   WGC503: auditRule("WGC503", "merge-worthy", "guidance", "Audit logging dropped or scoped down", "Keep auditLogConfigs populated and remove exemptedMembers from the IAMAuditConfig.", { authority: [GCP_SEC] }),

package/src/lint/post-synth/wgc501.ts

@@ -1,5 +1,5 @@
 /**
- * WGC501: Org Policy Guardrail Not Enforced (#793, epic #787 C3)
+ * WGC501: Org Policy Guardrail Not Enforced 
  *
  * Flags OrgPolicyPolicy resources whose rules switch enforcement off or that
  * reset the constraint to its default. A disabled org policy is the GCP

package/src/lint/post-synth/wgc502.ts

@@ -1,5 +1,5 @@
 /**
- * WGC502: Org Policy Guardrail Defines No Rules (#793, epic #787 C3)
+ * WGC502: Org Policy Guardrail Defines No Rules 
  *
  * Flags OrgPolicyPolicy resources with no rules (and no reset). A rule-less
  * org policy binds a constraint to nothing — the usual leftover of a

package/src/lint/post-synth/wgc503.ts

@@ -1,5 +1,5 @@
 /**
- * WGC503: Audit Logging Dropped or Scoped Down (#793, epic #787 C3)
+ * WGC503: Audit Logging Dropped or Scoped Down 
  *
  * Flags IAMAuditConfig resources that capture nothing (no auditLogConfigs)
  * or that carve identities out of the audit trail via exemptedMembers.