@intentius/chant-lexicon-gcp 0.44.14 → 0.45.0

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4FH;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8uB9E"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4FH;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB9E"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "87ff9dc3ad075eb6a2f45e1084298909b75702186399fb1666a64b2bd87d348e",
+    "manifest.json": "17362bbe86bdedd7a3825faca8213f558c72714c6f6f16ce27dfd207c329b1ea",
     "meta.json": "475f10909854d059a2e2d4fb541c058803422e38b9c64bd4d6858c0623eedb8c",
     "types/index.d.ts": "5433b54c04b57d6fda8f3d81ef92ed0aca87f7e8e5dd3ea92d8de6e62a3ccfab",
     "rules/hardcoded-project.ts": "228631d3159e1ffcce2359c66073d4ae59bb0285f378e46e446f416aec50481c",
@@ -40,5 +40,5 @@
     "skills/chant-gcp-patterns.md": "a7ef31c1eb2f7244d3f73952c300472ef94c1eb09bd7a1003281b89299b6b704",
     "skills/chant-gcp-gke.md": "be277019da9a722c851e47cd2dfb9c9536668948c3535fb20db7697e934c4e2b"
   },
-  "composite": "3f2aefb5e0c5e95d0f90855acd29cd91bf3d2fbfc96c411e83947c3fb88b9fb3"
+  "composite": "5d1b64bafea0ac5f419bf20633a22c2d6a49d498ad6e63aba5d89523492dcc79"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp",
-  "version": "0.44.14",
+  "version": "0.45.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GCP",
   "intrinsics": [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gcp",
-  "version": "0.44.14",
+  "version": "0.45.0",
   "description": "Google Cloud lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -76,7 +76,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.44.14",
+    "@intentius/chant": "^0.45.0",
     "typescript": "^5.9.3"
   }
 }

package/src/codegen/docs.ts

@@ -111,732 +111,6 @@ export async function generateDocs(opts?: { verbose?: boolean }): Promise<void>
     serviceFromType,
     srcDir: join(pkgDir, "src"),
     basePath: "/chant/lexicons/gcp/",
-    extraPages: [
-      {
-        slug: "getting-started",
-        title: "Getting Started",
-        description: "Install chant and deploy your first GCP resource in 5 minutes",
-        content: `## What is chant?
-
-Chant is a TypeScript-to-YAML compiler. You write typed TypeScript declarations, and chant outputs Config Connector YAML manifests that can be applied to a GKE cluster with Config Connector installed.
-
-## Prerequisites
-
-1. A GKE cluster with [Config Connector](https://cloud.google.com/config-connector/docs/overview) installed
-2. A \`ConfigConnectorContext\` resource configured per namespace
-3. A GCP Service Account bound to the Config Connector controller
-
-## Install
-
-\`\`\`bash
-npm install --save-dev @intentius/chant @intentius/chant-lexicon-gcp
-\`\`\`
-
-## Your first resource
-
-The fastest path is the **GcsBucket** composite — one function call that produces a properly configured Storage bucket:
-
-\`\`\`typescript
-// src/infra.gcp.ts
-import { GcsBucket } from "@intentius/chant-lexicon-gcp";
-import { defaultAnnotations, GCP } from "@intentius/chant-lexicon-gcp";
-
-export const annotations = defaultAnnotations({
-  "cnrm.cloud.google.com/project-id": GCP.ProjectId,
-});
-
-const { bucket } = GcsBucket({
-  name: "my-data-bucket",
-  location: "US",
-  versioning: true,
-});
-
-export { bucket };
-\`\`\`
-
-## Build and deploy
-
-\`\`\`bash
-# Generate Config Connector YAML
-chant build --output dist/manifests.yaml
-
-# Validate against the cluster API (no changes applied)
-kubectl apply -f dist/manifests.yaml --dry-run=server
-
-# Apply
-kubectl apply -f dist/manifests.yaml
-\`\`\`
-
-## Using resource constructors
-
-\`\`\`typescript
-import { StorageBucket, IAMPolicyMember, GCP } from "@intentius/chant-lexicon-gcp";
-
-export const bucket = new StorageBucket({
-  location: "US",
-  storageClass: "STANDARD",
-  uniformBucketLevelAccess: true,
-  versioning: { enabled: true },
-});
-
-export const reader = new IAMPolicyMember({
-  member: "serviceAccount:app@my-project.iam.gserviceaccount.com",
-  role: "roles/storage.objectViewer",
-  resourceRef: {
-    apiVersion: "storage.cnrm.cloud.google.com/v1beta1",
-    kind: "StorageBucket",
-    name: bucket,
-  },
-});
-\`\`\`
-
-## Next steps
-
-- [Config Connector Concepts](/chant/lexicons/gcp/config-connector-concepts/) — resource structure, references, project binding
-- [Examples](/chant/lexicons/gcp/examples/) — StorageBucket, ComputeInstance, CloudSQL, IAM
-- [Lint Rules](/chant/lexicons/gcp/lint-rules/) — built-in checks for security and best practices`,
-      },
-      {
-        slug: "config-connector-concepts",
-        title: "Config Connector Concepts",
-        description: "Resource structure, resourceRef, project binding, reconciliation lifecycle",
-        content: `import Diagram from '../../components/Diagram.astro';
-
-Every exported resource declaration becomes a Config Connector manifest document in the generated YAML.
-
-## Resource structure
-
-Every Config Connector resource has four standard fields:
-
-| Field | Source | Example |
-|-------|--------|---------|
-| \`apiVersion\` | Resolved from resource type | \`storage.cnrm.cloud.google.com/v1beta1\` |
-| \`kind\` | Resolved from resource type | \`StorageBucket\` |
-| \`metadata\` | From \`metadata\` property | \`{ name: "my-bucket", labels: {...} }\` |
-| \`spec\` | From remaining props | Resource-specific configuration |
-
-## Resource references
-
-Config Connector resources reference each other using \`resourceRef\`:
-
-\`\`\`yaml
-# By name (same namespace)
-resourceRef:
-  name: my-network
-
-# By external reference (cross-project)
-resourceRef:
-  external: projects/my-project/global/networks/my-network
-\`\`\`
-
-In chant, resource references resolve automatically:
-
-\`\`\`typescript
-export const network = new ComputeNetwork({ autoCreateSubnetworks: false });
-
-export const subnet = new ComputeSubnetwork({
-  networkRef: { name: network },  // Resolves to metadata.name of network
-  ipCidrRange: "10.0.0.0/24",
-  region: "us-central1",
-});
-\`\`\`
-
-## Project binding
-
-Bind resources to a GCP project via annotations:
-
-\`\`\`typescript
-import { defaultAnnotations, GCP } from "@intentius/chant-lexicon-gcp";
-
-export const annotations = defaultAnnotations({
-  "cnrm.cloud.google.com/project-id": GCP.ProjectId,
-});
-\`\`\`
-
-This injects the project annotation into every resource. Without it, Config Connector uses the namespace's default project.
-
-## Reconciliation lifecycle
-
-Config Connector resources go through a reconciliation lifecycle:
-
-<Diagram name="config-connector-lifecycle" alt="Config Connector state machine: YAML applied to kubectl, then Pending → Reconciling → UpToDate, UpdateFailed, or DependencyNotReady with retry paths" caption="Config Connector reconciliation lifecycle" />
-
-| Status | Meaning |
-|--------|---------|
-| UpToDate | Resource matches desired state |
-| Updating | Controller is applying changes |
-| UpdateFailed | GCP API returned an error |
-| DependencyNotReady | Waiting for a referenced resource |
-| DeletionFailed | Cannot delete the GCP resource |
-
-Check status with: \`kubectl get gcp -A\` or \`kubectl describe <resource>\`
-
-## Default labels and annotations
-
-Use \`defaultLabels()\` and \`defaultAnnotations()\` to inject metadata into all resources:
-
-\`\`\`typescript
-import { defaultLabels, defaultAnnotations } from "@intentius/chant-lexicon-gcp";
-
-export const labels = defaultLabels({
-  "app.kubernetes.io/managed-by": "chant",
-  "env": "production",
-});
-\`\`\`
-
-Explicit labels on individual resources take precedence over defaults.`,
-      },
-      {
-        slug: "lint-rules",
-        title: "Lint Rules",
-        description: "Built-in lint rules and post-synth checks for GCP Config Connector manifests",
-        content: `The GCP lexicon ships lint rules that run during \`chant lint\` and post-synth checks that validate the serialized YAML after \`chant build\`.
-
-## Lint rules
-
-Lint rules analyze your TypeScript source code before build.
-
-| Rule | Description |
-|------|-------------|
-| WGC001 | Hardcoded project ID in resource constructors |
-| WGC002 | Hardcoded region in resource constructors |
-| WGC003 | Public IAM member (allUsers/allAuthenticatedUsers) |
-
-## Post-synth checks
-
-Post-synth checks run against the serialized YAML after build.
-
-### Security
-
-| Rule | Description |
-|------|-------------|
-| WGC101 | Missing encryption on StorageBucket or SQLInstance |
-| WGC102 | Public IAM member detected in output |
-| WGC104 | Missing uniform bucket-level access |
-| WGC105 | Cloud SQL with public 0.0.0.0/0 in authorizedNetworks |
-| WGC109 | ComputeFirewall allowing all sources (0.0.0.0/0) |
-| WGC110 | KMS CryptoKey without rotation period |
-
-### Best practices
-
-| Rule | Description |
-|------|-------------|
-| WGC103 | Missing project annotation (uses namespace default) |
-| WGC106 | Missing deletion policy annotation |
-| WGC107 | StorageBucket without versioning |
-| WGC108 | SQLInstance without backup configuration |
-| WGC201 | Missing managed-by label |
-| WGC202 | GKE cluster without workload identity |
-| WGC203 | GKE node pool with overly broad cloud-platform OAuth scope |
-| WGC204 | ComputeInstance without shielded VM config |
-
-### Correctness
-
-| Rule | Description |
-|------|-------------|
-| WGC111 | Resource reference points to a name not defined in the output |
-| WGC112 | Config Connector resource has missing or invalid apiVersion |
-| WGC113 | Config Connector resource uses an alpha API version |
-
-### Schema validation
-
-Checks each Config Connector resource's \`spec\` against the CRD schema it is
-generated from.
-
-| Rule | Description |
-|------|-------------|
-| WGC401 | Config Connector resource spec contains unknown field |
-| WGC402 | Config Connector resource is missing a required spec field |
-| WGC403 | Config Connector resource spec field has wrong type or structure |
-
-### Compliance
-
-| Rule | Description |
-|------|-------------|
-| WGC301 | No IAMAuditConfig resource in output |
-| WGC302 | No Service (API enablement) resource in output |
-| WGC303 | No VPC Service Controls perimeter |
-
-## Running lint
-
-\`\`\`bash
-# Lint your chant project
-chant lint
-
-# Build (also runs post-synth checks)
-chant build
-\`\`\`
-
-To suppress a rule on a specific line:
-
-\`\`\`typescript
-// chant-disable-next-line WGC001
-const bucket = new StorageBucket({ metadata: { annotations: { "cnrm.cloud.google.com/project-id": "my-project" } } });
-\`\`\``,
-      },
-      {
-        slug: "examples",
-        title: "Examples: Resources",
-        description: "GCP Config Connector resource examples — StorageBucket, ComputeInstance, CloudSQL, IAM",
-        content: `## StorageBucket
-
-A Storage bucket with encryption, versioning, and lifecycle rules:
-
-\`\`\`typescript
-import { StorageBucket, GCP } from "@intentius/chant-lexicon-gcp";
-
-export const bucket = new StorageBucket({
-  location: "US",
-  storageClass: "STANDARD",
-  uniformBucketLevelAccess: true,
-  versioning: { enabled: true },
-  encryption: {
-    defaultKmsKeyName: "projects/p/locations/us/keyRings/kr/cryptoKeys/key",
-  },
-  lifecycleRule: [
-    { action: { type: "Delete" }, condition: { age: 365 } },
-    { action: { type: "SetStorageClass", storageClass: "NEARLINE" }, condition: { age: 30 } },
-  ],
-});
-\`\`\`
-
-## ComputeInstance
-
-A Compute Engine VM with shielded VM configuration:
-
-\`\`\`typescript
-import { ComputeInstance, GCP } from "@intentius/chant-lexicon-gcp";
-
-export const vm = new ComputeInstance({
-  machineType: "e2-medium",
-  zone: "us-central1-a",
-  bootDisk: {
-    initializeParams: {
-      sourceImageRef: {
-        external: "projects/debian-cloud/global/images/debian-12",
-      },
-    },
-  },
-  networkInterface: [{
-    networkRef: { name: "my-network" },
-    subnetworkRef: { name: "my-subnet" },
-  }],
-  shieldedInstanceConfig: {
-    enableSecureBoot: true,
-    enableVtpm: true,
-    enableIntegrityMonitoring: true,
-  },
-});
-\`\`\`
-
-## Cloud SQL
-
-A PostgreSQL instance with backups and high availability:
-
-\`\`\`typescript
-import { CloudSqlInstance } from "@intentius/chant-lexicon-gcp";
-
-const { instance, database, user } = CloudSqlInstance({
-  name: "app-db",
-  databaseVersion: "POSTGRES_15",
-  tier: "db-custom-2-8192",
-  region: "us-central1",
-  backupEnabled: true,
-  highAvailability: true,
-  diskSize: 50,
-});
-
-export { instance, database, user };
-\`\`\`
-
-## IAM Binding
-
-Grant a service account access to a resource:
-
-\`\`\`typescript
-import { IAMPolicyMember } from "@intentius/chant-lexicon-gcp";
-
-export const binding = new IAMPolicyMember({
-  member: "serviceAccount:app@my-project.iam.gserviceaccount.com",
-  role: "roles/storage.objectViewer",
-  resourceRef: {
-    apiVersion: "storage.cnrm.cloud.google.com/v1beta1",
-    kind: "StorageBucket",
-    name: "my-bucket",
-  },
-});
-\`\`\``,
-      },
-      {
-        slug: "composite-examples",
-        title: "Examples: Composites",
-        description: "All 10 GCP composites with full code and deployment workflow",
-        content: `Composites are higher-level constructs that produce multiple coordinated Config Connector resources from a single function call.
-
-## GkeCluster
-
-GKE cluster with node pool and workload identity:
-
-\`\`\`typescript
-import { GkeCluster } from "@intentius/chant-lexicon-gcp";
-
-const { cluster, nodePool } = GkeCluster({
-  name: "my-cluster",
-  location: "us-central1",
-  machineType: "e2-standard-4",
-  minNodeCount: 1,
-  maxNodeCount: 10,
-  workloadIdentity: true,
-});
-
-export { cluster, nodePool };
-\`\`\`
-
-## CloudRunService
-
-Cloud Run service with optional public access:
-
-\`\`\`typescript
-import { CloudRunService } from "@intentius/chant-lexicon-gcp";
-
-const { service, publicIam } = CloudRunService({
-  name: "my-api",
-  image: "gcr.io/my-project/api:1.0",
-  port: 8080,
-  publicAccess: true,
-  minInstanceCount: 1,
-  maxInstanceCount: 10,
-});
-
-export { service, publicIam };
-\`\`\`
-
-## CloudSqlInstance
-
-PostgreSQL with database and user:
-
-\`\`\`typescript
-import { CloudSqlInstance } from "@intentius/chant-lexicon-gcp";
-
-const { instance, database, user } = CloudSqlInstance({
-  name: "app-db",
-  tier: "db-custom-2-8192",
-  backupEnabled: true,
-  highAvailability: true,
-});
-
-export { instance, database, user };
-\`\`\`
-
-## GcsBucket
-
-Storage bucket with encryption and lifecycle:
-
-\`\`\`typescript
-import { GcsBucket } from "@intentius/chant-lexicon-gcp";
-
-const { bucket } = GcsBucket({
-  name: "data-lake",
-  location: "US",
-  versioning: true,
-  kmsKeyName: "projects/p/locations/us/keyRings/kr/cryptoKeys/key",
-  lifecycleDeleteAfterDays: 365,
-  lifecycleNearlineAfterDays: 30,
-});
-
-export { bucket };
-\`\`\`
-
-## VpcNetwork
-
-VPC with subnets, firewalls, and Cloud NAT:
-
-\`\`\`typescript
-import { VpcNetwork } from "@intentius/chant-lexicon-gcp";
-
-const { network, subnets, firewalls, router, routerNat } = VpcNetwork({
-  name: "production",
-  subnets: [
-    { name: "app", ipCidrRange: "10.0.0.0/24", region: "us-central1" },
-    { name: "data", ipCidrRange: "10.0.1.0/24", region: "us-central1" },
-  ],
-  enableNat: true,
-  natRegion: "us-central1",
-  allowIapSsh: true,
-});
-
-export { network, subnets, firewalls, router, routerNat };
-\`\`\`
-
-## PubSubPipeline
-
-Topic + Subscription + optional dead-letter queue:
-
-\`\`\`typescript
-import { PubSubPipeline } from "@intentius/chant-lexicon-gcp";
-
-const { topic, subscription, deadLetterTopic, subscriberIam } = PubSubPipeline({
-  name: "order-events",
-  enableDeadLetterQueue: true,
-  maxDeliveryAttempts: 5,
-  subscriberServiceAccount: "worker@my-project.iam.gserviceaccount.com",
-});
-
-export { topic, subscription, deadLetterTopic, subscriberIam };
-\`\`\`
-
-## CloudFunctionWithTrigger
-
-Cloud Function + source bucket + optional public invoker IAM:
-
-\`\`\`typescript
-import { CloudFunctionWithTrigger } from "@intentius/chant-lexicon-gcp";
-
-const { function: fn, sourceBucket, invokerIam } = CloudFunctionWithTrigger({
-  name: "process-upload",
-  runtime: "nodejs20",
-  entryPoint: "handler",
-  triggerType: "pubsub",
-  triggerTopic: "file-uploads",
-  region: "us-central1",
-});
-
-export { fn, sourceBucket, invokerIam };
-\`\`\`
-
-## PrivateService
-
-Private service networking (VPC peering):
-
-\`\`\`typescript
-import { PrivateService } from "@intentius/chant-lexicon-gcp";
-
-const { globalAddress, serviceConnection, dnsZone } = PrivateService({
-  name: "db-peering",
-  networkName: "production",
-  enableDns: true,
-});
-
-export { globalAddress, serviceConnection, dnsZone };
-\`\`\`
-
-## ManagedCertificate
-
-Google-managed SSL certificate + optional HTTPS proxy:
-
-\`\`\`typescript
-import { ManagedCertificate } from "@intentius/chant-lexicon-gcp";
-
-const { certificate, targetHttpsProxy, urlMap } = ManagedCertificate({
-  name: "web-cert",
-  domains: ["example.com", "www.example.com"],
-  createProxy: true,
-  backendServiceName: "web-backend",
-});
-
-export { certificate, targetHttpsProxy, urlMap };
-\`\`\`
-
-## SecureProject
-
-Project with audit logging, API enablement, and IAM:
-
-\`\`\`typescript
-import { SecureProject } from "@intentius/chant-lexicon-gcp";
-
-const { project, auditConfig, services, ownerIam, loggingSink } = SecureProject({
-  name: "my-project",
-  orgId: "123456789",
-  billingAccountRef: "ABCDEF-123456-ABCDEF",
-  owner: "user:admin@example.com",
-  loggingSinkDestination: "bigquery.googleapis.com/projects/audit/datasets/logs",
-});
-
-export { project, auditConfig, services, ownerIam, loggingSink };
-\`\`\`
-
-## Deploying composites
-
-\`\`\`bash
-# Build YAML manifests
-chant build src/ --output manifests.yaml
-
-# Lint for common issues
-chant lint src/
-
-# Dry run
-kubectl apply -f manifests.yaml --dry-run=server
-
-# Apply
-kubectl apply -f manifests.yaml
-\`\`\``,
-      },
-      {
-        slug: "operational-playbook",
-        title: "Operational Playbook",
-        description: "Build, lint, apply, troubleshoot Config Connector resources",
-        content: `This playbook covers the full lifecycle of chant-produced Config Connector manifests.
-
-## Build & validate
-
-| Step | Command | What it catches |
-|------|---------|-----------------|
-| Lint source | \`chant lint src/\` | Hardcoded project IDs (WGC001), regions (WGC002), public IAM (WGC003) |
-| Build manifests | \`chant build src/ --output manifests.yaml\` | Post-synth: missing encryption (WGC101), public IAM (WGC102), missing project annotation (WGC103), 14 more checks |
-| Server dry-run | \`kubectl apply -f manifests.yaml --dry-run=server\` | K8s API validation: CRD schema errors, admission webhooks |
-
-## Deploy to Kubernetes
-
-\`\`\`bash
-# Build
-chant build src/ --output manifests.yaml
-
-# Diff before applying
-kubectl diff -f manifests.yaml
-
-# Dry run
-kubectl apply -f manifests.yaml --dry-run=server
-
-# Apply
-kubectl apply -f manifests.yaml
-\`\`\`
-
-## Monitoring reconciliation
-
-\`\`\`bash
-# List all Config Connector resources
-kubectl get gcp -A
-
-# Check specific resource status
-kubectl describe storagebuckets.storage.cnrm.cloud.google.com my-bucket
-
-# Watch for status changes
-kubectl get gcp -A -w
-\`\`\`
-
-## Troubleshooting
-
-| Status | Meaning | Diagnostic | Fix |
-|--------|---------|------------|-----|
-| UpToDate | Resource in sync | None needed | — |
-| Updating | Applying changes | \`kubectl describe\` → Events | Wait for completion |
-| UpdateFailed | GCP API error | \`kubectl describe\` → Events | Check IAM permissions, quota, API enablement |
-| DependencyNotReady | Waiting for ref | \`kubectl get gcp\` | Ensure referenced resource exists and is UpToDate |
-| DeletionFailed | Cannot delete | \`kubectl describe\` → Events | Check IAM permissions, child resource dependencies |
-
-## Common issues
-
-| Symptom | Cause | Resolution |
-|---------|-------|------------|
-| Resource stuck in Updating | Missing GCP API | Enable API: add Service resource or \`gcloud services enable\` |
-| Permission denied | Service account lacks IAM role | Grant role to Config Connector SA |
-| Resource recreated on every apply | Missing deletion-policy annotation | Add \`cnrm.cloud.google.com/deletion-policy: abandon\` |
-| Namespace not found | ConfigConnectorContext missing | Create ConfigConnectorContext in namespace |
-| Cross-project reference fails | Missing project annotation | Add \`cnrm.cloud.google.com/project-id\` annotation |
-
-## Quick reference
-
-| Command | Description |
-|---------|-------------|
-| \`chant build src/\` | Synthesize manifests |
-| \`chant lint src/\` | Check for anti-patterns |
-| \`kubectl apply -f manifests.yaml\` | Apply to cluster |
-| \`kubectl get gcp -A\` | List all Config Connector resources |
-| \`kubectl describe <resource>\` | Check reconciliation status |
-| \`kubectl delete -f manifests.yaml\` | Remove resources |`,
-      },
-      {
-        slug: "importing-yaml",
-        title: "Importing Existing YAML",
-        description: "Convert existing Config Connector YAML into typed TypeScript",
-        content: `Chant can parse existing Config Connector YAML manifests and generate typed TypeScript source files.
-
-## How it works
-
-\`\`\`
-Input YAML → parse → generate TypeScript → export typed resources
-\`\`\`
-
-The importer reads multi-document YAML, identifies Config Connector resources by their \`cnrm.cloud.google.com\` apiVersion, and generates corresponding typed constructor calls.
-
-## Example
-
-Input YAML:
-
-\`\`\`yaml
-apiVersion: storage.cnrm.cloud.google.com/v1beta1
-kind: StorageBucket
-metadata:
-  name: my-bucket
-spec:
-  location: US
-  uniformBucketLevelAccess: true
-\`\`\`
-
-Generated TypeScript:
-
-\`\`\`typescript
-import { Bucket } from "@intentius/chant-lexicon-gcp";
-
-export const myBucket = new Bucket({
-  metadata: { name: "my-bucket" },
-  location: "US",
-  uniformBucketLevelAccess: true,
-});
-\`\`\`
-
-## Limitations
-
-The import pipeline:
-
-- Only handles Config Connector resources (\`cnrm.cloud.google.com\` apiVersion)
-- Non-CC resources (standard K8s Deployments, Services) are filtered out
-- Resource references are preserved as literal values, not typed refs
-- Multi-document YAML is fully supported`,
-      },
-      {
-        slug: "skills",
-        title: "AI Skills",
-        description: "AI agent skills bundled with the GCP lexicon",
-        content: `The GCP lexicon ships an AI skill called **chant-gcp** that teaches AI coding agents how to build, validate, and deploy Config Connector manifests from a chant project.
-
-## What are skills?
-
-Skills are structured markdown documents bundled with a lexicon. When an AI agent works in a chant project, it discovers and loads relevant skills automatically.
-
-## Installation
-
-When you scaffold a new project with \`chant init --lexicon gcp\`, the skill is installed to \`skills/chant-gcp/SKILL.md\`.
-
-## Skill: chant-gcp
-
-The \`chant-gcp\` skill covers:
-
-- **Build** — \`chant build src/ --output manifests.yaml\`
-- **Lint** — \`chant lint src/\` + 23 post-synth checks
-- **Apply** — \`kubectl apply -f manifests.yaml\`
-- **Status** — \`kubectl get gcp -A\`
-- **Troubleshooting** — reconciliation status, events, common error patterns
-
-## MCP integration
-
-| MCP tool | Description |
-|----------|-------------|
-| \`diff\` | Compare current build output against previous |
-
-| MCP resource | Description |
-|--------------|-------------|
-| \`resource-catalog\` | JSON list of all supported Config Connector resource types |
-| \`examples/basic-bucket\` | Example StorageBucket code |`,
-      },
-    ],
-    // `lint-rules` is gcp's rules documentation, so the generated `rules`
-    // table is a duplicate — and buildSidebar already declines to link it when
-    // a `lint-rules` page exists, which left it emitted but unreachable
-    // (#1312). aws, k8s, gitlab and github suppress it for the same reason.
-    sidebarExtra: [
-      { label: "Deploying to GKE", slug: "gke-kubernetes" },
-    ],
   };
 
   const result = docsPipeline(config);

package/src/lint/post-synth/post-synth.test.ts

@@ -1,4 +1,5 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc101 } from "./wgc101";
 import { wgc102 } from "./wgc102";
 import { wgc103 } from "./wgc103";
@@ -24,9 +25,7 @@ import { wgc402 } from "./wgc402";
 import { wgc403 } from "./wgc403";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 // ── WGC101: Missing encryption ─────────────────────────────────────

package/src/lint/post-synth/wgc101.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc101 } from "./wgc101";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC101: missing encryption", () => {

package/src/lint/post-synth/wgc102.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc102 } from "./wgc102";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC102: public IAM in output", () => {

package/src/lint/post-synth/wgc103.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc103 } from "./wgc103";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC103: missing project annotation", () => {

package/src/lint/post-synth/wgc104.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc104 } from "./wgc104";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC104: missing uniform bucket access", () => {

package/src/lint/post-synth/wgc105.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc105 } from "./wgc105";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC105: public Cloud SQL", () => {

package/src/lint/post-synth/wgc106.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc106 } from "./wgc106";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC106: missing deletion policy", () => {

package/src/lint/post-synth/wgc107.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc107 } from "./wgc107";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC107: missing versioning", () => {

package/src/lint/post-synth/wgc108.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc108 } from "./wgc108";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC108: missing backup configuration", () => {

package/src/lint/post-synth/wgc109.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc109 } from "./wgc109";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC109: open firewall", () => {

package/src/lint/post-synth/wgc110.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc110 } from "./wgc110";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC110: missing key rotation", () => {

package/src/lint/post-synth/wgc111.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc111 } from "./wgc111";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC111: dangling resource reference", () => {

package/src/lint/post-synth/wgc112.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc112 } from "./wgc112";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC112: missing or invalid apiVersion", () => {

package/src/lint/post-synth/wgc113.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc113 } from "./wgc113";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC113: alpha API version", () => {

package/src/lint/post-synth/wgc201.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc201 } from "./wgc201";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC201: missing managed-by label", () => {

package/src/lint/post-synth/wgc202.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc202 } from "./wgc202";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC202: missing workload identity", () => {

package/src/lint/post-synth/wgc203.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc203 } from "./wgc203";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC203: cloud-platform OAuth scope", () => {

package/src/lint/post-synth/wgc204.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc204 } from "./wgc204";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC204: missing shielded VM config", () => {

package/src/lint/post-synth/wgc301.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc301 } from "./wgc301";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC301: no audit logging", () => {

package/src/lint/post-synth/wgc302.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc302 } from "./wgc302";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC302: service API not enabled", () => {

package/src/lint/post-synth/wgc303.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc303 } from "./wgc303";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC303: missing VPC Service Controls", () => {

package/src/lint/post-synth/wgc401.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc401 } from "./wgc401";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC401: unknown spec field", () => {

package/src/lint/post-synth/wgc402.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc402 } from "./wgc402";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC402: missing required field", () => {

package/src/lint/post-synth/wgc403.test.ts

@@ -1,10 +1,9 @@
 import { describe, test, expect } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
 import { wgc403 } from "./wgc403";
 
 function makeCtx(yaml: string) {
-  return {
-    outputs: new Map([["gcp", yaml]]),
-  };
+  return makePostSynthCtx("gcp", yaml);
 }
 
 describe("WGC403: type/structure mismatch", () => {

package/src/serializer.test.ts

@@ -216,7 +216,7 @@ describe("gcpSerializer", () => {
       }),
     );
 
-    const result = gcpSerializer.serialize(entities);
+    const result = gcpSerializer.serialize(entities) as string;
     expect(result).toContain("env: prod");
     // Should not contain "dev" since explicit overrides
     const envLines = result.split("\n").filter((l: string) => l.includes("env:"));
@@ -233,7 +233,7 @@ describe("gcpSerializer", () => {
       }),
     );
 
-    const result = gcpSerializer.serialize(entities);
+    const result = gcpSerializer.serialize(entities) as string;
     // Only one document — property entities should not appear as separate docs
     expect(result.split("---").length).toBeLessThanOrEqual(2);
   });
@@ -264,7 +264,7 @@ describe("gcpSerializer", () => {
       }),
     );
 
-    const result = gcpSerializer.serialize(entities);
+    const result = gcpSerializer.serialize(entities) as string;
     const lines = result.split("\n");
     const keyLines = lines.filter((l: string) => /^\w+:/.test(l));
     const keys = keyLines.map((l: string) => l.split(":")[0]);