@intentius/chant-lexicon-cpln 0.124.31 → 0.124.32

package/dist/lint/post-synth/cpl041-image-reference-form.js

@@ -0,0 +1,52 @@
+import { readArray, readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType } from "./helpers.js";
+/**
+ * CPL041: registry prefixes Control Plane does not want in a workload spec.
+ *
+ * Two documented traps. `docker.io/` must never be added to a public image —
+ * the exact string `nginx:latest` works and `docker.io/library/nginx:latest`
+ * does not. And `<org>.registry.cpln.io/…` is the hostname for `docker login`
+ * and `docker push` only; inside a workload spec the org's own images are
+ * addressed as `//image/NAME:TAG`.
+ */
+export const imageReferenceFormCheck = {
+    id: "CPL041",
+    description: "Image references must not use docker.io/ or the registry hostname form",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            for (const container of readArray(entity, "spec", "containers")) {
+                const containerName = readString(container, "name") ?? "?";
+                const image = readString(container, "image");
+                if (!image)
+                    continue;
+                if (image.startsWith("docker.io/")) {
+                    const bare = image.replace(/^docker\.io\/(library\/)?/, "");
+                    diagnostics.push({
+                        checkId: "CPL041",
+                        severity: "error",
+                        message: `Workload "${name}" container "${containerName}" uses image "${image}". Control Plane rejects ` +
+                            `the docker.io/ prefix on public images — use "${bare}".`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                    continue;
+                }
+                const selfHosted = /^([a-z0-9-]+)\.registry\.cpln\.io\/(.+)$/.exec(image);
+                if (selfHosted) {
+                    diagnostics.push({
+                        checkId: "CPL041",
+                        severity: "warning",
+                        message: `Workload "${name}" container "${containerName}" uses image "${image}". The ` +
+                            `<org>.registry.cpln.io hostname is for \`docker login\` and \`docker push\`; in a workload ` +
+                            `spec, an image in this org is "//image/${selfHosted[2]}". (A cross-org pull does use the ` +
+                            `hostname form — ignore this if "${selfHosted[1]}" is another org.)`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl042-gvc-placement.js

@@ -0,0 +1,49 @@
+import { readArray, readPath, readString } from "../../entity-props.js";
+import { GVC, entitiesOfType } from "./helpers.js";
+/** Location links look like `/org/ORG/location/aws-us-east-1` or `//location/aws-us-east-1`. */
+const LOCATION_LINK = /\/location\/((aws|gcp|azure)-[a-z0-9-]+|[a-z0-9-]+)$/;
+/**
+ * CPL042: a GVC with nowhere to run.
+ *
+ * Placement is a GVC-level decision, and a GVC with neither `locationLinks` nor
+ * a `locationQuery` accepts workloads and schedules them nowhere. The workloads
+ * apply cleanly and never become ready.
+ */
+export const gvcPlacementCheck = {
+    id: "CPL042",
+    description: "A GVC must declare where its workloads run",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityName, entity] of entitiesOfType(ctx.entities, GVC)) {
+            const name = readString(entity, "name") ?? entityName;
+            const links = readArray(entity, "spec", "staticPlacement", "locationLinks");
+            const query = readPath(entity, "spec", "staticPlacement", "locationQuery");
+            if (links.length === 0 && query === undefined) {
+                diagnostics.push({
+                    checkId: "CPL042",
+                    severity: "error",
+                    message: `GVC "${name}" declares no placement. Set spec.staticPlacement.locationLinks (or a ` +
+                        `locationQuery) — without one, its workloads apply cleanly and are scheduled nowhere.`,
+                    entity: entityName,
+                    lexicon: "cpln",
+                });
+                continue;
+            }
+            for (const link of links) {
+                if (typeof link !== "string")
+                    continue;
+                if (LOCATION_LINK.test(link))
+                    continue;
+                diagnostics.push({
+                    checkId: "CPL042",
+                    severity: "warning",
+                    message: `GVC "${name}" has location link "${link}", which does not look like a location. Expected ` +
+                        `/org/<org>/location/<provider>-<region>, e.g. /org/acme/location/aws-us-east-1.`,
+                    entity: entityName,
+                    lexicon: "cpln",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/helpers.js

@@ -0,0 +1,102 @@
+/**
+ * Shared reading and parsing for the CPL post-synth checks.
+ *
+ * Each check lives in its own file named for its id, so `CPL027` is greppable
+ * to one place. What they have in common lands here rather than being repeated
+ * or, worse, drifting: the workload-type default, the port enumeration that has
+ * to span both `port` and `ports`, and the quantity parsers.
+ *
+ * Named `helpers.ts` deliberately — the completeness checker's post-synth count
+ * excludes that filename, so a support module is not miscounted as a check.
+ */
+import { readArray, readNumber, readPath, readString } from "../../entity-props.js";
+import { kindByName } from "../../kinds.js";
+export const WORKLOAD = kindByName("workload").typeName;
+export const GVC = kindByName("gvc").typeName;
+export const POLICY = kindByName("policy").typeName;
+export const DOMAIN = kindByName("domain").typeName;
+export const VOLUMESET = kindByName("volumeset").typeName;
+/** Control Plane defaults an unset workload type to `serverless`. */
+export function workloadType(entity) {
+    return readString(entity, "spec", "type") ?? "serverless";
+}
+/** The autoscaling block from `defaultOptions`. */
+export function autoscalingOf(entity) {
+    return readPath(entity, "spec", "defaultOptions", "autoscaling");
+}
+/** Every port a workload's containers expose, across both `port` and `ports`. */
+export function exposedPorts(entity) {
+    const ports = [];
+    for (const container of readArray(entity, "spec", "containers")) {
+        const single = readNumber(container, "port");
+        if (single !== undefined)
+            ports.push(single);
+        for (const port of readArray(container, "ports")) {
+            const number = readNumber(port, "number");
+            if (number !== undefined)
+                ports.push(number);
+        }
+    }
+    return ports;
+}
+/** Parse a CPU quantity (`"50m"`, `"1"`, `"1.5"`) to millicores. */
+export function parseCpuMillicores(value) {
+    if (!value)
+        return undefined;
+    const match = /^(\d+(?:\.\d+)?)(m?)$/.exec(value.trim());
+    if (!match)
+        return undefined;
+    const amount = Number(match[1]);
+    return match[2] === "m" ? amount : amount * 1000;
+}
+/** Parse a memory quantity (`"128Mi"`, `"1Gi"`, `"512M"`) to MiB. */
+export function parseMemoryMib(value) {
+    if (!value)
+        return undefined;
+    const match = /^(\d+(?:\.\d+)?)(Ki|Mi|Gi|Ti|K|M|G|T)?$/.exec(value.trim());
+    if (!match)
+        return undefined;
+    const amount = Number(match[1]);
+    const factors = {
+        Ki: 1 / 1024,
+        Mi: 1,
+        Gi: 1024,
+        Ti: 1024 * 1024,
+        // Decimal suffixes, converted to MiB so one comparison covers both families.
+        K: 1000 / (1024 * 1024),
+        M: 1000000 / (1024 * 1024),
+        G: 1000000000 / (1024 * 1024),
+        T: 1000000000000 / (1024 * 1024),
+    };
+    const suffix = match[2];
+    if (!suffix)
+        return amount / (1024 * 1024); // bare bytes
+    return amount * factors[suffix];
+}
+/**
+ * The tag of an image reference, or undefined when untagged.
+ *
+ * A colon in a registry host's port (`registry:5000/app`) is not a tag, so only
+ * a colon after the last slash counts.
+ */
+export function imageTag(image) {
+    const lastSlash = image.lastIndexOf("/");
+    const colon = image.indexOf(":", lastSlash + 1);
+    return colon === -1 ? undefined : image.slice(colon + 1);
+}
+/** `//gvc/prod/identity/api` → kind `identity`, name `api`, gvc `prod`. */
+const GVC_SCOPED_LINK = /^\/\/gvc\/([^/]+)\/([a-z]+)\/([^/]+)$/;
+/** `//secret/db-password` → kind `secret`, name `db-password`. */
+const ORG_SCOPED_LINK = /^\/\/([a-z]+)\/([^/]+)$/;
+/** Parse a Control Plane link, or return undefined if it is not one. */
+export function parseLink(value) {
+    const scoped = GVC_SCOPED_LINK.exec(value);
+    if (scoped)
+        return { gvc: scoped[1], kind: scoped[2], name: scoped[3] };
+    const org = ORG_SCOPED_LINK.exec(value);
+    if (org)
+        return { kind: org[1], name: org[2] };
+    return undefined;
+}
+/** Iterate entities of one type. Re-exported so checks import one module. */
+export { entitiesOfType } from "../../entity-props.js";

package/dist/lint/post-synth/index.js

@@ -0,0 +1,42 @@
+import { unrestrictedOutboundCheck } from "./cpl010-unrestricted-outbound.js";
+import { internalFirewallScopeCheck } from "./cpl011-internal-firewall-scope.js";
+import { noLiteralCredentialEnvCheck } from "./cpl012-no-literal-credential-env.js";
+import { qualifiedIdentityPrincipalCheck } from "./cpl013-qualified-identity-principal.js";
+import { qualifiedSecretRefCheck } from "./cpl014-qualified-secret-ref.js";
+import { serverlessSinglePortCheck } from "./cpl020-serverless-single-port.js";
+import { cronJobShapeCheck } from "./cpl021-cron-job-shape.js";
+import { containerPortsCheck } from "./cpl022-container-ports.js";
+import { containerResourcesCheck } from "./cpl023-container-resources.js";
+import { probeHandlerCheck } from "./cpl024-probe-handler.js";
+import { autoscalingShapeCheck } from "./cpl025-autoscaling-shape.js";
+import { scaleToZeroCheck } from "./cpl026-scale-to-zero.js";
+import { capacityAiConflictCheck } from "./cpl027-capacity-ai-conflict.js";
+import { volumeSetCheck } from "./cpl028-volume-set.js";
+import { linkTargetsCheck } from "./cpl029-link-targets.js";
+import { domainRoutingCheck } from "./cpl030-domain-routing.js";
+import { pinnedImageCheck } from "./cpl040-pinned-image.js";
+import { imageReferenceFormCheck } from "./cpl041-image-reference-form.js";
+import { gvcPlacementCheck } from "./cpl042-gvc-placement.js";
+import { policyScopeCheck } from "./cpl043-policy-scope.js";
+export const postSynthChecks = [
+    unrestrictedOutboundCheck,
+    internalFirewallScopeCheck,
+    noLiteralCredentialEnvCheck,
+    qualifiedIdentityPrincipalCheck,
+    qualifiedSecretRefCheck,
+    serverlessSinglePortCheck,
+    cronJobShapeCheck,
+    containerPortsCheck,
+    containerResourcesCheck,
+    probeHandlerCheck,
+    autoscalingShapeCheck,
+    scaleToZeroCheck,
+    capacityAiConflictCheck,
+    volumeSetCheck,
+    linkTargetsCheck,
+    domainRoutingCheck,
+    pinnedImageCheck,
+    imageReferenceFormCheck,
+    gvcPlacementCheck,
+    policyScopeCheck,
+];

package/dist/lint/rules/cpl001-no-secret-literals.js

@@ -0,0 +1,73 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * CPL001: no literal credential material in a cpln declaration.
+ *
+ * This is a source-level rule rather than a post-synth check on purpose. By
+ * the time the manifest exists, a literal is just a string in a `data` block
+ * and there is nothing left to point at; here there is a file and a line, which
+ * is what makes the finding actionable — and, more to the point, this is the
+ * form the credential is in when it enters git history.
+ *
+ * `Secret` is the obvious carrier, but a credential pasted into a workload's
+ * env or an identity's cloud config is the same leak, so the rule fires
+ * anywhere inside a `new <cpln kind>(…)`.
+ *
+ * Complementary to CPL012, which catches the shape this cannot see — a
+ * plausible-looking value in a credential-named env var — from the model.
+ */
+const CPLN_KINDS = new Set(["Gvc", "Workload", "Identity", "VolumeSet", "Secret", "Policy", "Domain", "IpSet"]);
+const CREDENTIAL_SHAPES = [
+    { pattern: /^-----BEGIN [A-Z ]*PRIVATE KEY-----/, label: "private key material" },
+    { pattern: /^AKIA[0-9A-Z]{16}$/, label: "AWS access key id" },
+    { pattern: /^(ghp|gho|ghs|ghu)_[A-Za-z0-9]{20,}$/, label: "GitHub token" },
+    { pattern: /^github_pat_[A-Za-z0-9_]{20,}$/, label: "GitHub fine-grained token" },
+    { pattern: /^sk-[A-Za-z0-9_-]{20,}$/, label: "secret API key (sk-)" },
+    { pattern: /^xox[baprs]-[A-Za-z0-9-]{10,}$/, label: "Slack token" },
+    { pattern: /^ya29\.[A-Za-z0-9_-]{20,}$/, label: "Google OAuth access token" },
+    { pattern: /^eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}$/, label: "JWT" },
+    {
+        pattern: /^postgres(ql)?:\/\/[^:@/\s]+:[^@/\s]+@/,
+        label: "database URL with an inline password",
+    },
+    { pattern: /^mysql:\/\/[^:@/\s]+:[^@/\s]+@/, label: "database URL with an inline password" },
+    { pattern: /^mongodb(\+srv)?:\/\/[^:@/\s]+:[^@/\s]+@/, label: "database URL with an inline password" },
+];
+export const noSecretLiteralsRule = {
+    id: "CPL001",
+    severity: "error",
+    category: "security",
+    description: "No literal credential material in cpln declarations — reference a secret instead",
+    check(context) {
+        const diagnostics = [];
+        const source = context.sourceFile;
+        const visit = (node, insideCplnNew) => {
+            let inside = insideCplnNew;
+            if (ts.isNewExpression(node)) {
+                const name = node.expression.getText(source);
+                const short = name.split(".").pop() ?? name;
+                if (CPLN_KINDS.has(short))
+                    inside = true;
+            }
+            if (inside && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))) {
+                for (const { pattern, label } of CREDENTIAL_SHAPES) {
+                    if (!pattern.test(node.text))
+                        continue;
+                    const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+                    diagnostics.push({
+                        ruleId: "CPL001",
+                        severity: "error",
+                        message: `Literal ${label} in a cpln declaration. Store it as a Secret and reference it as ` +
+                            `\`cpln://secret/NAME.FIELD\` — a literal here is a credential in git history.`,
+                        file: context.filePath,
+                        line: line + 1,
+                        column: character + 1,
+                    });
+                    break;
+                }
+            }
+            ts.forEachChild(node, (child) => visit(child, inside));
+        };
+        visit(source, false);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/cpl002-prefer-resource-reference.js

@@ -0,0 +1,60 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * CPL002: prefer a resource reference over a hand-written link.
+ *
+ * The cpln serializer resolves a declared resource passed where a link is
+ * expected into the correct link for its kind — including the GVC qualifier
+ * that the identity form needs and that is silently ignored when missing. A
+ * hand-spelled `"//gvc/prod/identity/api"` gets none of that: it does not
+ * follow a rename, it is not checked against anything at author time, and
+ * getting the shape subtly wrong fails at runtime rather than at apply.
+ *
+ * This is a style rule, not a correctness one — the literal form is valid, and
+ * is the only option for a resource this stack does not declare. It fires on
+ * the link syntax specifically, so ordinary strings are untouched.
+ *
+ * Not flagged: `cpln://secret/…` and `cpln://volumeset/…`. Those are runtime
+ * *resolution* URIs read by the container, not links between resources, and
+ * they have no reference form to prefer.
+ */
+const CPLN_KINDS = new Set(["Gvc", "Workload", "Identity", "VolumeSet", "Secret", "Policy", "Domain", "IpSet"]);
+/** `//gvc/prod/identity/api` or `//secret/db-password`. */
+const LINK = /^\/\/(?:gvc\/[^/\s]+\/)?(gvc|workload|identity|volumeset|secret|policy|domain|ipset)\/[^/\s]+$/;
+export const preferResourceReferenceRule = {
+    id: "CPL002",
+    severity: "info",
+    category: "style",
+    description: "Prefer passing a declared resource over a hand-written Control Plane link",
+    check(context) {
+        const diagnostics = [];
+        const source = context.sourceFile;
+        const visit = (node, insideCplnNew) => {
+            let inside = insideCplnNew;
+            if (ts.isNewExpression(node)) {
+                const name = node.expression.getText(source);
+                const short = name.split(".").pop() ?? name;
+                if (CPLN_KINDS.has(short))
+                    inside = true;
+            }
+            if (inside && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))) {
+                const match = LINK.exec(node.text);
+                if (match) {
+                    const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+                    diagnostics.push({
+                        ruleId: "CPL002",
+                        severity: "info",
+                        message: `Hand-written link "${node.text}". If the ${match[1]} is declared in this stack, pass the ` +
+                            `resource itself — the serializer emits the correct link, including the GVC qualifier, and ` +
+                            `the reference follows a rename.`,
+                        file: context.filePath,
+                        line: line + 1,
+                        column: character + 1,
+                    });
+                }
+            }
+            ts.forEachChild(node, (child) => visit(child, inside));
+        };
+        visit(source, false);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/index.js

@@ -0,0 +1,6 @@
+import { noSecretLiteralsRule } from "./cpl001-no-secret-literals.js";
+import { preferResourceReferenceRule } from "./cpl002-prefer-resource-reference.js";
+export { noSecretLiteralsRule } from "./cpl001-no-secret-literals.js";
+export { preferResourceReferenceRule } from "./cpl002-prefer-resource-reference.js";
+/** All source-level lint rules provided by this lexicon (imported by plugin.ts). */
+export const rules = [noSecretLiteralsRule, preferResourceReferenceRule];

package/dist/lsp/completions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAmBpF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEpE"}
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAmBpF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEpE"}

package/dist/lsp/completions.js

@@ -0,0 +1,24 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconCompletions } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+/**
+ * The generated registry, loaded once. It carries every cpln resource and
+ * property type with its constraints, which is exactly what the shared
+ * completion provider indexes — so completions cannot drift from the types.
+ */
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-cpln.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * LSP completions for cpln resources — class names after `new `, property
+ * names inside a constructor.
+ */
+export function completions(ctx) {
+    return lexiconCompletions(ctx, getIndex(), "cpln resource");
+}

package/dist/lsp/hover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AA6H1E,wDAAwD;AACxD,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AA6H1E,wDAAwD;AACxD,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}

package/dist/lsp/hover.js

@@ -0,0 +1,106 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconHover } from "@intentius/chant/lsp/lexicon-providers";
+import { KINDS, kindByClassName } from "../kinds.js";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-cpln.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Per-kind notes.
+ *
+ * These carry the rules an author cannot infer from the property names, and
+ * specifically the ones whose violation fails *silently* — an unqualified
+ * identity link, a scale-to-zero that never happens, an immutable field. The
+ * property list is already in the types; what hover adds is the part the types
+ * cannot say.
+ */
+const KIND_NOTES = {
+    Gvc: "The placement and networking boundary. Workloads, identities and volume sets live inside one.\n\n" +
+        "Placement is set here, not per workload (`spec.staticPlacement.locationLinks`, e.g. " +
+        "`/org/acme/location/aws-us-east-1`). **Pull secrets are also GVC-level** (`spec.pullSecretLinks`) — " +
+        "only `docker`, `ecr` and `gcp` secret types are valid. KEDA must be enabled here before a standard or " +
+        "stateful workload in the GVC can use it.",
+    Workload: "A running unit of work. **`type` and `name` are immutable** — changing either means delete and recreate.\n\n" +
+        "- `serverless` — exactly one HTTP port, required. Scales to zero with `rps` or `concurrency`.\n" +
+        "- `standard` — multiple ports, non-HTTP allowed. Scale to zero via KEDA only.\n" +
+        "- `stateful` — stable replica identity; the only type that mounts `ext4`/`xfs` volumes or uses " +
+        "`replicaDirect` load balancing.\n" +
+        "- `cron` — must set `spec.job.schedule` and expose no ports. Probes, autoscaling and `timeoutSeconds` " +
+        "are accepted and ignored.\n\n" +
+        "Capacity AI is **on by default** for serverless, standard and cron, and conflicts with CPU-utilization " +
+        "autoscaling, multi-metric autoscaling, and GPUs. Memory(MiB)/CPU(millicores) must be ≤ 8.",
+    Identity: "A workload's identity: cloud-provider access, network resources, and the principal a policy grants to.\n\n" +
+        "**GVC-scoped and not shareable** — an identity cannot be used from another GVC; declare one per GVC with " +
+        "the same spec. A workload has at most one. Each provider section allows one account " +
+        "(AWS `roleName` ⊻ `policyRefs`, GCP `serviceAccount` ⊻ `bindings`).\n\n" +
+        "In a policy binding the principal must be `//gvc/GVC/identity/NAME`. The bare `//identity/NAME` is " +
+        "**silently ignored** (CPL013).",
+    VolumeSet: "Persistent storage inside one GVC.\n\n" +
+        "**`fileSystemType` and `performanceClass` are both immutable** — changing either means delete, recreate, " +
+        "and data loss. `ext4`/`xfs` are RWO and bind to exactly one *stateful* workload; `shared` is RWX, works " +
+        "with any type, and supports no snapshots. `high-throughput-ssd` has a 200 GB floor where the others have " +
+        "10 GB. Mount with `cpln://volumeset/NAME`.",
+    Secret: "An org-scoped secret, in one of 12 types.\n\n" +
+        "Reading one at runtime takes three steps, and **missing any one fails silently**: the workload has an " +
+        "identity, a policy grants that identity `reveal` on the secret, and the reference is field-qualified — " +
+        "`cpln://secret/NAME.payload`, not `cpln://secret/NAME` (CPL014).",
+    Policy: "Binds permissions to principals over a target.\n\n" +
+        "`targetKind` is singular and lowercase. Pick exactly one scope: `target: \"all\"`, `targetLinks`, or " +
+        "`targetQuery`. `ipset` and `mk8s` are **not** valid targets — they are governed through their parent. " +
+        "Permissions in a binding must be sorted and unique. Never set `origin` by hand.",
+    Domain: "A custom domain with its TLS, CORS and routing.\n\n" +
+        "**Apex domains must use `dnsMode: cname`** — NS does not support apex. NS mode requires " +
+        "`certChallengeType: dns01`. `gvcLink`, `workloadLink` and `ports[].routes` are mutually exclusive, and " +
+        "`workloadLink` (replica-direct) is stateful-only. Every route must target workloads in one GVC.",
+    IpSet: "Dedicated IP addresses reserved in named locations and bound to a workload.\n\n" +
+        "Not a valid policy target — access is governed through the workload it fronts.",
+};
+/** Enum-valued props are worth spelling out inline — they are the typo surface. */
+function enumLines(entry) {
+    const constraints = entry.propertyConstraints;
+    if (!constraints)
+        return [];
+    const lines = [];
+    for (const [prop, constraint] of Object.entries(constraints)) {
+        if (!Array.isArray(constraint?.enum) || constraint.enum.length === 0)
+            continue;
+        lines.push(`- \`${prop}\`: ${constraint.enum.map((v) => `\`${String(v)}\``).join(" | ")}`);
+    }
+    return lines;
+}
+function cplnHover(className, entry) {
+    const lines = [`**${className}**`, "", `Control Plane type: \`${entry.resourceType}\``];
+    const kind = kindByClassName(className);
+    if (!kind) {
+        // A property type — a nested shape rather than a standalone declarable.
+        // Naming its owner is the useful part, since the names are path-derived.
+        const owner = KINDS.find((k) => className.startsWith(k.className));
+        lines.push("", owner
+            ? `*Property type — a nested shape within \`${owner.className}\`, not a standalone declarable.*`
+            : "*Property type — a nested shape, not a standalone declarable.*");
+        const propertyEnums = enumLines(entry);
+        if (propertyEnums.length > 0)
+            lines.push("", "Enumerated properties:", ...propertyEnums);
+        return { contents: lines.join("\n") };
+    }
+    lines.push("", `Manifest kind: \`${kind.kind}\``);
+    if (kind.gvcScoped)
+        lines.push("", "GVC-scoped — requires a `gvc`.");
+    const note = KIND_NOTES[className];
+    if (note)
+        lines.push("", note);
+    const enums = enumLines(entry);
+    if (enums.length > 0)
+        lines.push("", "Enumerated properties:", ...enums);
+    return { contents: lines.join("\n") };
+}
+/** Provide LSP hover information for cpln resources. */
+export function hover(ctx) {
+    return lexiconHover(ctx, getIndex(), cplnHover);
+}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "cpln",
-  "version": "0.124.31",
+  "version": "0.124.32",
   "chantVersion": ">=0.1.0",
   "namespace": "Cpln"
 }

package/dist/ownership.js

@@ -0,0 +1,25 @@
+/**
+ * The cpln lexicon's ownership convention.
+ *
+ * Declared here rather than in core — the same seam aws (`chant:managed-by`),
+ * azure and fly sit on. Core owns the generic stamp/detect logic; each lexicon
+ * owns key names its provider will actually accept.
+ *
+ * Control Plane gives every kind a free-form `tags` map, which makes this the
+ * cleanest ownership channel of any target chant supports: one uniform place on
+ * all eight kinds, readable straight off a plain `GET`, with no per-kind
+ * special case of the sort fly needs for volumes and certificates.
+ *
+ * Key naming. Tag keys accept a `/`, which Control Plane uses itself for its
+ * reserved `cpln/…` keys (`cpln/relaxMemoryToCpuRatio`). A prefixed key is
+ * therefore both idiomatic and safely namespaced against a future reserved key,
+ * so these follow the same `chant.intentius.io/…` convention as the shared
+ * label channel rather than inventing a flat spelling. The `cpln/` prefix is
+ * Control Plane's own and is never written here.
+ */
+/** Tag keys carrying chant's ownership marker on every cpln resource. */
+export const CPLN_TAG_OWNERSHIP_KEYS = {
+    managedBy: "chant.intentius.io/managed-by",
+    stack: "chant.intentius.io/stack",
+    env: "chant.intentius.io/env",
+};

package/dist/package-cli.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env tsx
+/**
+ * Entry point for `npm run bundle` — generates `src/generated/` and writes the
+ * `dist/` bundle.
+ *
+ * Top-level await rather than an async wrapper, matching the other lexicons:
+ * an async main() leaves event-loop references that keep the process alive
+ * after the bundle is written.
+ */
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { writeBundleSpec } from "@intentius/chant/codegen/package";
+import { packageLexicon } from "./codegen/package.js";
+const pkgDir = dirname(fileURLToPath(import.meta.url));
+const distDir = join(pkgDir, "..", "dist");
+const verbose = process.argv.includes("--verbose") || !process.argv.includes("--quiet");
+const force = process.argv.includes("--force");
+const { spec, stats } = await packageLexicon({ verbose, force });
+writeBundleSpec(spec, distDir);
+console.error(`Packaged ${stats.resources} resources, ${stats.ruleCount} rules, ${stats.skillCount} skills`);
+console.error(`dist/ written to ${distDir}`);