@intentius/chant-lexicon-cpln 0.124.31 → 0.124.32

package/dist/spec/parse.js

@@ -0,0 +1,338 @@
+/**
+ * Control Plane Core API OpenAPI 3.0.3 parser.
+ *
+ * The cpln spec is one document with a schema per kind. Unlike the k8s swagger
+ * or ARM, it is mostly *inline*: `workload.spec.containers[].readinessProbe`
+ * is nested object literals all the way down, with only a handful of named
+ * `$ref` schemas (`query`, `policy_binding`, `secret_opaque`, …). So there is
+ * no upstream definition table to lift property types out of — this parser
+ * synthesizes them from the tree, which raises two questions the naming rules
+ * below answer: what to call them, and where to stop.
+ *
+ * ## Naming
+ *
+ * A `$ref`'d schema keeps its upstream name (`query` → `Query`), so a shape
+ * shared by two kinds is emitted once and both reference it. An inline object
+ * is named by its path under the nearest named ancestor
+ * (`workload.spec.containers[].readinessProbe` → `WorkloadSpecContainersReadinessProbe`).
+ * Names are long, but they are derived rather than chosen, so two runs of the
+ * generator over the same spec agree, and a property that moves in the spec
+ * produces a visible rename rather than a silent re-binding.
+ *
+ * Arrays do not contribute a segment: an array of objects and a single object
+ * yield the same class, because `containers[]` and `containers` describe the
+ * same shape.
+ *
+ * ## Where it stops
+ *
+ * One subtree is deliberately untyped: `spec.sidecar.envoy` on both `gvc` and
+ * `workload`. It is a raw Envoy bootstrap fragment that Control Plane passes
+ * through verbatim — `typed_config`, `google_grpc` channel credentials, the
+ * lot — and expanding it costs 81 property-type classes on `gvc` alone, more
+ * than four times every other shape in this lexicon combined, to type a field
+ * whose contents are Envoy's contract and not Control Plane's. It resolves to
+ * `Record<string, unknown>`; see {@link LOOSENED_PATHS}.
+ *
+ * Everything else is typed in full. That comes to 137 property types across
+ * the eight kinds, with a natural maximum depth of 6.
+ */
+import { extractConstraints as coreExtractConstraints, primaryType, } from "@intentius/chant/codegen/json-schema";
+import { KINDS, NAMESPACE, SERVICE } from "../kinds.js";
+const REF_PREFIX = "#/components/schemas/";
+/** Backstop against a self-referential `$ref` the spec does not currently have. */
+const MAX_DEPTH = 16;
+// ── Curation ───────────────────────────────────────────────────────
+/**
+ * Property paths that resolve to `Record<string, unknown>` instead of being
+ * expanded. Keyed `<kind>:<dotted path>`; see the module comment for why.
+ */
+const LOOSENED_PATHS = new Set(["gvc:spec.sidecar.envoy", "workload:spec.sidecar.envoy"]);
+/**
+ * Types the spec states too loosely to author against, keyed `<kind>:<path>`.
+ *
+ * `tags` is declared as a bare `{"type": "object"}` on all eight kinds, which
+ * resolves to `Record<string, unknown>` — technically true and useless in
+ * practice, since Control Plane stores tag values as strings and an object
+ * value is rejected at apply time. Narrowing it here turns a runtime rejection
+ * into a compile error, and matters more than usual for this lexicon because
+ * `tags` is also where the ownership marker is stamped.
+ */
+const TYPE_OVERRIDES = new Map(KINDS.map((k) => [`${k.kind}:tags`, "Record<string, string>"]));
+/**
+ * Top-level properties treated as read-only attributes on every kind. These
+ * are the envelope the API stamps on a resource, not authoring surface.
+ */
+const ENVELOPE_ATTRIBUTES = new Set(["id", "kind", "version", "created", "lastModified", "links", "alias", "status"]);
+/**
+ * Attribute names core's runtime already owns on every `Declarable`.
+ *
+ * `createResource` installs `lexicon`, `entityType`, `kind`, `props`,
+ * `attributes` and `Ref` as non-configurable instance properties, then defines
+ * an `AttrRef` for each declared attribute. An attribute colliding with one of
+ * those throws `TypeError: Cannot redefine property` in the constructor — not
+ * at generate time, at the moment a user writes `new Gvc({...})`.
+ *
+ * cpln collides on exactly one: every kind carries a read-only `kind`
+ * discriminator. Dropping it costs nothing, because the chant type already
+ * says which kind a resource is and the serializer emits `kind:` from the
+ * kinds table rather than from the resource. The rest of the set is guarded so
+ * a future upstream field cannot reintroduce the same failure quietly.
+ */
+const RESERVED_ATTRIBUTE_NAMES = new Set(["lexicon", "entityType", "kind", "props", "attributes", "Ref"]);
+/**
+ * Properties the spec fails to mark `readOnly` but which are server-computed.
+ *
+ * `workload.health` is a rollup of readiness across locations — the API
+ * populates it and rejects nothing if you send it, so it round-trips as
+ * writable and would show up as permanent drift on every workload if this
+ * lexicon declared it. It is an attribute here regardless of the spec.
+ */
+const FORCED_ATTRIBUTES = new Set(["workload:health"]);
+/**
+ * The spec marks `required: []` on every kind — nothing is required, including
+ * a resource's own name. That is true of a PATCH body and false of anything
+ * chant would synthesize, so `name` is required on every kind, and the two
+ * discriminators without which a manifest is meaningless are required on their
+ * own kind.
+ */
+const FORCED_REQUIRED = new Set(["name", "secret:type", "policy:targetKind"]);
+/**
+ * The `gvc` property every GVC-scoped kind carries.
+ *
+ * Synthetic only with respect to the OpenAPI document. A workload's GVC is a
+ * URL segment there (`/org/{org}/gvc/{gvc}/workload/{name}`) rather than a body
+ * field, so the `workload` schema has none; `identity` and `volumeset` do carry
+ * one, inconsistently — a string on the first, an object on the second.
+ *
+ * The `cpln apply` manifest format, which is what this lexicon actually emits,
+ * has a real top-level `gvc` key for exactly this purpose: "you can specify
+ * either a `gvc` property in the file or use the `--gvc` flag, but not both".
+ * So all three kinds get the same required `gvc: string`, it serializes
+ * straight through, and a manifest stays self-contained rather than depending
+ * on which flag the caller remembered. The Terraform provider makes the same
+ * call (`cpln_workload.gvc`).
+ */
+const SYNTHETIC_GVC_PROP = {
+    name: "gvc",
+    tsType: "string",
+    required: true,
+    description: "Name of the GVC this resource belongs to.",
+    constraints: {},
+};
+// ── Parser ─────────────────────────────────────────────────────────
+/**
+ * Parse the cpln OpenAPI spec into the modelled kinds and every property type
+ * reachable from them.
+ */
+export function parseCplnOpenAPI(data) {
+    const spec = JSON.parse(typeof data === "string" ? data : data.toString("utf-8"));
+    const schemas = spec.components?.schemas ?? {};
+    // Synthesized property types, keyed by class name. Populated as a side effect
+    // of resolving each kind's properties; a shape reached twice is emitted once.
+    const propertyTypes = new Map();
+    const inProgress = new Set();
+    const results = [];
+    for (const kind of KINDS) {
+        const schema = schemas[kind.schema];
+        if (!schema) {
+            throw new Error(`cpln spec has no \`components.schemas.${kind.schema}\` backing kind \`${kind.kind}\` — ` +
+                `the upstream spec changed shape, or the snapshot is stale.`);
+        }
+        const properties = [];
+        const attributes = [];
+        for (const [name, prop] of Object.entries(schema.properties ?? {})) {
+            const isAttribute = prop.readOnly === true || ENVELOPE_ATTRIBUTES.has(name) || FORCED_ATTRIBUTES.has(`${kind.kind}:${name}`);
+            const ctx = { schemas, propertyTypes, inProgress, kind };
+            const tsType = resolveType(prop, ctx, kind.className + segment(name), `${kind.kind}:${name}`, 0, isAttribute);
+            if (isAttribute) {
+                if (!RESERVED_ATTRIBUTE_NAMES.has(name))
+                    attributes.push({ name, tsType });
+                continue;
+            }
+            properties.push({
+                name,
+                tsType,
+                required: (schema.required ?? []).includes(name) || FORCED_REQUIRED.has(name) || FORCED_REQUIRED.has(`${kind.kind}:${name}`),
+                description: prop.description,
+                constraints: coreExtractConstraints(prop),
+            });
+        }
+        if (kind.gvcScoped) {
+            // Replace rather than append: `identity` and `volumeset` already declare
+            // a `gvc` of their own, in two different shapes. One normalized property
+            // beats three near-identical ones.
+            const existing = properties.findIndex((p) => p.name === "gvc");
+            if (existing >= 0)
+                properties.splice(existing, 1);
+            properties.push({ ...SYNTHETIC_GVC_PROP });
+        }
+        results.push({
+            resource: { typeName: kind.typeName, description: kind.summary, properties, attributes },
+            propertyTypes: [],
+            enums: [],
+        });
+    }
+    for (const [className, resource] of [...propertyTypes].sort(([a], [b]) => a.localeCompare(b))) {
+        results.push({
+            resource: { ...resource, typeName: `${NAMESPACE}::${SERVICE}::${className}` },
+            propertyTypes: [],
+            enums: [],
+            isProperty: true,
+        });
+    }
+    return results;
+}
+/**
+ * Resolve a schema node to a TypeScript type, emitting property-type classes
+ * for the object shapes it reaches.
+ *
+ * `className` is the name an inline object at this position would take;
+ * `path` is the `<kind>:<dotted path>` used to consult {@link LOOSENED_PATHS}.
+ * `readOnlyBranch` suppresses class emission under a read-only subtree —
+ * `status` trees are reported back as plain data, and typing them would double
+ * this lexicon's surface for shapes nobody authors.
+ */
+function resolveType(node, ctx, className, path, depth, readOnlyBranch) {
+    if (!node || depth > MAX_DEPTH)
+        return "Record<string, unknown>";
+    if (LOOSENED_PATHS.has(path))
+        return "Record<string, unknown>";
+    const override = TYPE_OVERRIDES.get(path);
+    if (override)
+        return override;
+    // A `$ref` adopts the upstream schema's name, so a shape shared between two
+    // kinds is emitted once rather than once per path that reaches it.
+    if (node.$ref) {
+        const refName = refTarget(node.$ref);
+        if (!refName)
+            return "Record<string, unknown>";
+        const target = ctx.schemas[refName];
+        if (!target)
+            return "Record<string, unknown>";
+        return resolveType(target, ctx, schemaClassName(refName), path, depth + 1, readOnlyBranch);
+    }
+    // `allOf: [{ $ref }]` — the OpenAPI idiom for "typed as this schema".
+    if (node.allOf?.length) {
+        const withRef = node.allOf.find((s) => s.$ref);
+        if (withRef)
+            return resolveType(withRef, ctx, className, path, depth + 1, readOnlyBranch);
+    }
+    const union = node.oneOf ?? node.anyOf;
+    if (union?.length) {
+        // Named branches keep their type; inline object branches collapse to a map.
+        // The only union of consequence is `secret.data`, whose named branches are
+        // the six documented secret payloads and whose inline branches are
+        // provider-specific credential bags — a union of six anonymous
+        // `SecretDataVariant3`-style classes would be worse than one honest map.
+        const members = union.map((branch) => branch.$ref
+            ? resolveType(branch, ctx, className, path, depth + 1, readOnlyBranch)
+            : branch.properties
+                ? "Record<string, unknown>"
+                : resolveType(branch, ctx, className, path, depth + 1, readOnlyBranch));
+        return dedupeUnion(members);
+    }
+    if (node.enum?.length)
+        return enumUnion(node.enum);
+    const kind = primaryType(node.type);
+    if (kind === "array") {
+        // An array contributes no name segment: `containers[]` and `containers`
+        // describe the same shape.
+        const item = resolveType(node.items, ctx, className, path, depth + 1, readOnlyBranch);
+        return item.includes(" | ") ? `(${item})[]` : `${item}[]`;
+    }
+    if (kind === "object" || (!node.type && node.properties)) {
+        if (node.properties && Object.keys(node.properties).length > 0) {
+            if (readOnlyBranch)
+                return "Record<string, unknown>";
+            return emitPropertyType(node, ctx, className, path, depth);
+        }
+        if (node.additionalProperties && typeof node.additionalProperties === "object") {
+            const value = resolveType(node.additionalProperties, ctx, className, path, depth + 1, readOnlyBranch);
+            return `Record<string, ${value}>`;
+        }
+        return "Record<string, unknown>";
+    }
+    switch (kind) {
+        case "string":
+            return "string";
+        case "integer":
+        case "number":
+            return "number";
+        case "boolean":
+            return "boolean";
+        default:
+            return "Record<string, unknown>";
+    }
+}
+/**
+ * Register (or reuse) a property-type class for an object schema and return
+ * its class name.
+ */
+function emitPropertyType(node, ctx, className, path, depth) {
+    if (ctx.propertyTypes.has(className))
+        return className;
+    // A `$ref` cycle would otherwise recurse forever. The spec has none today;
+    // this makes adding one a loose type rather than a hung generator.
+    if (ctx.inProgress.has(className))
+        return className;
+    ctx.inProgress.add(className);
+    const required = new Set(node.required ?? []);
+    const properties = [];
+    for (const [name, prop] of Object.entries(node.properties ?? {})) {
+        if (prop.readOnly === true)
+            continue;
+        properties.push({
+            name,
+            tsType: resolveType(prop, ctx, className + segment(name), `${path}.${name}`, depth + 1, false),
+            required: required.has(name),
+            description: prop.description,
+            constraints: coreExtractConstraints(prop),
+        });
+    }
+    ctx.inProgress.delete(className);
+    ctx.propertyTypes.set(className, {
+        typeName: className,
+        description: node.description,
+        properties,
+        attributes: [],
+    });
+    return className;
+}
+// ── Naming helpers ─────────────────────────────────────────────────
+/**
+ * Upstream schema names that read better with their internal word boundary
+ * restored. `volumeset` and `ipset` are one lowercase token in the API and two
+ * words everywhere in Control Plane's own documentation.
+ */
+const SCHEMA_NAME_ALIASES = {
+    volumeset: "VolumeSet",
+    ipset: "IpSet",
+};
+/** `volumeset_spec` → `VolumeSetSpec`, `policy_binding` → `PolicyBinding`. */
+export function schemaClassName(schemaName) {
+    return schemaName
+        .split("_")
+        .map((part) => SCHEMA_NAME_ALIASES[part] ?? segment(part))
+        .join("");
+}
+/** `readinessProbe` → `ReadinessProbe`; strips anything not identifier-safe. */
+function segment(name) {
+    const cleaned = name.replace(/[^A-Za-z0-9]/g, "");
+    return cleaned.charAt(0).toUpperCase() + cleaned.slice(1);
+}
+/** `#/components/schemas/query` → `query`. */
+function refTarget(ref) {
+    return ref.startsWith(REF_PREFIX) ? ref.slice(REF_PREFIX.length) : undefined;
+}
+/** Render an enum as a sorted string-literal union. */
+function enumUnion(values) {
+    return [...values]
+        .map((v) => JSON.stringify(v))
+        .sort()
+        .join(" | ");
+}
+/** Collapse duplicate union members, preserving first-seen order. */
+function dedupeUnion(members) {
+    const unique = [...new Set(members)];
+    return unique.length === 0 ? "Record<string, unknown>" : unique.join(" | ");
+}

package/dist/spec/snapshot-cli.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env tsx
+/**
+ * Refresh the committed offline spec snapshot (`just snapshot`).
+ *
+ * Fetches the live Control Plane OpenAPI document and writes back the subset
+ * reachable from the modelled kinds. Pruning is what makes committing it
+ * reasonable: the full document is 2.8 MB of which this lexicon reads 23
+ * schemas, and the remainder is `patch_*` mirrors and kinds not modelled here
+ * — churn in a file whose whole purpose is to be a stable fallback. It is
+ * written re-indented rather than compact so upstream changes show up as a
+ * readable diff.
+ *
+ * Run this on a networked machine whenever the generated surface is meant to
+ * move, and commit the result in the same change as the regenerated types, so
+ * the snapshot and the types in the tree always describe the same API.
+ */
+import { writeFileSync } from "fs";
+import { SCHEMA_URL, SNAPSHOT_FILE } from "./fetch.js";
+import { KINDS } from "../kinds.js";
+const REF_RE = /#\/components\/schemas\/([A-Za-z0-9_]+)/g;
+async function main() {
+    console.error(`Fetching ${SCHEMA_URL} …`);
+    const response = await fetch(SCHEMA_URL);
+    if (!response.ok) {
+        throw new Error(`${SCHEMA_URL} answered ${response.status} ${response.statusText}`);
+    }
+    const spec = (await response.json());
+    const schemas = spec.components?.schemas;
+    if (!schemas)
+        throw new Error("response carried no components.schemas");
+    // Transitive closure over `$ref` from the modelled kinds.
+    const keep = new Set();
+    const queue = KINDS.map((k) => k.schema);
+    while (queue.length > 0) {
+        const name = queue.shift();
+        if (keep.has(name) || !(name in schemas))
+            continue;
+        keep.add(name);
+        for (const match of JSON.stringify(schemas[name]).matchAll(REF_RE))
+            queue.push(match[1]);
+    }
+    const missing = KINDS.filter((k) => !keep.has(k.schema));
+    if (missing.length > 0) {
+        throw new Error(`spec is missing schemas for: ${missing.map((k) => k.schema).join(", ")}`);
+    }
+    const pruned = {
+        openapi: spec.openapi,
+        info: spec.info,
+        components: {
+            schemas: Object.fromEntries([...keep].sort().map((name) => [name, schemas[name]])),
+        },
+    };
+    const json = `${JSON.stringify(pruned, null, 1)}\n`;
+    writeFileSync(SNAPSHOT_FILE, json);
+    console.error(`Wrote ${keep.size} schemas (${(json.length / 1024).toFixed(0)} KB) to ${SNAPSHOT_FILE}`);
+}
+main().catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+});

package/dist/validate-cli.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env tsx
+import { validate } from "./validate.js";
+import { printValidationResult } from "@intentius/chant/codegen/validate";
+// `validate` returns a result; printing it is what turns a failed check into a
+// non-zero exit. Calling it and discarding the answer exits 0 whatever the
+// registry looks like — the same scaffold bug cedar carried.
+printValidationResult(await validate());

package/dist/validate.js

@@ -0,0 +1,88 @@
+/**
+ * Validate the generated `lexicon-cpln` artifacts.
+ *
+ * The required-names list is the point of this file: it asserts that a
+ * regeneration still produced the surface consumers import. A rename upstream,
+ * a parser change that stops following a `$ref`, or a loosened subtree would
+ * otherwise leave a smaller generated surface that builds fine and is missing
+ * classes nobody notices until an import fails.
+ *
+ * The list spans all three layers deliberately — the eight resources, property
+ * types reached through several different mechanisms (inline nesting, a `$ref`,
+ * a `oneOf` branch, an array item), and the deepest shapes the parser walks to.
+ * A shallow list of the eight resource names would pass while the entire
+ * property-type tree vanished.
+ */
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+import { validateLexiconArtifacts } from "@intentius/chant/codegen/validate";
+import { KINDS } from "./kinds.js";
+const REQUIRED_NAMES = [
+    // The eight resources.
+    ...KINDS.map((kind) => kind.className),
+    // Top-level specs — inline on gvc/workload/domain/ipset, a `$ref` on volumeset.
+    "GvcSpec",
+    "WorkloadSpec",
+    "VolumeSetSpec",
+    "DomainSpec",
+    "IpSetSpec",
+    // The workload authoring surface most specs actually use.
+    "WorkloadSpecContainers",
+    "WorkloadSpecContainersPorts",
+    "WorkloadSpecContainersEnv",
+    "WorkloadSpecContainersVolumes",
+    "WorkloadSpecContainersReadinessProbe",
+    "WorkloadSpecContainersReadinessProbeHttpGet",
+    "WorkloadSpecContainersLivenessProbe",
+    "WorkloadSpecFirewallConfig",
+    "WorkloadSpecFirewallConfigExternal",
+    "WorkloadSpecFirewallConfigInternal",
+    "WorkloadSpecDefaultOptions",
+    "WorkloadSpecDefaultOptionsAutoscaling",
+    "WorkloadSpecJob",
+    "WorkloadSpecLoadBalancer",
+    "WorkloadSpecVm",
+    // GVC placement and routing.
+    "GvcSpecStaticPlacement",
+    "GvcSpecStaticPlacementLocationQuery",
+    "GvcSpecLoadBalancer",
+    "GvcSpecTracing",
+    "GvcSpecKeda",
+    // Storage.
+    "VolumeSetSpecSnapshots",
+    "VolumeSetSpecAutoscaling",
+    "VolumeSetSpecMountOptions",
+    // Domain routing.
+    "DomainSpecPorts",
+    "DomainSpecPortsRoutes",
+    "DomainSpecPortsTls",
+    // Identity provider sections — the XOR-ruled shapes.
+    "IdentityAws",
+    "IdentityGcp",
+    "IdentityAzure",
+    "NetworkResource",
+    // `$ref`'d schemas that keep their upstream name, and the `oneOf` branches of
+    // `secret.data`. These are the two naming mechanisms other than path
+    // derivation, so their absence would mean the parser stopped following a
+    // whole class of reference.
+    "Query",
+    "PolicyBinding",
+    "IpSetLocation",
+    "SecretOpaque",
+    "SecretTls",
+    "SecretKeypair",
+    "SecretUserpass",
+];
+/**
+ * Validate the generated artifacts.
+ */
+export async function validate(opts) {
+    const basePath = opts?.basePath ?? dirname(dirname(fileURLToPath(import.meta.url)));
+    return validateLexiconArtifacts({
+        lexiconJsonFilename: "lexicon-cpln.json",
+        requiredNames: REQUIRED_NAMES,
+        basePath,
+    });
+}
+/** The names `validate` asserts, exported so a test can assert the list itself is deep. */
+export const REQUIRED_ARTIFACT_NAMES = REQUIRED_NAMES;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-cpln",
-  "version": "0.124.31",
+  "version": "0.124.32",
   "type": "module",
   "files": [
     "src/",
@@ -13,22 +13,22 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./detect": {
       "development": "./src/detect.ts",
       "types": "./dist/detect.d.ts",
-      "default": "./src/detect.ts"
+      "default": "./dist/detect.js"
     },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
-      "default": "./src/lint/post-synth/index.ts"
+      "default": "./dist/lint/post-synth/index.js"
     },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
@@ -41,7 +41,7 @@
     "docs": "tsx src/codegen/docs-cli.ts",
     "snapshot": "tsx src/spec/snapshot-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "devDependencies": {
     "@intentius/chant": "*",
@@ -49,7 +49,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.31"
+    "@intentius/chant": "^0.124.32"
   },
   "description": "Control Plane (cpln) lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",

package/src/codegen/package.ts

@@ -4,7 +4,7 @@
 
 import { readFileSync } from "fs";
 import { dirname, join } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import { packagePipeline, collectSkills } from "@intentius/chant/codegen/package";
 import { generate } from "./generate";
 import { cplnPlugin } from "../plugin";
@@ -14,7 +14,7 @@ export async function packageLexicon(options?: { verbose?: boolean; force?: bool
   // relative to `src/`, so srcDir is the parent of this directory. Pointing it
   // at `src/codegen` globs a directory that does not exist and silently ships
   // a bundle with zero rules and zero skills.
-  const srcDir = dirname(dirname(fileURLToPath(import.meta.url)));
+  const srcDir = dirname(moduleSourceDir(import.meta.url));
   const pkgJson = JSON.parse(readFileSync(join(srcDir, "..", "package.json"), "utf-8"));
 
   const { spec, stats } = await packagePipeline({

package/src/lsp/completions.ts

@@ -1,8 +1,9 @@
 import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
 import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
 import { LexiconIndex, lexiconCompletions, type LexiconEntry } from "@intentius/chant/lsp/lexicon-providers";
 
-const require = createRequire(import.meta.url);
+const require = createRequire(moduleSourceUrl(import.meta.url));
 
 let cachedIndex: LexiconIndex | null = null;
 

package/src/lsp/hover.ts

@@ -1,9 +1,10 @@
 import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
 import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
 import { LexiconIndex, lexiconHover, type LexiconEntry } from "@intentius/chant/lsp/lexicon-providers";
 import { KINDS, kindByClassName } from "../kinds";
 
-const require = createRequire(import.meta.url);
+const require = createRequire(moduleSourceUrl(import.meta.url));
 
 let cachedIndex: LexiconIndex | null = null;
 

package/src/spec/fetch.ts

@@ -32,7 +32,7 @@
 import { join, dirname } from "path";
 import { homedir } from "os";
 import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import { fetchWithCache } from "@intentius/chant/codegen/fetch";
 
 export const SCHEMA_URL = "https://api.cpln.io/openapi.json";
@@ -44,7 +44,7 @@ export const SCHEMA_URL = "https://api.cpln.io/openapi.json";
  */
 const CACHE_FILE = join(homedir(), ".chant", "cpln-openapi.json");
 
-export const SNAPSHOT_FILE = join(dirname(fileURLToPath(import.meta.url)), "cpln-openapi.snapshot.json");
+export const SNAPSHOT_FILE = join(moduleSourceDir(import.meta.url), "cpln-openapi.snapshot.json");
 
 /** The single map key the parser is handed. The spec is one document. */
 export const SPEC_KEY = "Cpln::OpenAPI";