@intentius/chant-lexicon-cpln 0.124.31 → 0.124.33

package/dist/detect.js

@@ -0,0 +1,52 @@
+/**
+ * Detect whether a template is a Control Plane manifest.
+ *
+ * cpln manifests are structurally light — `kind`, `name`, and usually `spec` —
+ * which is not a lot to go on, and `kind`/`name`/`spec` alone would also match a
+ * Kubernetes manifest. The discriminator is that a cpln manifest's `kind` is one
+ * of a small closed set of lowercase strings and it has **no `apiVersion`**,
+ * which every Kubernetes object has and no cpln manifest does.
+ */
+import { KIND_NAMES } from "./kinds.js";
+const KINDS = new Set(KIND_NAMES);
+/**
+ * Every kind `cpln apply` accepts, not only the ones this lexicon models — a
+ * file of `group` and `serviceaccount` documents is still recognisably a
+ * Control Plane manifest, and answering "no" to it would be wrong.
+ */
+const ALL_CPLN_KINDS = new Set([
+    ...KIND_NAMES,
+    "agent",
+    "auditctx",
+    "cloudaccount",
+    "group",
+    "image",
+    "location",
+    "mk8s",
+    "org",
+    "quota",
+    "serviceaccount",
+    "user",
+]);
+/** True when `data` is a cpln manifest document, or a list of them. */
+export function detectCplnTemplate(data) {
+    if (Array.isArray(data)) {
+        return data.length > 0 && data.every((doc) => detectCplnTemplate(doc));
+    }
+    if (!data || typeof data !== "object")
+        return false;
+    const doc = data;
+    // A Kubernetes object. Same three keys, different platform.
+    if (typeof doc.apiVersion === "string")
+        return false;
+    const kind = doc.kind;
+    if (typeof kind !== "string" || !ALL_CPLN_KINDS.has(kind))
+        return false;
+    // `name` is the one field every cpln manifest carries. A bare `{ kind }` is
+    // more likely a fragment than a manifest.
+    return typeof doc.name === "string";
+}
+/** True when the document is a kind this lexicon can generate types for. */
+export function isModelledKind(kind) {
+    return KINDS.has(kind);
+}

package/dist/entity-props.js

@@ -0,0 +1,100 @@
+/**
+ * Read an entity's authored props regardless of representation, and walk the
+ * shapes cpln's checks keep needing.
+ *
+ * Real runtime instances (`createResource`/`createProperty`) keep authored
+ * props under a non-enumerable `.props` — enumerating the instance yields its
+ * `AttrRef`s, not its inputs. Plain objects (test fixtures, parsed manifests)
+ * carry props as own fields. Every cpln consumer goes through here so both
+ * shapes behave identically.
+ *
+ * A cpln spec is also nested property declarables all the way down: a
+ * `Workload`'s `spec.containers[0].readinessProbe` may be a plain object, a
+ * `WorkloadSpecContainersReadinessProbe` instance, or a mix, depending on how
+ * the author wrote it. {@link readProp} unwraps at every level so a check can
+ * be written against one shape.
+ */
+/** Reserved instance fields core installs; never authored props. */
+const RESERVED = new Set(["entityType", "lexicon", "kind", "attributes", "props", "Ref"]);
+/** Read an entity's or property declarable's authored props. */
+export function propsOf(entity) {
+    if (!entity || typeof entity !== "object")
+        return {};
+    const anyEntity = entity;
+    if (anyEntity.props && typeof anyEntity.props === "object" && !Array.isArray(anyEntity.props)) {
+        return anyEntity.props;
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(anyEntity)) {
+        if (RESERVED.has(key))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+/** Read a named property, unwrapping a nested property declarable. */
+export function readProp(source, key) {
+    const props = propsOf(source);
+    const value = props[key];
+    return wrapsProps(value) ? propsOf(value) : value;
+}
+/** Read a nested path, unwrapping declarables at each step. `readPath(w, "spec", "job")`. */
+export function readPath(source, ...keys) {
+    let current = source;
+    for (const key of keys) {
+        if (current === undefined || current === null)
+            return undefined;
+        current = readProp(current, key);
+    }
+    return current;
+}
+/** Read a property expected to be an array, unwrapping each element. */
+export function readArray(source, ...keys) {
+    const value = readPath(source, ...keys);
+    if (!Array.isArray(value))
+        return [];
+    return value.map((item) => (wrapsProps(item) ? propsOf(item) : item));
+}
+/** Read a property expected to be a string. */
+export function readString(source, ...keys) {
+    const value = readPath(source, ...keys);
+    return typeof value === "string" ? value : undefined;
+}
+/** Read a property expected to be a number. */
+export function readNumber(source, ...keys) {
+    const value = readPath(source, ...keys);
+    return typeof value === "number" ? value : undefined;
+}
+/** Read a property expected to be a boolean. */
+export function readBoolean(source, ...keys) {
+    const value = readPath(source, ...keys);
+    return typeof value === "boolean" ? value : undefined;
+}
+/**
+ * A value that carries authored props under `.props`.
+ *
+ * chant#2444 — deliberately NOT `isDeclarable`, and deliberately not named as
+ * though it were. This answers "does this wrap props that should be unwrapped",
+ * which is a different question from "is this an entity", and it has to match
+ * markerless objects: swapping it for core's marker test fails 85 of this
+ * lexicon's tests, because cpln's nested property shapes carry `.props` without
+ * carrying an entity marker.
+ *
+ * The old name invited exactly that swap. It is one of three readings of
+ * "declarable" chant#2444 found in the tree, and the only one that was never a
+ * divergent copy of the entity test — the other, in `forgejo/src/dialect.ts`,
+ * was and is now core's.
+ */
+function wrapsProps(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        typeof value.props === "object");
+}
+/** Iterate the entities of one cpln kind, yielding `[name, entity]`. */
+export function* entitiesOfType(entities, typeName) {
+    for (const [name, entity] of entities) {
+        if (entity.entityType === typeName)
+            yield [name, entity];
+    }
+}

package/dist/generated/index.js

@@ -0,0 +1,169 @@
+// Code generated by chant generate. DO NOT EDIT.
+import { createResource, createProperty } from "./runtime.js";
+export const Domain = /* @__PURE__ */ createResource("Cpln::Core::Domain", "cpln", { "id": "id", "version": "version", "created": "created", "lastModified": "lastModified", "links": "links", "status": "status" });
+export const Gvc = /* @__PURE__ */ createResource("Cpln::Core::Gvc", "cpln", { "id": "id", "version": "version", "created": "created", "lastModified": "lastModified", "links": "links", "alias": "alias", "status": "status" });
+export const Identity = /* @__PURE__ */ createResource("Cpln::Core::Identity", "cpln", { "id": "id", "version": "version", "created": "created", "lastModified": "lastModified", "links": "links", "status": "status" });
+export const IpSet = /* @__PURE__ */ createResource("Cpln::Core::IpSet", "cpln", { "id": "id", "version": "version", "created": "created", "lastModified": "lastModified", "links": "links", "status": "status" });
+export const Policy = /* @__PURE__ */ createResource("Cpln::Core::Policy", "cpln", { "id": "id", "version": "version", "created": "created", "lastModified": "lastModified", "links": "links" });
+export const Secret = /* @__PURE__ */ createResource("Cpln::Core::Secret", "cpln", { "id": "id", "version": "version", "created": "created", "lastModified": "lastModified", "links": "links" });
+export const VolumeSet = /* @__PURE__ */ createResource("Cpln::Core::VolumeSet", "cpln", { "id": "id", "version": "version", "created": "created", "lastModified": "lastModified", "links": "links", "status": "status" });
+export const Workload = /* @__PURE__ */ createResource("Cpln::Core::Workload", "cpln", { "id": "id", "version": "version", "created": "created", "lastModified": "lastModified", "links": "links", "health": "health", "status": "status" });
+export const DomainSpec = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpec", "cpln");
+export const DomainSpecPorts = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPorts", "cpln");
+export const DomainSpecPortsCors = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsCors", "cpln");
+export const DomainSpecPortsCorsAllowOrigins = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsCorsAllowOrigins", "cpln");
+export const DomainSpecPortsRoutes = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsRoutes", "cpln");
+export const DomainSpecPortsRoutesCanaries = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsRoutesCanaries", "cpln");
+export const DomainSpecPortsRoutesHeaders = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsRoutesHeaders", "cpln");
+export const DomainSpecPortsRoutesHeadersRequest = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsRoutesHeadersRequest", "cpln");
+export const DomainSpecPortsRoutesMirror = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsRoutesMirror", "cpln");
+export const DomainSpecPortsTls = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsTls", "cpln");
+export const DomainSpecPortsTlsClientCertificate = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsTlsClientCertificate", "cpln");
+export const DomainSpecPortsTlsServerCertificate = /* @__PURE__ */ createProperty("Cpln::Core::DomainSpecPortsTlsServerCertificate", "cpln");
+export const GvcSpec = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpec", "cpln");
+export const GvcSpecEnv = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecEnv", "cpln");
+export const GvcSpecKeda = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecKeda", "cpln");
+export const GvcSpecLoadBalancer = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecLoadBalancer", "cpln");
+export const GvcSpecLoadBalancerMultiZone = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecLoadBalancerMultiZone", "cpln");
+export const GvcSpecLoadBalancerRedirect = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecLoadBalancerRedirect", "cpln");
+export const GvcSpecLoadBalancerRedirectClass = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecLoadBalancerRedirectClass", "cpln");
+export const GvcSpecSidecar = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecSidecar", "cpln");
+export const GvcSpecStaticPlacement = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecStaticPlacement", "cpln");
+export const GvcSpecStaticPlacementLocationOptions = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecStaticPlacementLocationOptions", "cpln");
+export const GvcSpecStaticPlacementLocationQuery = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecStaticPlacementLocationQuery", "cpln");
+export const GvcSpecStaticPlacementLocationQuerySpec = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecStaticPlacementLocationQuerySpec", "cpln");
+export const GvcSpecStaticPlacementLocationQuerySpecSort = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecStaticPlacementLocationQuerySpecSort", "cpln");
+export const GvcSpecStaticPlacementLocationQuerySpecTerms = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecStaticPlacementLocationQuerySpecTerms", "cpln");
+export const GvcSpecTracing = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecTracing", "cpln");
+export const GvcSpecTracingLightstep = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecTracingLightstep", "cpln");
+export const GvcSpecTracingProvider = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecTracingProvider", "cpln");
+export const GvcSpecTracingProviderLightstep = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecTracingProviderLightstep", "cpln");
+export const GvcSpecTracingProviderOtel = /* @__PURE__ */ createProperty("Cpln::Core::GvcSpecTracingProviderOtel", "cpln");
+export const IdentityAws = /* @__PURE__ */ createProperty("Cpln::Core::IdentityAws", "cpln");
+export const IdentityAwsTrustPolicy = /* @__PURE__ */ createProperty("Cpln::Core::IdentityAwsTrustPolicy", "cpln");
+export const IdentityAzure = /* @__PURE__ */ createProperty("Cpln::Core::IdentityAzure", "cpln");
+export const IdentityAzureRoleAssignments = /* @__PURE__ */ createProperty("Cpln::Core::IdentityAzureRoleAssignments", "cpln");
+export const IdentityGcp = /* @__PURE__ */ createProperty("Cpln::Core::IdentityGcp", "cpln");
+export const IdentityGcpBindings = /* @__PURE__ */ createProperty("Cpln::Core::IdentityGcpBindings", "cpln");
+export const IdentityMemcacheAccess = /* @__PURE__ */ createProperty("Cpln::Core::IdentityMemcacheAccess", "cpln");
+export const IdentityNativeNetworkResources = /* @__PURE__ */ createProperty("Cpln::Core::IdentityNativeNetworkResources", "cpln");
+export const IdentityNativeNetworkResourcesAwsPrivateLink = /* @__PURE__ */ createProperty("Cpln::Core::IdentityNativeNetworkResourcesAwsPrivateLink", "cpln");
+export const IdentityNativeNetworkResourcesGcpServiceConnect = /* @__PURE__ */ createProperty("Cpln::Core::IdentityNativeNetworkResourcesGcpServiceConnect", "cpln");
+export const IdentityNgs = /* @__PURE__ */ createProperty("Cpln::Core::IdentityNgs", "cpln");
+export const IdentityNgsPub = /* @__PURE__ */ createProperty("Cpln::Core::IdentityNgsPub", "cpln");
+export const IdentityNgsResp = /* @__PURE__ */ createProperty("Cpln::Core::IdentityNgsResp", "cpln");
+export const IdentityNgsSub = /* @__PURE__ */ createProperty("Cpln::Core::IdentityNgsSub", "cpln");
+export const IdentitySpicedbAccess = /* @__PURE__ */ createProperty("Cpln::Core::IdentitySpicedbAccess", "cpln");
+export const IpSetLocation = /* @__PURE__ */ createProperty("Cpln::Core::IpSetLocation", "cpln");
+export const IpSetSpec = /* @__PURE__ */ createProperty("Cpln::Core::IpSetSpec", "cpln");
+export const NetworkResource = /* @__PURE__ */ createProperty("Cpln::Core::NetworkResource", "cpln");
+export const PolicyBinding = /* @__PURE__ */ createProperty("Cpln::Core::PolicyBinding", "cpln");
+export const Query = /* @__PURE__ */ createProperty("Cpln::Core::Query", "cpln");
+export const QuerySpec = /* @__PURE__ */ createProperty("Cpln::Core::QuerySpec", "cpln");
+export const QuerySpecSort = /* @__PURE__ */ createProperty("Cpln::Core::QuerySpecSort", "cpln");
+export const QuerySpecTerms = /* @__PURE__ */ createProperty("Cpln::Core::QuerySpecTerms", "cpln");
+export const SecretAwskey = /* @__PURE__ */ createProperty("Cpln::Core::SecretAwskey", "cpln");
+export const SecretKeypair = /* @__PURE__ */ createProperty("Cpln::Core::SecretKeypair", "cpln");
+export const SecretOpaque = /* @__PURE__ */ createProperty("Cpln::Core::SecretOpaque", "cpln");
+export const SecretTls = /* @__PURE__ */ createProperty("Cpln::Core::SecretTls", "cpln");
+export const SecretUserpass = /* @__PURE__ */ createProperty("Cpln::Core::SecretUserpass", "cpln");
+export const VolumeSetSpec = /* @__PURE__ */ createProperty("Cpln::Core::VolumeSetSpec", "cpln");
+export const VolumeSetSpecAutoscaling = /* @__PURE__ */ createProperty("Cpln::Core::VolumeSetSpecAutoscaling", "cpln");
+export const VolumeSetSpecAutoscalingPredictive = /* @__PURE__ */ createProperty("Cpln::Core::VolumeSetSpecAutoscalingPredictive", "cpln");
+export const VolumeSetSpecCustomEncryption = /* @__PURE__ */ createProperty("Cpln::Core::VolumeSetSpecCustomEncryption", "cpln");
+export const VolumeSetSpecMountOptions = /* @__PURE__ */ createProperty("Cpln::Core::VolumeSetSpecMountOptions", "cpln");
+export const VolumeSetSpecMountOptionsResources = /* @__PURE__ */ createProperty("Cpln::Core::VolumeSetSpecMountOptionsResources", "cpln");
+export const VolumeSetSpecSnapshots = /* @__PURE__ */ createProperty("Cpln::Core::VolumeSetSpecSnapshots", "cpln");
+export const WorkloadSpec = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpec", "cpln");
+export const WorkloadSpecContainers = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainers", "cpln");
+export const WorkloadSpecContainersEnv = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersEnv", "cpln");
+export const WorkloadSpecContainersGpu = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersGpu", "cpln");
+export const WorkloadSpecContainersGpuCustom = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersGpuCustom", "cpln");
+export const WorkloadSpecContainersGpuNvidia = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersGpuNvidia", "cpln");
+export const WorkloadSpecContainersLifecycle = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLifecycle", "cpln");
+export const WorkloadSpecContainersLifecyclePostStart = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLifecyclePostStart", "cpln");
+export const WorkloadSpecContainersLifecyclePostStartExec = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLifecyclePostStartExec", "cpln");
+export const WorkloadSpecContainersLifecyclePreStop = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLifecyclePreStop", "cpln");
+export const WorkloadSpecContainersLifecyclePreStopExec = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLifecyclePreStopExec", "cpln");
+export const WorkloadSpecContainersLivenessProbe = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLivenessProbe", "cpln");
+export const WorkloadSpecContainersLivenessProbeExec = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLivenessProbeExec", "cpln");
+export const WorkloadSpecContainersLivenessProbeGrpc = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLivenessProbeGrpc", "cpln");
+export const WorkloadSpecContainersLivenessProbeHttpGet = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLivenessProbeHttpGet", "cpln");
+export const WorkloadSpecContainersLivenessProbeHttpGetHttpHeaders = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLivenessProbeHttpGetHttpHeaders", "cpln");
+export const WorkloadSpecContainersLivenessProbeTcpSocket = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersLivenessProbeTcpSocket", "cpln");
+export const WorkloadSpecContainersMetrics = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersMetrics", "cpln");
+export const WorkloadSpecContainersPorts = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersPorts", "cpln");
+export const WorkloadSpecContainersReadinessProbe = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersReadinessProbe", "cpln");
+export const WorkloadSpecContainersReadinessProbeExec = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersReadinessProbeExec", "cpln");
+export const WorkloadSpecContainersReadinessProbeGrpc = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersReadinessProbeGrpc", "cpln");
+export const WorkloadSpecContainersReadinessProbeHttpGet = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersReadinessProbeHttpGet", "cpln");
+export const WorkloadSpecContainersReadinessProbeHttpGetHttpHeaders = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersReadinessProbeHttpGetHttpHeaders", "cpln");
+export const WorkloadSpecContainersReadinessProbeTcpSocket = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersReadinessProbeTcpSocket", "cpln");
+export const WorkloadSpecContainersVolumes = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecContainersVolumes", "cpln");
+export const WorkloadSpecDefaultOptions = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptions", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscaling = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscaling", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKeda = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKeda", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaAdvanced = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaAdvanced", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfig = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfig", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehavior = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehavior", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleDown = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleDown", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleDownPolicies = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleDownPolicies", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleUp = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleUp", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleUpPolicies = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleUpPolicies", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedScalingModifiers = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaAdvancedScalingModifiers", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaFallback = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaFallback", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaTriggers = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaTriggers", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingKedaTriggersAuthenticationRef = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingKedaTriggersAuthenticationRef", "cpln");
+export const WorkloadSpecDefaultOptionsAutoscalingMulti = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsAutoscalingMulti", "cpln");
+export const WorkloadSpecDefaultOptionsMultiZone = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecDefaultOptionsMultiZone", "cpln");
+export const WorkloadSpecExtras = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecExtras", "cpln");
+export const WorkloadSpecExtrasMetadata = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecExtrasMetadata", "cpln");
+export const WorkloadSpecFirewallConfig = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecFirewallConfig", "cpln");
+export const WorkloadSpecFirewallConfigExternal = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecFirewallConfigExternal", "cpln");
+export const WorkloadSpecFirewallConfigExternalHttp = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecFirewallConfigExternalHttp", "cpln");
+export const WorkloadSpecFirewallConfigExternalHttpInboundHeaderFilter = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecFirewallConfigExternalHttpInboundHeaderFilter", "cpln");
+export const WorkloadSpecFirewallConfigExternalOutboundAllowPort = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecFirewallConfigExternalOutboundAllowPort", "cpln");
+export const WorkloadSpecFirewallConfigInternal = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecFirewallConfigInternal", "cpln");
+export const WorkloadSpecJob = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecJob", "cpln");
+export const WorkloadSpecLoadBalancer = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLoadBalancer", "cpln");
+export const WorkloadSpecLoadBalancerDirect = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLoadBalancerDirect", "cpln");
+export const WorkloadSpecLoadBalancerDirectPorts = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLoadBalancerDirectPorts", "cpln");
+export const WorkloadSpecLoadBalancerGeoLocation = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLoadBalancerGeoLocation", "cpln");
+export const WorkloadSpecLoadBalancerGeoLocationHeaders = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLoadBalancerGeoLocationHeaders", "cpln");
+export const WorkloadSpecLocalOptions = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptions", "cpln");
+export const WorkloadSpecLocalOptionsAutoscaling = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscaling", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKeda = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKeda", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaAdvanced = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaAdvanced", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfig = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfig", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehavior = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehavior", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleDown = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleDown", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleDownPolicies = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleDownPolicies", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleUp = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleUp", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleUpPolicies = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaAdvancedHorizontalPodAutoscalerConfigBehaviorScaleUpPolicies", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaAdvancedScalingModifiers = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaAdvancedScalingModifiers", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaFallback = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaFallback", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaTriggers = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaTriggers", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingKedaTriggersAuthenticationRef = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingKedaTriggersAuthenticationRef", "cpln");
+export const WorkloadSpecLocalOptionsAutoscalingMulti = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsAutoscalingMulti", "cpln");
+export const WorkloadSpecLocalOptionsMultiZone = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecLocalOptionsMultiZone", "cpln");
+export const WorkloadSpecNetworking = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecNetworking", "cpln");
+export const WorkloadSpecRequestRetryPolicy = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecRequestRetryPolicy", "cpln");
+export const WorkloadSpecRolloutOptions = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecRolloutOptions", "cpln");
+export const WorkloadSpecSandbox = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecSandbox", "cpln");
+export const WorkloadSpecSandboxVolume = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecSandboxVolume", "cpln");
+export const WorkloadSpecSecurityOptions = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecSecurityOptions", "cpln");
+export const WorkloadSpecSidecar = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecSidecar", "cpln");
+export const WorkloadSpecVm = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVm", "cpln");
+export const WorkloadSpecVmAccessCredentials = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmAccessCredentials", "cpln");
+export const WorkloadSpecVmBootDisk = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmBootDisk", "cpln");
+export const WorkloadSpecVmBootDiskPersist = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmBootDiskPersist", "cpln");
+export const WorkloadSpecVmBootDiskSource = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmBootDiskSource", "cpln");
+export const WorkloadSpecVmBootDiskSourceHttp = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmBootDiskSourceHttp", "cpln");
+export const WorkloadSpecVmBootDiskSourceOci = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmBootDiskSourceOci", "cpln");
+export const WorkloadSpecVmClock = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmClock", "cpln");
+export const WorkloadSpecVmCloudInit = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmCloudInit", "cpln");
+export const WorkloadSpecVmCpu = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmCpu", "cpln");
+export const WorkloadSpecVmFirmware = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmFirmware", "cpln");
+export const WorkloadSpecVmFirmwareSmbios = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmFirmwareSmbios", "cpln");
+export const WorkloadSpecVmNetworks = /* @__PURE__ */ createProperty("Cpln::Core::WorkloadSpecVmNetworks", "cpln");
+// Re-exports for convenience

package/dist/generated/runtime.js

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/dist/index.js

@@ -0,0 +1,14 @@
+// Plugin
+export { cplnPlugin } from "./plugin.js";
+// Serializer
+export { cplnSerializer, cplnLink } from "./serializer.js";
+// The modelled kinds and the link/path helpers built on them. Useful to
+// consumers writing their own tooling against a chant-declared cpln estate.
+export { KINDS, KIND_NAMES, kindByName, kindByTypeName, kindByClassName, isCplnResourceType, collectionPath, resourcePath, NAMESPACE, SERVICE, } from "./kinds.js";
+// Ownership marker convention (cpln `tags` keys).
+export { CPLN_TAG_OWNERSHIP_KEYS } from "./ownership.js";
+// Composites — opinionated bundles over the generated resources.
+export * from "./composites/index.js";
+// Generated resources — `Gvc`, `Workload`, `Identity`, `VolumeSet`, `Secret`,
+// `Policy`, `Domain`, `IpSet` and the property types their specs reach.
+export * from "./generated/index.js";

package/dist/init-templates.js

@@ -0,0 +1,125 @@
+/**
+ * `chant init` scaffolding for cpln projects.
+ *
+ * Three templates, chosen so the default is the shape most people actually
+ * start with and the other two are the two directions it grows in. Each is
+ * written to pass this lexicon's own checks as scaffolded — a template that
+ * emits CPL findings on first build teaches the wrong lesson about what the
+ * findings mean.
+ */
+const DEFAULT = `import { GvcEnvironment, ServerlessService } from "@intentius/chant-lexicon-cpln";
+
+// A GVC and one public serverless service.
+//
+// Placement lives on the GVC, not the workload — locationLinks is what decides
+// where anything in this environment runs. Set CPLN_ORG to your org name.
+const org = process.env.CPLN_ORG ?? "my-org";
+
+export const { gvc } = GvcEnvironment({
+  name: "prod",
+  org,
+  locations: ["aws-us-east-1"],
+});
+
+// Serverless requires exactly one HTTP port, and the external firewall starts
+// closed in both directions — so a public service says so explicitly. Egress is
+// left closed; open it to the hosts this actually calls.
+export const { workload } = ServerlessService({
+  name: "web",
+  gvc: "prod",
+  image: "nginx:1.27",
+  port: 8080,
+  inboundAllowCidr: ["0.0.0.0/0"],
+});
+`;
+const WITH_SECRETS = `import {
+  GvcEnvironment,
+  ServerlessService,
+  SecretAccess,
+  Secret,
+  secretRef,
+} from "@intentius/chant-lexicon-cpln";
+
+// A service that reads a secret at runtime.
+//
+// Reading a secret takes three things, and missing any one fails *silently* at
+// runtime rather than at apply: an identity on the workload, a policy granting
+// that identity \`reveal\`, and a field-qualified reference. SecretAccess owns
+// the first two; secretRef() is the third.
+const org = process.env.CPLN_ORG ?? "my-org";
+
+export const { gvc } = GvcEnvironment({
+  name: "prod",
+  org,
+  locations: ["aws-us-east-1"],
+});
+
+// The value is a placeholder. Set the real one with \`cpln secret edit\`, or
+// point this at a value read from the environment at build time — never a
+// literal in source (CPL001).
+export const dbPassword = new Secret({
+  name: "db-password",
+  type: "opaque",
+  data: { payload: process.env.DB_PASSWORD ?? "changeme", encoding: "plain" },
+});
+
+export const { identity, policy } = SecretAccess({
+  name: "web-identity",
+  gvc: "prod",
+  secrets: ["db-password"],
+});
+
+export const { workload } = ServerlessService({
+  name: "web",
+  gvc: "prod",
+  image: "nginx:1.27",
+  port: 8080,
+  inboundAllowCidr: ["0.0.0.0/0"],
+  identityLink: "//gvc/prod/identity/web-identity",
+  env: {
+    DATABASE_PASSWORD: secretRef("db-password", "payload"),
+  },
+});
+`;
+const STATEFUL = `import { GvcEnvironment, StatefulService } from "@intentius/chant-lexicon-cpln";
+
+// A stateful service with persistent storage.
+//
+// Both fileSystemType and performanceClass are immutable — changing either
+// later means delete, recreate, and data loss — so they are worth settling
+// before the first apply. ext4 binds to exactly one stateful workload; use
+// "shared" if several workloads need the same volume.
+const org = process.env.CPLN_ORG ?? "my-org";
+
+export const { gvc } = GvcEnvironment({
+  name: "prod",
+  org,
+  locations: ["aws-us-east-1"],
+});
+
+export const { workload, volumeSet } = StatefulService({
+  name: "db",
+  gvc: "prod",
+  image: "postgres:17",
+  mountPath: "/var/lib/postgresql/data",
+  capacityGb: 20,
+  fileSystemType: "ext4",
+  performanceClass: "general-purpose-ssd",
+  ports: [{ number: 5432, protocol: "tcp" }],
+  env: { POSTGRES_DB: "app" },
+});
+`;
+/**
+ * Return the scaffold for a template name. Unknown names fall back to the
+ * default rather than erroring — `chant init` treats the name as a hint.
+ */
+export function cplnInitTemplates(template) {
+    switch (template) {
+        case "secrets":
+            return { src: { "infra.ts": WITH_SECRETS } };
+        case "stateful":
+            return { src: { "infra.ts": STATEFUL } };
+        default:
+            return { src: { "infra.ts": DEFAULT } };
+    }
+}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "5c4d30348a558b762acffa81f2a974cccc68b9dfa1ea23df67156ca32d5204cc",
+    "manifest.json": "d73b66bc6b722baf3d22e5d024a01452b09b9cf82ad9e15a26adf158a03a68ec",
     "meta.json": "b6a66263e39a7f7664cdc0eb2966c5ae6876113cbf8e842925670a3de330c71a",
     "types/index.d.ts": "5ae9a3a7320d9c42006af9881a07768e0838a1b5124f4aafc32acdea16d6dc05",
     "rules/cpl001-no-secret-literals.ts": "d7895ebd78b3604d765370e6aa983a5c1a5b9e10d89349685a54b8f5b0a990db",
@@ -31,5 +31,5 @@
     "skills/chant-cpln-workloads.md": "8353909ff18f244f4d4389e74b8d95b04359e97a46ddacb18d669d41d62b6080",
     "skills/chant-cpln-secrets.md": "8628c2286a7e8e14aa78224fe22ff266dc54b996f4fdb64002fa433213de13a0"
   },
-  "composite": "2428eb50add9921506492179883e59d91bf962fb84f8b03fefa877496b1a7d7b"
+  "composite": "b6e14820ea1f3de2735a7582f3e6d3ea5627a80849a7cbf3b1b4b5e177d6e47f"
 }

package/dist/kinds.js

@@ -0,0 +1,134 @@
+/**
+ * The Control Plane kinds this lexicon models, and the facts about each that
+ * more than one subsystem needs.
+ *
+ * Codegen, the serializer, observation, the LSP providers, the MCP catalog and
+ * the docs generator all need to agree on the same three things: which schema
+ * in the OpenAPI document backs a kind, what its chant type name is, and
+ * whether it is scoped to a GVC. Each of those was, in an earlier draft, a
+ * literal repeated in five files — so a kind added in one place quietly went
+ * missing from the others. This table is the single place a kind is declared.
+ *
+ * Coverage is deliberately the *workload* surface rather than every kind the
+ * API exposes. The org-administration kinds (`group`, `serviceaccount`,
+ * `cloudaccount`, `auditctx`, `user`, `agent`) and `mk8s` are all modellable
+ * from the same spec by adding rows here; they are out of the first pass, not
+ * out of reach. `chant cpln coverage` reports the gap rather than hiding it.
+ */
+/** The chant namespace segment for every generated cpln type. */
+export const NAMESPACE = "Cpln";
+/** The single service segment. The Control Plane Core API is one service. */
+export const SERVICE = "Core";
+export const KINDS = [
+    {
+        kind: "gvc",
+        schema: "gvc",
+        typeName: `${NAMESPACE}::${SERVICE}::Gvc`,
+        className: "Gvc",
+        gvcScoped: false,
+        summary: "Global Virtual Cloud — the placement and networking boundary every workload, identity and volume set belongs to.",
+    },
+    {
+        kind: "workload",
+        schema: "workload",
+        typeName: `${NAMESPACE}::${SERVICE}::Workload`,
+        className: "Workload",
+        gvcScoped: true,
+        summary: "A running unit of work — serverless, standard, cron, stateful or vm — with its containers, firewall and autoscaling.",
+    },
+    {
+        kind: "identity",
+        schema: "identity",
+        typeName: `${NAMESPACE}::${SERVICE}::Identity`,
+        className: "Identity",
+        gvcScoped: true,
+        summary: "A workload's identity, carrying its cloud-provider access (AWS/GCP/Azure) and network resource grants.",
+    },
+    {
+        kind: "volumeset",
+        schema: "volumeset",
+        typeName: `${NAMESPACE}::${SERVICE}::VolumeSet`,
+        className: "VolumeSet",
+        gvcScoped: true,
+        summary: "Persistent storage attached to stateful workloads, with its performance class and snapshot policy.",
+    },
+    {
+        kind: "secret",
+        schema: "secret",
+        typeName: `${NAMESPACE}::${SERVICE}::Secret`,
+        className: "Secret",
+        gvcScoped: false,
+        summary: "An org-scoped secret — opaque, TLS, keypair, dictionary, or a cloud-provider credential.",
+    },
+    {
+        kind: "policy",
+        schema: "policy",
+        typeName: `${NAMESPACE}::${SERVICE}::Policy`,
+        className: "Policy",
+        gvcScoped: false,
+        summary: "An access policy binding permissions to principals over a target kind, link set, or query.",
+    },
+    {
+        kind: "domain",
+        schema: "domain",
+        typeName: `${NAMESPACE}::${SERVICE}::Domain`,
+        className: "Domain",
+        gvcScoped: false,
+        summary: "A custom domain with its TLS, CORS and per-port routing to workloads.",
+    },
+    {
+        kind: "ipset",
+        schema: "ipset",
+        typeName: `${NAMESPACE}::${SERVICE}::IpSet`,
+        className: "IpSet",
+        gvcScoped: false,
+        summary: "A set of dedicated IP addresses reserved in named locations and bound to a workload.",
+    },
+];
+/** Every modelled kind string, in declaration order. */
+export const KIND_NAMES = KINDS.map((k) => k.kind);
+const BY_KIND = new Map(KINDS.map((k) => [k.kind, k]));
+const BY_TYPE_NAME = new Map(KINDS.map((k) => [k.typeName, k]));
+const BY_CLASS_NAME = new Map(KINDS.map((k) => [k.className, k]));
+/** Look up a kind by its `kind` discriminator (`"workload"`). */
+export function kindByName(kind) {
+    return BY_KIND.get(kind);
+}
+/** Look up a kind by chant type name (`"Cpln::Core::Workload"`). */
+export function kindByTypeName(typeName) {
+    return BY_TYPE_NAME.get(typeName);
+}
+/** Look up a kind by generated class name (`"Workload"`). */
+export function kindByClassName(className) {
+    return BY_CLASS_NAME.get(className);
+}
+/** Whether a chant type name belongs to a modelled cpln resource (not a property type). */
+export function isCplnResourceType(typeName) {
+    return BY_TYPE_NAME.has(typeName);
+}
+/**
+ * The REST collection path for a kind, relative to the API root.
+ *
+ * GVC-scoped kinds have two: the writable collection nested under their GVC,
+ * and an org-wide read-only rollup. Observation uses the rollup (one request
+ * per kind instead of one per GVC); apply uses the nested one.
+ */
+export function collectionPath(kind, org, gvc) {
+    if (kind.gvcScoped && gvc)
+        return `/org/${org}/gvc/${gvc}/${kind.kind}`;
+    return `/org/${org}/${kind.kind}`;
+}
+/** The path of a single named resource. */
+export function resourcePath(kind, org, name, gvc) {
+    return `${collectionPath(kind, org, gvc)}/${name}`;
+}
+/** Extract the short name from a chant type name: `Cpln::Core::Workload` → `Workload`. */
+export function cplnShortName(typeName) {
+    const parts = typeName.split("::");
+    return parts[parts.length - 1];
+}
+/** Extract the service segment: `Cpln::Core::Workload` → `Core`. */
+export function cplnServiceName(typeName) {
+    const parts = typeName.split("::");
+    return parts.length >= 2 ? parts[1] : SERVICE;
+}