@intentius/chant-lexicon-cpln 0.124.31 → 0.124.33

package/dist/lint/audit-catalog.js

@@ -0,0 +1,90 @@
+/**
+ * The cpln lexicon's `chant audit` catalog — metadata for every CPL check.
+ *
+ * Every entry carries `yamlBased: false`. That is not an oversight: all of
+ * cpln's checks read the chant model (`ctx.entities`) rather than the emitted
+ * manifests (`ctx.outputs`), because the facts they need — which GVC a workload
+ * is placed in, which volume set a mount names, whether a policy principal is
+ * GVC-qualified — are relationships between declared resources rather than text
+ * in one document. They fire on `chant build` and cannot fire on an audit of
+ * standalone cpln YAML. `auditRule()` hardcodes `yamlBased: true`, so these are
+ * constructed directly.
+ *
+ * A test asserts this catalog covers every check the plugin registers, so a
+ * check added without an entry here fails the build rather than contributing
+ * nothing to `chant audit` silently.
+ */
+import { cplnAuditLineage } from "./audit-lineage.js";
+import { applyLineage } from "@intentius/chant/audit/catalog";
+// ── Authorities ────────────────────────────────────────────────────
+const CPLN_WORKLOAD = {
+    name: "Control Plane — Workload reference",
+    url: "https://docs.controlplane.com/reference/workload",
+};
+const CPLN_SECRETS = {
+    name: "Control Plane — Secret access model",
+    url: "https://docs.controlplane.com/reference/secret",
+};
+const CPLN_POLICY = {
+    name: "Control Plane — Policy reference",
+    url: "https://docs.controlplane.com/reference/policy",
+};
+/**
+ * An entry with no external citation.
+ *
+ * Deliberately unable to take one. Core asserts two invariants over the
+ * aggregated catalog — an authority citation always means `security`, and it
+ * only attaches to `merge-worthy` — so a citation is not decoration, it is a
+ * claim about the finding's weight. Splitting the constructors makes the pair
+ * unviolatable here rather than caught later by core's test.
+ */
+function rule(id, tier, category, title, remediation) {
+    return { id, tier, fixKind: "guidance", category, title, remediation, yamlBased: false };
+}
+/**
+ * A merge-worthy security entry, which is the only kind that may cite an
+ * authority. The tier and category are not parameters because there is only
+ * one legal combination.
+ */
+function securityRule(id, title, remediation, authority) {
+    return {
+        id,
+        tier: "merge-worthy",
+        fixKind: "guidance",
+        category: "security",
+        title,
+        remediation,
+        authority,
+        yamlBased: false,
+    };
+}
+export const cplnAuditCatalog = {
+    // ── Source-level rules ───────────────────────────────────────────
+    CPL001: securityRule("CPL001", "Literal credential in a cpln declaration", "Store the value as a Secret and reference it as cpln://secret/NAME.FIELD.", [CPLN_SECRETS]),
+    CPL002: rule("CPL002", "report-only", "best-practice", "Hand-written Control Plane link where a resource reference would do", "Pass the declared resource; the serializer emits the correct link, GVC qualifier included."),
+    // ── Security ─────────────────────────────────────────────────────
+    CPL010: securityRule("CPL010", "Workload allows outbound traffic to every address", "Narrow outboundAllowCIDR, or use outboundAllowHostname with wildcards.", [CPLN_WORKLOAD]),
+    CPL011: rule("CPL011", "report-only", "security", "Internal firewall opened to the whole org", 'Prefer "same-gvc", or "workload-list" naming the specific workloads.'),
+    CPL012: securityRule("CPL012", "Credential-shaped environment variable set to a literal", "Reference a secret: cpln://secret/NAME.FIELD.", [CPLN_SECRETS]),
+    CPL013: securityRule("CPL013", "Policy binds an identity by its unqualified link", "Use //gvc/<gvc>/identity/<name>; the bare //identity/<name> form is silently ignored.", [CPLN_POLICY]),
+    CPL014: rule("CPL014", "merge-worthy", "correctness", "Secret reference names no field", "Qualify the reference: cpln://secret/NAME.payload, .username, .cert, or a dictionary key."),
+    // ── Correctness ──────────────────────────────────────────────────
+    CPL020: rule("CPL020", "merge-worthy", "correctness", "Serverless workload does not expose exactly one HTTP port", "Expose exactly one http/http2 port, or change the workload to type standard."),
+    CPL021: rule("CPL021", "merge-worthy", "correctness", "Cron workload shape is invalid", "Cron requires spec.job.schedule and must expose no ports; no other type may set spec.job."),
+    CPL022: rule("CPL022", "merge-worthy", "correctness", "Container ports conflict", "Use `ports` rather than `port`, and keep port numbers unique across a workload's containers."),
+    CPL023: rule("CPL023", "merge-worthy", "correctness", "Container resources violate a platform floor or the memory-to-CPU ratio", "CPU ≥ 25m, memory ≥ 32Mi, and memory(MiB)/cpu(m) ≤ 8 — or add the cpln/relaxMemoryToCpuRatio tag."),
+    CPL024: rule("CPL024", "merge-worthy", "correctness", "Health-check probe sets no handler, or more than one", "Set exactly one of exec, grpc, tcpSocket, httpGet per probe."),
+    CPL025: rule("CPL025", "merge-worthy", "correctness", "Autoscaling configuration is not a valid combination", "`metric` and `multi` are exclusive; `target` belongs to the single-metric form and caps at 100 for cpu/memory."),
+    CPL026: rule("CPL026", "merge-worthy", "correctness", "minScale 0 with a strategy that cannot scale to zero", "Serverless needs rps or concurrency; standard and stateful need KEDA, enabled at the GVC."),
+    CPL027: rule("CPL027", "merge-worthy", "correctness", "Capacity AI combined with a feature it excludes", "Set defaultOptions.capacityAI false, or drop the CPU-utilization scaling, multi-metric scaling, or GPU."),
+    CPL028: rule("CPL028", "merge-worthy", "correctness", "Volume set capacity, filesystem binding, or mount paths are invalid", "Clear the performance-class capacity floor, mount ext4/xfs only from stateful workloads, and keep mount paths disjoint."),
+    CPL029: rule("CPL029", "merge-worthy", "correctness", "Control Plane link does not resolve, or crosses a GVC boundary", "Point the link at a declared resource in the right GVC; identities cannot be shared across GVCs."),
+    CPL030: rule("CPL030", "merge-worthy", "correctness", "Domain DNS mode, challenge, or routing target is invalid", "Apex domains need cname; ns needs dns01; pick exactly one of gvcLink, workloadLink, ports[].routes."),
+    // ── Best practice ────────────────────────────────────────────────
+    CPL040: rule("CPL040", "report-only", "best-practice", "Container image is not pinned", "Pin a version tag or a digest; a scale-from-zero cold start re-pulls."),
+    CPL041: rule("CPL041", "merge-worthy", "correctness", "Image reference uses a registry prefix Control Plane rejects", "Drop the docker.io/ prefix; address this org's own images as //image/NAME:TAG."),
+    CPL042: rule("CPL042", "merge-worthy", "correctness", "GVC declares no placement", "Set spec.staticPlacement.locationLinks, e.g. /org/<org>/location/aws-us-east-1."),
+    CPL043: rule("CPL043", "merge-worthy", "correctness", "Policy target kind, scope, or origin is not well formed", "Pick exactly one target scope, target a policy-targetable kind, and never set origin by hand."),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(cplnAuditCatalog, cplnAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,32 @@
+export const cplnAuditLineage = {
+    CPL020: [
+        { tool: "controlplane-docs", rule: "Workload types: serverless", url: "https://docs.controlplane.com/reference/workload/types", relation: "overlaps" },
+    ],
+    CPL021: [
+        { tool: "controlplane-docs", rule: "Workload types: cron", url: "https://docs.controlplane.com/reference/workload/types", relation: "overlaps" },
+    ],
+    CPL026: [
+        { tool: "controlplane-docs", rule: "Autoscaling: scale to zero", url: "https://docs.controlplane.com/reference/workload/autoscaling", relation: "overlaps" },
+    ],
+    CPL027: [
+        { tool: "controlplane-docs", rule: "Autoscaling: Capacity AI", url: "https://docs.controlplane.com/reference/workload/autoscaling", relation: "overlaps" },
+    ],
+    CPL028: [
+        { tool: "controlplane-docs", rule: "Volume set: performance classes / file system type", url: "https://docs.controlplane.com/reference/volumeset#performance-classes", relation: "overlaps" },
+    ],
+    CPL029: [
+        { tool: "controlplane-docs", rule: "Identity: GVC scope", url: "https://docs.controlplane.com/reference/identity", relation: "overlaps" },
+    ],
+    CPL030: [
+        { tool: "controlplane-docs", rule: "Domain: apex domain considerations", url: "https://docs.controlplane.com/reference/domain#apex-domain-considerations", relation: "overlaps" },
+    ],
+    CPL040: [
+        { tool: "controlplane-docs", rule: "Image: tags and digests", url: "https://docs.controlplane.com/reference/image#image-tags-and-digests", relation: "overlaps" },
+    ],
+    CPL041: [
+        { tool: "controlplane-docs", rule: "Image: reference formats", url: "https://docs.controlplane.com/reference/image#image-reference-formats", relation: "overlaps" },
+    ],
+    CPL042: [
+        { tool: "controlplane-docs", rule: "GVC locations", url: "https://docs.controlplane.com/reference/gvc#gvc-locations", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/cpl010-unrestricted-outbound.js

@@ -0,0 +1,34 @@
+import { readArray } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType } from "./helpers.js";
+const ANY_ADDRESS = "0.0.0.0/0";
+/**
+ * CPL010: a workload that may call out to the entire internet.
+ *
+ * Inbound `0.0.0.0/0` is how a public service is *supposed* to be written, so
+ * it is not flagged. Outbound `0.0.0.0/0` is different: it is rarely required,
+ * it is the egress path for anything that gets a foothold in the container,
+ * and Control Plane supports hostname rules (with wildcards) precisely so it
+ * does not have to be all-or-nothing.
+ */
+export const unrestrictedOutboundCheck = {
+    id: "CPL010",
+    description: "Workloads should not allow outbound traffic to every address",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            const outbound = readArray(entity, "spec", "firewallConfig", "external", "outboundAllowCIDR");
+            if (!outbound.includes(ANY_ADDRESS))
+                continue;
+            diagnostics.push({
+                checkId: "CPL010",
+                severity: "warning",
+                message: `Workload "${name}" allows outbound traffic to ${ANY_ADDRESS}. Narrow it to the CIDRs it ` +
+                    `actually calls, or use \`outboundAllowHostname\` (wildcards like "*.amazonaws.com" are ` +
+                    `supported) so egress is bounded.`,
+                entity: name,
+                lexicon: "cpln",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl011-internal-firewall-scope.js

@@ -0,0 +1,32 @@
+import { readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType } from "./helpers.js";
+/**
+ * CPL011: internal firewall opened to the whole org.
+ *
+ * `same-org` lets every workload in every GVC reach this one, which crosses the
+ * boundary a GVC exists to draw. `same-gvc` and `workload-list` cover almost
+ * every real case, and `workload-list` works cross-GVC when that is genuinely
+ * needed.
+ */
+export const internalFirewallScopeCheck = {
+    id: "CPL011",
+    description: "Internal firewall should not be opened to the entire org",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            const allowType = readString(entity, "spec", "firewallConfig", "internal", "inboundAllowType");
+            if (allowType !== "same-org")
+                continue;
+            diagnostics.push({
+                checkId: "CPL011",
+                severity: "warning",
+                message: `Workload "${name}" sets internal inboundAllowType "same-org", so every workload in the org — ` +
+                    `including other GVCs — can reach it. Prefer "same-gvc", or "workload-list" with the specific ` +
+                    `workloads (which also works across GVCs).`,
+                entity: name,
+                lexicon: "cpln",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl012-no-literal-credential-env.js

@@ -0,0 +1,51 @@
+import { readArray, readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType } from "./helpers.js";
+/** `cpln://secret/NAME.FIELD` — the field qualifier is the part that matters. */
+const SECRET_REF = /^cpln:\/\/secret\/([^/.\s]+)(?:\.([^/\s]+))?$/;
+/** Env var names that read as credentials. */
+const CREDENTIAL_NAME = /(password|passwd|secret|token|apikey|api_key|access_key|private_key|credential)/i;
+/**
+ * Values that look like a deliberate non-secret rather than a leaked one: an
+ * empty string, an obvious placeholder, or another `cpln://` reference.
+ */
+const PLACEHOLDER = /^(|changeme|placeholder|todo|xxx+|\*+|<[^>]*>|\$\{[^}]*\})$/i;
+/**
+ * CPL012: a credential-shaped env var carrying a literal value.
+ *
+ * The alternative is one string change — `cpln://secret/db.password` — so a
+ * literal here is almost always an oversight rather than a decision. Env values
+ * end up in the workload spec, which is readable by anyone with `get` on the
+ * workload, and in every diff of the manifest.
+ */
+export const noLiteralCredentialEnvCheck = {
+    id: "CPL012",
+    description: "Credential-shaped environment variables must reference a secret, not a literal",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            for (const container of readArray(entity, "spec", "containers")) {
+                const containerName = readString(container, "name") ?? "?";
+                for (const env of readArray(container, "env")) {
+                    const envName = readString(env, "name");
+                    const value = readString(env, "value");
+                    if (!envName || value === undefined)
+                        continue;
+                    if (!CREDENTIAL_NAME.test(envName))
+                        continue;
+                    if (value.startsWith("cpln://") || PLACEHOLDER.test(value))
+                        continue;
+                    diagnostics.push({
+                        checkId: "CPL012",
+                        severity: "error",
+                        message: `Workload "${name}" container "${containerName}" sets env "${envName}" to a literal value. ` +
+                            `Reference a secret instead — \`cpln://secret/NAME.FIELD\` — so the value is not stored in ` +
+                            `the workload spec or its diffs.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl013-qualified-identity-principal.js

@@ -0,0 +1,40 @@
+import { propsOf, readArray } from "../../entity-props.js";
+import { POLICY, entitiesOfType } from "./helpers.js";
+/**
+ * CPL013: an identity principal link that Control Plane will ignore.
+ *
+ * `//identity/NAME` is accepted by the policy API and then has no effect. Only
+ * the GVC-qualified `//gvc/GVC/identity/NAME` grants anything. Nothing reports
+ * this — the policy exists, the binding exists, and the permission is simply
+ * never granted.
+ */
+export const qualifiedIdentityPrincipalCheck = {
+    id: "CPL013",
+    description: "Policy bindings must name identities by their GVC-qualified link",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, POLICY)) {
+            for (const binding of readArray(entity, "bindings")) {
+                const links = propsOf(binding).principalLinks;
+                if (!Array.isArray(links))
+                    continue;
+                for (const link of links) {
+                    if (typeof link !== "string")
+                        continue;
+                    if (!/^\/\/identity\/[^/]+$/.test(link))
+                        continue;
+                    diagnostics.push({
+                        checkId: "CPL013",
+                        severity: "error",
+                        message: `Policy "${name}" binds the principal "${link}". Control Plane silently ignores the bare ` +
+                            `//identity/NAME form — use //gvc/<gvc>/identity/${link.slice("//identity/".length)} instead. ` +
+                            `The policy will apply cleanly and grant nothing as written.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl014-qualified-secret-ref.js

@@ -0,0 +1,47 @@
+import { readArray, readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType } from "./helpers.js";
+/** `cpln://secret/NAME.FIELD` — the field qualifier is the part that matters. */
+const SECRET_REF = /^cpln:\/\/secret\/([^/.\s]+)(?:\.([^/\s]+))?$/;
+/**
+ * CPL014: a secret reference with no field qualifier.
+ *
+ * `cpln://secret/db` resolves to nothing for every secret type except `gcp`,
+ * which is conventionally mounted as a whole JSON file. The field name is not
+ * optional: `opaque` needs `.payload`, `userpass` needs `.username`/`.password`,
+ * `tls` needs `.cert`/`.key`, and a `dictionary` needs one of its keys.
+ *
+ * Volume mounts are exempt — mounting a secret as a directory is the documented
+ * way to consume a `dictionary` or a `gcp` credential file.
+ */
+export const qualifiedSecretRefCheck = {
+    id: "CPL014",
+    description: "Secret references in environment variables must name a field",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            for (const container of readArray(entity, "spec", "containers")) {
+                const containerName = readString(container, "name") ?? "?";
+                for (const env of readArray(container, "env")) {
+                    const envName = readString(env, "name") ?? "?";
+                    const value = readString(env, "value");
+                    if (!value)
+                        continue;
+                    const match = SECRET_REF.exec(value);
+                    if (!match || match[2])
+                        continue;
+                    diagnostics.push({
+                        checkId: "CPL014",
+                        severity: "error",
+                        message: `Workload "${name}" container "${containerName}" sets env "${envName}" to "${value}", which ` +
+                            `names no field. Use \`cpln://secret/${match[1]}.FIELD\` — \`.payload\` for opaque, ` +
+                            `\`.username\`/\`.password\` for userpass, \`.cert\`/\`.key\` for tls, a key name for a ` +
+                            `dictionary. An unqualified reference resolves to nothing at runtime.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl020-serverless-single-port.js

@@ -0,0 +1,51 @@
+import { readArray, readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType, exposedPorts, workloadType } from "./helpers.js";
+/**
+ * CPL020: a serverless workload must expose exactly one HTTP port.
+ *
+ * Not "at least one" and not "any number" — exactly one, and it must be HTTP.
+ * Zero is the more common mistake and the more confusing one, because the
+ * workload deploys and reports healthy while serving nothing.
+ */
+export const serverlessSinglePortCheck = {
+    id: "CPL020",
+    description: "Serverless workloads must expose exactly one HTTP port",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            if (workloadType(entity) !== "serverless")
+                continue;
+            const ports = exposedPorts(entity);
+            if (ports.length !== 1) {
+                diagnostics.push({
+                    checkId: "CPL020",
+                    severity: "error",
+                    message: `Serverless workload "${name}" exposes ${ports.length} ports; exactly one HTTP port is required. ` +
+                        (ports.length === 0
+                            ? `It will deploy and serve nothing.`
+                            : `Use a standard workload if it genuinely needs several.`),
+                    entity: name,
+                    lexicon: "cpln",
+                });
+                continue;
+            }
+            // The single port must be HTTP. `tcp` and `grpc` need a standard workload.
+            for (const container of readArray(entity, "spec", "containers")) {
+                for (const port of readArray(container, "ports")) {
+                    const protocol = readString(port, "protocol") ?? "http";
+                    if (protocol === "http" || protocol === "http2")
+                        continue;
+                    diagnostics.push({
+                        checkId: "CPL020",
+                        severity: "error",
+                        message: `Serverless workload "${name}" exposes a "${protocol}" port. Serverless supports only http ` +
+                            `and http2 — use a standard workload for ${protocol}.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl021-cron-job-shape.js

@@ -0,0 +1,55 @@
+import { readPath, readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType, exposedPorts, workloadType } from "./helpers.js";
+/**
+ * CPL021: a cron workload needs a schedule and must expose no ports.
+ *
+ * Cron cannot serve traffic, so a port on one is always a misunderstanding —
+ * usually a workload converted from serverless with the ports left behind. A
+ * missing `spec.job.schedule` is the other half: `spec.job` is *required* for
+ * cron and forbidden for every other type.
+ */
+export const cronJobShapeCheck = {
+    id: "CPL021",
+    description: "Cron workloads must declare a schedule and expose no ports",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            const type = workloadType(entity);
+            const job = readPath(entity, "spec", "job");
+            const schedule = readString(entity, "spec", "job", "schedule");
+            if (type === "cron") {
+                if (!schedule) {
+                    diagnostics.push({
+                        checkId: "CPL021",
+                        severity: "error",
+                        message: `Cron workload "${name}" has no spec.job.schedule. A cron workload requires one.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+                const ports = exposedPorts(entity);
+                if (ports.length > 0) {
+                    diagnostics.push({
+                        checkId: "CPL021",
+                        severity: "error",
+                        message: `Cron workload "${name}" exposes ${ports.length} port(s) (${ports.join(", ")}). Cron workloads ` +
+                            `cannot serve traffic — remove the ports, or use a standard workload.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+                continue;
+            }
+            if (job !== undefined) {
+                diagnostics.push({
+                    checkId: "CPL021",
+                    severity: "error",
+                    message: `Workload "${name}" is type "${type}" but sets spec.job. Only cron workloads may declare one.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl022-container-ports.js

@@ -0,0 +1,53 @@
+import { readArray, readNumber, readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType } from "./helpers.js";
+/**
+ * CPL022: `port` and `ports` are mutually exclusive, and port numbers must be
+ * unique across every container in a workload.
+ *
+ * The duplicate case is the one worth catching: two containers each binding
+ * 8080 is accepted at author time, rejected at apply, and reads as correct.
+ */
+export const containerPortsCheck = {
+    id: "CPL022",
+    description: "Container ports must not mix `port` and `ports`, and must be unique across containers",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            const seen = new Map();
+            for (const container of readArray(entity, "spec", "containers")) {
+                const containerName = readString(container, "name") ?? "?";
+                const single = readNumber(container, "port");
+                const list = readArray(container, "ports");
+                if (single !== undefined && list.length > 0) {
+                    diagnostics.push({
+                        checkId: "CPL022",
+                        severity: "error",
+                        message: `Workload "${name}" container "${containerName}" sets both \`port\` and \`ports\`. ` +
+                            `They are mutually exclusive — keep \`ports\`.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+                const numbers = [
+                    ...(single !== undefined ? [single] : []),
+                    ...list.map((port) => readNumber(port, "number")).filter((n) => n !== undefined),
+                ];
+                for (const number of numbers) {
+                    const owner = seen.get(number);
+                    if (owner !== undefined && owner !== containerName) {
+                        diagnostics.push({
+                            checkId: "CPL022",
+                            severity: "error",
+                            message: `Workload "${name}" exposes port ${number} from both "${owner}" and "${containerName}". ` +
+                                `Port numbers must be unique across the containers of one workload.`,
+                            entity: name,
+                            lexicon: "cpln",
+                        });
+                    }
+                    seen.set(number, containerName);
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl023-container-resources.js

@@ -0,0 +1,73 @@
+import { propsOf, readArray, readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType, parseCpuMillicores, parseMemoryMib } from "./helpers.js";
+/** The tag that raises the memory-to-CPU ceiling from 8 to 32. */
+const RELAX_RATIO_TAG = "cpln/relaxMemoryToCpuRatio";
+const CPU_MIN_MILLICORES = 25;
+const MEMORY_MIN_MIB = 32;
+const RATIO_MAX = 8;
+const RATIO_MAX_RELAXED = 32;
+/**
+ * CPL023: CPU and memory floors, and the memory-to-CPU ratio.
+ *
+ * The ratio is the non-obvious one. `memory(MiB) / cpu(millicores)` must be
+ * ≤ 8, so `2Gi` of memory needs at least 256 millicores of CPU — a workload
+ * asking for lots of memory and a little CPU is rejected, which surprises
+ * people coming from Kubernetes where the two are independent. The
+ * `cpln/relaxMemoryToCpuRatio` tag raises the ceiling to 32.
+ */
+export const containerResourcesCheck = {
+    id: "CPL023",
+    description: "Container CPU and memory must clear the platform floors and the memory-to-CPU ratio",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            const tags = propsOf(entity).tags;
+            const relaxed = !!tags && typeof tags === "object" && RELAX_RATIO_TAG in tags;
+            const ceiling = relaxed ? RATIO_MAX_RELAXED : RATIO_MAX;
+            for (const container of readArray(entity, "spec", "containers")) {
+                const containerName = readString(container, "name") ?? "?";
+                // Control Plane's defaults, so an omitted value is checked as what it
+                // will actually become rather than skipped.
+                const cpu = parseCpuMillicores(readString(container, "cpu") ?? "50m");
+                const memory = parseMemoryMib(readString(container, "memory") ?? "128Mi");
+                if (cpu !== undefined && cpu < CPU_MIN_MILLICORES) {
+                    diagnostics.push({
+                        checkId: "CPL023",
+                        severity: "error",
+                        message: `Workload "${name}" container "${containerName}" requests ${cpu}m CPU; the minimum is ` +
+                            `${CPU_MIN_MILLICORES}m.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+                if (memory !== undefined && memory < MEMORY_MIN_MIB) {
+                    diagnostics.push({
+                        checkId: "CPL023",
+                        severity: "error",
+                        message: `Workload "${name}" container "${containerName}" requests ${Math.round(memory)}Mi memory; ` +
+                            `the minimum is ${MEMORY_MIN_MIB}Mi.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+                if (cpu !== undefined && memory !== undefined && cpu > 0) {
+                    const ratio = memory / cpu;
+                    if (ratio > ceiling) {
+                        const needed = Math.ceil(memory / ceiling);
+                        diagnostics.push({
+                            checkId: "CPL023",
+                            severity: "error",
+                            message: `Workload "${name}" container "${containerName}" has a memory-to-CPU ratio of ` +
+                                `${ratio.toFixed(1)} (${Math.round(memory)}Mi / ${cpu}m), above the limit of ${ceiling}. ` +
+                                `Raise CPU to at least ${needed}m` +
+                                (relaxed ? "." : `, or add the \`${RELAX_RATIO_TAG}\` tag to raise the ceiling to ${RATIO_MAX_RELAXED}.`),
+                            entity: name,
+                            lexicon: "cpln",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl024-probe-handler.js

@@ -0,0 +1,43 @@
+import { readArray, readPath, readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType } from "./helpers.js";
+/** The four mutually exclusive probe handlers. */
+const PROBE_HANDLERS = ["exec", "grpc", "tcpSocket", "httpGet"];
+/**
+ * CPL024: a probe must set exactly one handler.
+ *
+ * Zero is the interesting case: a `readinessProbe` with only
+ * `initialDelaySeconds` and `periodSeconds` set looks configured and probes
+ * nothing.
+ */
+export const probeHandlerCheck = {
+    id: "CPL024",
+    description: "Each health-check probe must set exactly one of exec, grpc, tcpSocket, httpGet",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            for (const container of readArray(entity, "spec", "containers")) {
+                const containerName = readString(container, "name") ?? "?";
+                for (const probeName of ["readinessProbe", "livenessProbe"]) {
+                    const probe = readPath(container, probeName);
+                    if (!probe || typeof probe !== "object")
+                        continue;
+                    const set = PROBE_HANDLERS.filter((handler) => readPath(probe, handler) !== undefined);
+                    if (set.length === 1)
+                        continue;
+                    diagnostics.push({
+                        checkId: "CPL024",
+                        severity: "error",
+                        message: set.length === 0
+                            ? `Workload "${name}" container "${containerName}" declares a ${probeName} with no handler. ` +
+                                `Set exactly one of ${PROBE_HANDLERS.join(", ")} — as written the probe checks nothing.`
+                            : `Workload "${name}" container "${containerName}" ${probeName} sets ${set.length} handlers ` +
+                                `(${set.join(", ")}). They are mutually exclusive; keep one.`,
+                        entity: name,
+                        lexicon: "cpln",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};