@intentius/chant-lexicon-cpln 0.124.31 → 0.124.33

package/dist/lint/post-synth/cpl025-autoscaling-shape.js

@@ -0,0 +1,84 @@
+import { readArray, readNumber, readString } from "../../entity-props.js";
+import { WORKLOAD, autoscalingOf, entitiesOfType, workloadType } from "./helpers.js";
+/** Which strategies each workload type supports at all. */
+const SUPPORTED_METRICS = {
+    serverless: ["concurrency", "rps", "cpu", "memory", "disabled"],
+    standard: ["rps", "cpu", "memory", "latency", "keda", "disabled"],
+    stateful: ["rps", "cpu", "memory", "latency", "keda", "disabled"],
+};
+/**
+ * CPL025: mutually exclusive autoscaling fields, and the `target` ceiling.
+ *
+ * `metric` and `multi` are alternatives, not layers; `target` belongs to the
+ * single-metric form and is rejected alongside `multi`; and with cpu or memory
+ * as the metric, `target` is a utilization percentage, so above 100 it is not
+ * an aggressive setting but an invalid one.
+ */
+export const autoscalingShapeCheck = {
+    id: "CPL025",
+    description: "Autoscaling `metric`, `multi` and `target` must form a valid combination",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            const scaling = autoscalingOf(entity);
+            if (!scaling || typeof scaling !== "object")
+                continue;
+            const metric = readString(scaling, "metric");
+            const multi = readArray(scaling, "multi");
+            const target = readNumber(scaling, "target");
+            const type = workloadType(entity);
+            if (metric && multi.length > 0) {
+                diagnostics.push({
+                    checkId: "CPL025",
+                    severity: "error",
+                    message: `Workload "${name}" sets both autoscaling.metric ("${metric}") and autoscaling.multi. ` +
+                        `They are mutually exclusive — multi is the multi-metric form and replaces metric.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            if (target !== undefined && multi.length > 0) {
+                diagnostics.push({
+                    checkId: "CPL025",
+                    severity: "error",
+                    message: `Workload "${name}" sets autoscaling.target alongside autoscaling.multi. ` +
+                        `Each entry in multi carries its own target.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            if (target !== undefined && (metric === "cpu" || metric === "memory") && target > 100) {
+                diagnostics.push({
+                    checkId: "CPL025",
+                    severity: "error",
+                    message: `Workload "${name}" sets autoscaling.target ${target} with metric "${metric}", which is a ` +
+                        `utilization percentage capped at 100.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            const supported = SUPPORTED_METRICS[type];
+            if (metric && supported && !supported.includes(metric)) {
+                diagnostics.push({
+                    checkId: "CPL025",
+                    severity: "error",
+                    message: `Workload "${name}" is type "${type}" and uses autoscaling metric "${metric}", which that type ` +
+                        `does not support. Available: ${supported.join(", ")}.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            if (multi.length > 0 && type === "serverless") {
+                diagnostics.push({
+                    checkId: "CPL025",
+                    severity: "error",
+                    message: `Workload "${name}" is serverless and uses multi-metric autoscaling, which is available only ` +
+                        `on standard and stateful workloads.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl026-scale-to-zero.js

@@ -0,0 +1,59 @@
+import { readNumber, readPath, readString } from "../../entity-props.js";
+import { WORKLOAD, autoscalingOf, entitiesOfType, workloadType } from "./helpers.js";
+/** Strategies that let a workload scale to zero, by workload type. */
+const SCALE_TO_ZERO = {
+    serverless: ["rps", "concurrency"],
+    standard: ["keda"],
+    stateful: ["keda"],
+};
+/**
+ * CPL026: scale-to-zero that will not happen.
+ *
+ * `minScale: 0` is accepted on any workload type. It only *takes effect* for
+ * serverless with `rps` or `concurrency`, or for standard/stateful under KEDA.
+ * Everywhere else the workload holds at one replica and the cost saving that
+ * motivated the setting never arrives — with nothing reported.
+ */
+export const scaleToZeroCheck = {
+    id: "CPL026",
+    description: "minScale 0 must pair with a strategy that can actually scale to zero",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            const scaling = autoscalingOf(entity);
+            if (!scaling || typeof scaling !== "object")
+                continue;
+            if (readNumber(scaling, "minScale") !== 0)
+                continue;
+            const type = workloadType(entity);
+            const metric = readString(scaling, "metric") ?? (type === "serverless" ? "concurrency" : undefined);
+            if (type === "cron") {
+                diagnostics.push({
+                    checkId: "CPL026",
+                    severity: "error",
+                    message: `Cron workload "${name}" sets minScale 0. Cron workloads cannot scale to zero.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+                continue;
+            }
+            const allowed = SCALE_TO_ZERO[type] ?? [];
+            const usingKeda = metric === "keda" || readPath(scaling, "keda") !== undefined;
+            if (allowed.includes(metric ?? "") || (allowed.includes("keda") && usingKeda))
+                continue;
+            diagnostics.push({
+                checkId: "CPL026",
+                severity: "warning",
+                message: `Workload "${name}" (type "${type}") sets minScale 0 with metric "${metric ?? "unset"}", which ` +
+                    `cannot scale to zero. ` +
+                    (type === "serverless"
+                        ? `Serverless scales to zero only with "rps" or "concurrency".`
+                        : `Standard and stateful workloads scale to zero only under KEDA, which must be enabled on the GVC.`) +
+                    ` As written the workload holds at one replica with no error.`,
+                entity: name,
+                lexicon: "cpln",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl027-capacity-ai-conflict.js

@@ -0,0 +1,67 @@
+import { readArray, readBoolean, readPath, readString } from "../../entity-props.js";
+import { WORKLOAD, autoscalingOf, entitiesOfType, workloadType } from "./helpers.js";
+/**
+ * CPL027: Capacity AI combined with something it excludes.
+ *
+ * Capacity AI resizes CPU and memory from observed usage, and it is **on by
+ * default** for serverless, standard and cron — so these conflicts are usually
+ * reached by adding CPU autoscaling or a GPU to a workload that never opted
+ * into Capacity AI in the first place. Each conflict has the same root: the
+ * other feature needs a stable resource baseline that Capacity AI is actively
+ * moving.
+ */
+export const capacityAiConflictCheck = {
+    id: "CPL027",
+    description: "Capacity AI conflicts with CPU-utilization autoscaling, multi-metric autoscaling and GPUs",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            const type = workloadType(entity);
+            // Default-on for every type except stateful, so `undefined` means enabled
+            // for those — which is exactly how these conflicts get reached unnoticed.
+            const declared = readBoolean(entity, "spec", "defaultOptions", "capacityAI");
+            const enabled = declared ?? type !== "stateful";
+            if (!enabled)
+                continue;
+            const implicit = declared === undefined;
+            const how = implicit ? "Capacity AI is on by default for this workload type and" : "Capacity AI";
+            const scaling = autoscalingOf(entity);
+            const metric = scaling && typeof scaling === "object" ? readString(scaling, "metric") : undefined;
+            const multi = scaling && typeof scaling === "object" ? readArray(scaling, "multi") : [];
+            if (metric === "cpu") {
+                diagnostics.push({
+                    checkId: "CPL027",
+                    severity: "error",
+                    message: `Workload "${name}": ${how} conflicts with CPU-utilization autoscaling — dynamic CPU allocation ` +
+                        `moves the baseline the metric scales against. Set defaultOptions.capacityAI false, or scale on ` +
+                        `rps or memory.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            if (multi.length > 0) {
+                diagnostics.push({
+                    checkId: "CPL027",
+                    severity: "error",
+                    message: `Workload "${name}": ${how} conflicts with multi-metric autoscaling, which requires stable ` +
+                        `resource baselines. Set defaultOptions.capacityAI false.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            for (const container of readArray(entity, "spec", "containers")) {
+                if (readPath(container, "gpu") === undefined)
+                    continue;
+                diagnostics.push({
+                    checkId: "CPL027",
+                    severity: "error",
+                    message: `Workload "${name}" container "${readString(container, "name") ?? "?"}" requests a GPU, and ` +
+                        `${how} conflicts with it — GPU allocation is fixed. Set defaultOptions.capacityAI false.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl028-volume-set.js

@@ -0,0 +1,155 @@
+import { readArray, readNumber, readString } from "../../entity-props.js";
+import { VOLUMESET, WORKLOAD, entitiesOfType } from "./helpers.js";
+/** Minimum initial capacity in GB, by performance class. */
+const MIN_CAPACITY_GB = {
+    "general-purpose-ssd": 10,
+    "high-throughput-ssd": 200,
+    shared: 10,
+};
+const MAX_CAPACITY_GB = 65536;
+/** Filesystems that bind to exactly one stateful workload. */
+const EXCLUSIVE_FILESYSTEMS = new Set(["ext4", "xfs"]);
+/** Control Plane caps a workload at 15 volumes. */
+const MAX_VOLUMES = 15;
+const VOLUMESET_URI = /^cpln:\/\/volumeset\/(.+)$/;
+export const volumeSetCheck = {
+    id: "CPL028",
+    description: "Volume set capacity, filesystem binding, and workload mount rules",
+    check(ctx) {
+        const diagnostics = [];
+        // Volume sets by their declared name, so a mount can be checked against the
+        // set it names rather than only against itself.
+        const volumeSets = new Map();
+        for (const [name, entity] of entitiesOfType(ctx.entities, VOLUMESET)) {
+            const declaredName = readString(entity, "name") ?? name;
+            const fileSystemType = readString(entity, "spec", "fileSystemType") ?? "ext4";
+            volumeSets.set(declaredName, { entity, gvc: readString(entity, "gvc"), fileSystemType });
+            const performanceClass = readString(entity, "spec", "performanceClass") ?? (fileSystemType === "shared" ? "shared" : "general-purpose-ssd");
+            const capacity = readNumber(entity, "spec", "initialCapacity");
+            const floor = MIN_CAPACITY_GB[performanceClass];
+            if (capacity !== undefined && floor !== undefined && capacity < floor) {
+                diagnostics.push({
+                    checkId: "CPL028",
+                    severity: "error",
+                    message: `Volume set "${name}" requests ${capacity} GB with performanceClass "${performanceClass}", ` +
+                        `below its ${floor} GB minimum. performanceClass is immutable after creation, so correcting ` +
+                        `this later means recreating the volume set and losing its data.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            if (capacity !== undefined && capacity > MAX_CAPACITY_GB) {
+                diagnostics.push({
+                    checkId: "CPL028",
+                    severity: "error",
+                    message: `Volume set "${name}" requests ${capacity} GB, above the ${MAX_CAPACITY_GB} GB maximum.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            if (fileSystemType === "shared" && performanceClass !== "shared") {
+                diagnostics.push({
+                    checkId: "CPL028",
+                    severity: "warning",
+                    message: `Volume set "${name}" has fileSystemType "shared" but performanceClass "${performanceClass}". ` +
+                        `Control Plane forces "shared" for a shared filesystem, so the declared value will not match ` +
+                        `what comes back and will read as drift on every plan.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            // Custom encryption is AWS KMS on a block device; a shared filesystem has
+            // no device to encrypt.
+            if (fileSystemType === "shared" && readString(entity, "spec", "customEncryption", "secretLink")) {
+                diagnostics.push({
+                    checkId: "CPL028",
+                    severity: "error",
+                    message: `Volume set "${name}" sets customEncryption with fileSystemType "shared"; it is supported on ext4 and xfs only.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+        }
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            const type = readString(entity, "spec", "type") ?? "serverless";
+            const workloadGvc = readString(entity, "gvc");
+            const paths = [];
+            let mountCount = 0;
+            for (const container of readArray(entity, "spec", "containers")) {
+                const containerName = readString(container, "name") ?? "?";
+                for (const volume of readArray(container, "volumes")) {
+                    mountCount++;
+                    const uri = readString(volume, "uri");
+                    const path = readString(volume, "path");
+                    if (path)
+                        paths.push(path);
+                    const match = uri ? VOLUMESET_URI.exec(uri) : null;
+                    if (!match)
+                        continue;
+                    const target = volumeSets.get(match[1]);
+                    if (!target)
+                        continue; // declared elsewhere; CPL029 covers dangling references
+                    if (EXCLUSIVE_FILESYSTEMS.has(target.fileSystemType) && type !== "stateful") {
+                        diagnostics.push({
+                            checkId: "CPL028",
+                            severity: "error",
+                            message: `Workload "${name}" is type "${type}" and container "${containerName}" mounts volume set ` +
+                                `"${match[1]}", whose fileSystemType "${target.fileSystemType}" binds to exactly one ` +
+                                `stateful workload. Use a "shared" volume set, or make the workload stateful.`,
+                            entity: name,
+                            lexicon: "cpln",
+                        });
+                    }
+                    if (target.gvc && workloadGvc && target.gvc !== workloadGvc) {
+                        diagnostics.push({
+                            checkId: "CPL028",
+                            severity: "error",
+                            message: `Workload "${name}" (GVC "${workloadGvc}") mounts volume set "${match[1]}" from GVC ` +
+                                `"${target.gvc}". Volume sets are only mountable from within their own GVC.`,
+                            entity: name,
+                            lexicon: "cpln",
+                        });
+                    }
+                }
+            }
+            if (mountCount > MAX_VOLUMES) {
+                diagnostics.push({
+                    checkId: "CPL028",
+                    severity: "error",
+                    message: `Workload "${name}" mounts ${mountCount} volumes; the maximum is ${MAX_VOLUMES}.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+            for (const [i, path] of paths.entries()) {
+                for (const other of paths.slice(i + 1)) {
+                    if (path === other) {
+                        diagnostics.push({
+                            checkId: "CPL028",
+                            severity: "error",
+                            message: `Workload "${name}" mounts two volumes at the same path "${path}".`,
+                            entity: name,
+                            lexicon: "cpln",
+                        });
+                    }
+                    else if (isParentPath(path, other) || isParentPath(other, path)) {
+                        diagnostics.push({
+                            checkId: "CPL028",
+                            severity: "error",
+                            message: `Workload "${name}" mounts volumes at "${path}" and "${other}"; no mount path may be a ` +
+                                `parent of another.`,
+                            entity: name,
+                            lexicon: "cpln",
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};
+/** Whether `parent` is a proper ancestor directory of `child`. */
+function isParentPath(parent, child) {
+    const normalized = parent.endsWith("/") ? parent : `${parent}/`;
+    return child.startsWith(normalized);
+}

package/dist/lint/post-synth/cpl029-link-targets.js

@@ -0,0 +1,140 @@
+import { propsOf, readString } from "../../entity-props.js";
+import { KINDS, kindByTypeName } from "../../kinds.js";
+import { GVC, WORKLOAD, entitiesOfType, parseLink } from "./helpers.js";
+/**
+ * Every string anywhere in a value, so links are found wherever they were
+ * written. Depth-bounded — a spec is deep but finite, and a cycle would not be.
+ */
+function* strings(value, depth = 0) {
+    if (depth > 12)
+        return;
+    if (typeof value === "string") {
+        yield value;
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value)
+            yield* strings(item, depth + 1);
+        return;
+    }
+    if (value && typeof value === "object") {
+        for (const nested of Object.values(propsOf(value)))
+            yield* strings(nested, depth + 1);
+    }
+}
+/**
+ * A workload's identity must live in the workload's own GVC.
+ *
+ * Identities cannot be shared across GVCs — the documented remedy is to
+ * recreate the identity with the same spec in each GVC that needs it. A
+ * cross-GVC `identityLink` is therefore never right, however reasonable it
+ * reads.
+ */
+function identityGvcCheck(entities) {
+    const diagnostics = [];
+    for (const [name, entity] of entitiesOfType(entities, WORKLOAD)) {
+        const workloadGvc = readString(entity, "gvc");
+        const identityLink = readString(entity, "spec", "identityLink");
+        if (!workloadGvc || !identityLink)
+            continue;
+        const link = parseLink(identityLink);
+        if (!link || link.kind !== "identity" || !link.gvc)
+            continue;
+        if (link.gvc === workloadGvc)
+            continue;
+        diagnostics.push({
+            checkId: "CPL029",
+            severity: "error",
+            message: `Workload "${name}" is in GVC "${workloadGvc}" but its identityLink names GVC "${link.gvc}". ` +
+                `Identities cannot be shared across GVCs — declare an identity with the same spec in ` +
+                `"${workloadGvc}".`,
+            entity: name,
+            lexicon: "cpln",
+        });
+    }
+    return diagnostics;
+}
+export const linkTargetsCheck = {
+    id: "CPL029",
+    description: "Control Plane links must resolve to a declared resource of the right kind and GVC",
+    check(ctx) {
+        const diagnostics = [];
+        // Declared resources by kind → name → its GVC (undefined for org-scoped).
+        const declared = new Map();
+        const declaredKinds = new Set();
+        for (const [entityName, entity] of ctx.entities) {
+            const kind = kindByTypeName(entity.entityType);
+            if (!kind)
+                continue;
+            declaredKinds.add(kind.kind);
+            const byName = declared.get(kind.kind) ?? new Map();
+            byName.set(readString(entity, "name") ?? entityName, readString(entity, "gvc"));
+            declared.set(kind.kind, byName);
+        }
+        const knownKinds = new Set(KINDS.map((k) => k.kind));
+        for (const [entityName, entity] of ctx.entities) {
+            const kind = kindByTypeName(entity.entityType);
+            if (!kind)
+                continue;
+            const ownGvc = readString(entity, "gvc");
+            for (const value of strings(propsOf(entity))) {
+                const link = parseLink(value);
+                if (!link || !knownKinds.has(link.kind))
+                    continue;
+                // Only assert against kinds this stack actually declares. Referencing a
+                // secret managed by another team is ordinary, not a defect.
+                if (!declaredKinds.has(link.kind))
+                    continue;
+                const byName = declared.get(link.kind);
+                if (!byName.has(link.name)) {
+                    diagnostics.push({
+                        checkId: "CPL029",
+                        severity: "warning",
+                        message: `${kind.kind} "${entityName}" links to "${value}", but no ${link.kind} named "${link.name}" ` +
+                            `is declared in this stack. Control Plane accepts a dangling link without error.`,
+                        entity: entityName,
+                        lexicon: "cpln",
+                    });
+                    continue;
+                }
+                const targetGvc = byName.get(link.name);
+                if (link.gvc && targetGvc && link.gvc !== targetGvc) {
+                    diagnostics.push({
+                        checkId: "CPL029",
+                        severity: "error",
+                        message: `${kind.kind} "${entityName}" links to "${value}", but ${link.kind} "${link.name}" is ` +
+                            `declared in GVC "${targetGvc}".`,
+                        entity: entityName,
+                        lexicon: "cpln",
+                    });
+                }
+            }
+        }
+        // A GVC-scoped resource whose GVC is declared here must name one that exists.
+        if (declaredKinds.has("gvc")) {
+            const gvcNames = new Set();
+            for (const [entityName, entity] of entitiesOfType(ctx.entities, GVC)) {
+                gvcNames.add(readString(entity, "name") ?? entityName);
+            }
+            for (const [entityName, entity] of ctx.entities) {
+                const kind = kindByTypeName(entity.entityType);
+                if (!kind?.gvcScoped)
+                    continue;
+                const gvc = readString(entity, "gvc");
+                if (!gvc || gvcNames.has(gvc))
+                    continue;
+                diagnostics.push({
+                    checkId: "CPL029",
+                    severity: "warning",
+                    message: `${kind.kind} "${entityName}" is placed in GVC "${gvc}", which this stack does not declare. ` +
+                        `If the GVC is managed elsewhere this is fine; if it is a typo, the apply fails with a ` +
+                        `not-found on the parent.`,
+                    entity: entityName,
+                    lexicon: "cpln",
+                });
+            }
+        }
+        diagnostics.push(...identityGvcCheck(ctx.entities));
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl030-domain-routing.js

@@ -0,0 +1,114 @@
+import { readArray, readPath, readString } from "../../entity-props.js";
+import { DOMAIN, WORKLOAD, entitiesOfType, parseLink } from "./helpers.js";
+/** An apex domain has exactly two labels: `example.com`, not `api.example.com`. */
+function isApex(name) {
+    return name.split(".").filter(Boolean).length === 2;
+}
+export const domainRoutingCheck = {
+    id: "CPL030",
+    description: "Domain DNS mode, certificate challenge, and routing target must be a valid combination",
+    check(ctx) {
+        const diagnostics = [];
+        // Workload types, so a `workloadLink` route can be checked for the stateful
+        // requirement that replica-direct routing carries.
+        const workloadTypes = new Map();
+        for (const [entityName, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            workloadTypes.set(readString(entity, "name") ?? entityName, readString(entity, "spec", "type") ?? "serverless");
+        }
+        for (const [entityName, entity] of entitiesOfType(ctx.entities, DOMAIN)) {
+            const name = readString(entity, "name") ?? entityName;
+            const dnsMode = readString(entity, "spec", "dnsMode") ?? "cname";
+            const challenge = readString(entity, "spec", "certChallengeType");
+            const gvcLink = readString(entity, "spec", "gvcLink");
+            const workloadLink = readString(entity, "spec", "workloadLink");
+            const ports = readArray(entity, "spec", "ports");
+            const routed = ports.some((port) => readArray(port, "routes").length > 0);
+            if (dnsMode === "ns" && isApex(name)) {
+                diagnostics.push({
+                    checkId: "CPL030",
+                    severity: "error",
+                    message: `Domain "${name}" is an apex domain with dnsMode "ns". NS mode does not support apex domains — ` +
+                        `use "cname".`,
+                    entity: entityName,
+                    lexicon: "cpln",
+                });
+            }
+            if (dnsMode === "ns" && challenge === "http01") {
+                diagnostics.push({
+                    checkId: "CPL030",
+                    severity: "error",
+                    message: `Domain "${name}" uses dnsMode "ns" with certChallengeType "http01", which is rejected. ` +
+                        `NS mode requires "dns01".`,
+                    entity: entityName,
+                    lexicon: "cpln",
+                });
+            }
+            const targets = [gvcLink && "gvcLink", workloadLink && "workloadLink", routed && "ports[].routes"].filter(Boolean);
+            if (targets.length > 1) {
+                diagnostics.push({
+                    checkId: "CPL030",
+                    severity: "error",
+                    message: `Domain "${name}" sets ${targets.join(" and ")}. These are mutually exclusive ways of saying ` +
+                        `where traffic goes — keep exactly one.`,
+                    entity: entityName,
+                    lexicon: "cpln",
+                });
+            }
+            if (targets.length === 0) {
+                diagnostics.push({
+                    checkId: "CPL030",
+                    severity: "warning",
+                    message: `Domain "${name}" names no routing target. Set one of gvcLink, workloadLink, or ports[].routes, ` +
+                        `or the domain resolves to nothing.`,
+                    entity: entityName,
+                    lexicon: "cpln",
+                });
+            }
+            // `workloadLink` is replica-direct routing, which only stateful supports.
+            if (workloadLink) {
+                const link = parseLink(workloadLink);
+                const type = link && workloadTypes.get(link.name);
+                if (type && type !== "stateful") {
+                    diagnostics.push({
+                        checkId: "CPL030",
+                        severity: "error",
+                        message: `Domain "${name}" routes via workloadLink to "${link.name}", which is type "${type}". ` +
+                            `workloadLink is replica-direct routing and is supported on stateful workloads only.`,
+                        entity: entityName,
+                        lexicon: "cpln",
+                    });
+                }
+            }
+            // Every route in a domain must target workloads in one GVC.
+            const routeGvcs = new Set();
+            for (const port of ports) {
+                for (const route of readArray(port, "routes")) {
+                    const target = readString(route, "workloadLink");
+                    const link = target ? parseLink(target) : undefined;
+                    if (link?.gvc)
+                        routeGvcs.add(link.gvc);
+                }
+            }
+            if (routeGvcs.size > 1) {
+                diagnostics.push({
+                    checkId: "CPL030",
+                    severity: "error",
+                    message: `Domain "${name}" routes to workloads in ${routeGvcs.size} GVCs (${[...routeGvcs].sort().join(", ")}). ` +
+                        `All routes in a domain must target workloads in the same GVC.`,
+                    entity: entityName,
+                    lexicon: "cpln",
+                });
+            }
+            if (readPath(entity, "spec", "acceptAllHosts") === true && readPath(entity, "spec", "acceptAllSubdomains") === true) {
+                diagnostics.push({
+                    checkId: "CPL030",
+                    severity: "error",
+                    message: `Domain "${name}" sets both acceptAllHosts and acceptAllSubdomains; they are mutually exclusive.`,
+                    entity: entityName,
+                    lexicon: "cpln",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/cpl040-pinned-image.js

@@ -0,0 +1,41 @@
+import { readArray, readString } from "../../entity-props.js";
+import { WORKLOAD, entitiesOfType, imageTag } from "./helpers.js";
+/** A digest pin — `@sha256:…` — is reproducible regardless of tag. */
+const DIGEST = /@sha\d+:[0-9a-f]+$/i;
+/**
+ * CPL040: an image reference that is not pinned.
+ *
+ * `:latest`, or no tag at all (which *means* `:latest`), makes what runs a
+ * function of when the workload last happened to pull. On a serverless
+ * workload that scales to zero and cold-starts, that can be several times a
+ * day, so two replicas of "the same" deploy can be different builds.
+ */
+export const pinnedImageCheck = {
+    id: "CPL040",
+    description: "Container images should be pinned to a specific tag or digest",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+            for (const container of readArray(entity, "spec", "containers")) {
+                const containerName = readString(container, "name") ?? "?";
+                const image = readString(container, "image");
+                if (!image || DIGEST.test(image))
+                    continue;
+                const tag = imageTag(image);
+                if (tag && tag !== "latest")
+                    continue;
+                diagnostics.push({
+                    checkId: "CPL040",
+                    severity: "warning",
+                    message: `Workload "${name}" container "${containerName}" uses image "${image}", which is ` +
+                        (tag === "latest" ? `tagged \`latest\`` : `untagged (implicitly \`latest\`)`) +
+                        `. Pin a version or a digest — a scale-from-zero cold start re-pulls, so what runs can change ` +
+                        `without a deploy.`,
+                    entity: name,
+                    lexicon: "cpln",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};