@intentius/chant-lexicon-cpln 0.53.0

package/README.md

@@ -0,0 +1,85 @@
+# @intentius/chant-lexicon-cpln
+
+[Control Plane](https://controlplane.com) (cpln) lexicon for [chant](https://github.com/intentius/chant) — GVCs, workloads, identities and secrets as typed TypeScript.
+
+Types are generated from Control Plane's served OpenAPI document, so they track the real API.
+
+```bash
+npm install --save-dev @intentius/chant-lexicon-cpln
+```
+
+## What it looks like
+
+```typescript
+import { GvcEnvironment, ServerlessService } from "@intentius/chant-lexicon-cpln";
+
+export const { gvc } = GvcEnvironment({
+  name: "prod",
+  org: "acme",
+  locations: ["aws-us-east-1"],     // placement is GVC-level
+});
+
+export const { workload } = ServerlessService({
+  name: "web",
+  gvc: "prod",
+  image: "nginx:1.27",
+  port: 8080,
+  inboundAllowCidr: ["0.0.0.0/0"],  // the firewall starts closed
+});
+```
+
+`chant build` emits multi-document YAML for `cpln apply --file`. Each document carries its own `gvc:` key, so the file is self-contained rather than depending on a `--gvc` flag.
+
+## The kinds
+
+Org-scoped: `Gvc`, `Secret`, `Policy`, `Domain`, `IpSet`.
+GVC-scoped (each takes a required `gvc`): `Workload`, `Identity`, `VolumeSet`.
+
+Org-administration kinds (`group`, `serviceaccount`, `cloudaccount`, `auditctx`, `agent`, `user`) and `mk8s` are not modelled yet — each is a row in `src/kinds.ts` away, and `chant cpln coverage` reports the gap rather than hiding it.
+
+## What the checks are for
+
+Control Plane accepts several plausible-looking configurations and then quietly does nothing with them. The 22 CPL rules are weighted toward exactly those:
+
+| | |
+|---|---|
+| `CPL013` | A policy binding against `//identity/NAME` is accepted and **silently ignored** — only `//gvc/GVC/identity/NAME` grants anything |
+| `CPL014` | `cpln://secret/db` with no `.field` resolves to nothing at runtime |
+| `CPL026` | `minScale: 0` on a strategy that cannot scale to zero holds at one replica, with no error |
+| `CPL027` | Capacity AI is on by default and conflicts with CPU autoscaling, multi-metric autoscaling, and GPUs |
+| `CPL023` | `memory(MiB) / cpu(millicores)` must be ≤ 8 — a memory-heavy, CPU-light workload is rejected |
+
+Passing a declared resource where a link belongs sidesteps the first of these entirely: the serializer emits the correct link for its kind, GVC qualifier included.
+
+## Live state
+
+Every kind carries a free-form `tags` map, which is where chant stamps its ownership marker. That is what makes `chant plan` precise without a state file.
+
+```bash
+CPLN_ORG=acme CPLN_TOKEN=$(cat sa-key) chant plan
+```
+
+Use the env var rather than `--token`; the flag leaks into process listings and logs.
+
+## Development
+
+```bash
+just generate    # regenerate types from the upstream spec
+just validate    # check the generated artifacts
+just snapshot    # refresh the committed offline spec snapshot
+just docs        # build and serve the docs site
+```
+
+## Project structure
+
+- `src/kinds.ts` — the kind table every subsystem agrees on
+- `src/plugin.ts` — the `LexiconPlugin` entry point
+- `src/serializer.ts` — `cpln apply` manifest output
+- `src/spec/` — OpenAPI fetch, offline snapshot, and parser
+- `src/codegen/` — generation pipeline, naming, packaging, docs
+- `src/lint/` — source-level rules, post-synth checks, audit catalog
+- `src/composites/` — `GvcEnvironment`, `ServerlessService`, `CronJob`, `StatefulService`, `SecretAccess`, `PublicDomain`
+- `src/describe-resources.ts` — live observation
+- `src/generated/` — generated artifacts (do not edit)
+
+[Full documentation →](https://intentius.io/chant/lexicons/cpln/)

package/dist/api.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Minimal Control Plane REST client.
+ *
+ * Deliberately small: observation needs list-and-index, nothing more. The API
+ * is uniform enough that one `get` covers every kind — `/org/{org}/{kind}` for
+ * org-scoped, `/org/{org}/{kind}` again for the GVC-scoped rollup, which is why
+ * `collectionPath` in `kinds.ts` returns the org-wide form when no GVC is given.
+ * That rollup is what makes observation one request per kind instead of one per
+ * GVC.
+ *
+ * Credentials follow the CLI's own conventions so `chant plan` reads the org a
+ * `cpln` command in the same shell would write to. Nothing here reads a secret
+ * value: `-reveal` is never called.
+ */
+import { type CplnKind } from "./kinds.js";
+/** Default API root. `CPLN_ENDPOINT` overrides it for a private deployment. */
+export declare const DEFAULT_ENDPOINT = "https://api.cpln.io";
+/** A resource as the API returns it. Only the envelope is typed. */
+export interface CplnResource {
+    id?: string;
+    name?: string;
+    kind?: string;
+    version?: number;
+    description?: string;
+    tags?: Record<string, unknown>;
+    created?: string;
+    lastModified?: string;
+    links?: Array<{
+        rel?: string;
+        href?: string;
+    }>;
+    spec?: Record<string, unknown>;
+    status?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface CplnConfig {
+    endpoint: string;
+    org: string;
+    token: string;
+}
+/** Thrown when there is no org or no token to read with. */
+export declare class CplnCredentialsError extends Error {
+}
+/**
+ * Resolve endpoint, org and token from the environment.
+ *
+ * `CPLN_TOKEN` is the documented CI variable and the one Control Plane's own
+ * guidance prefers over `--token`, which leaks into process listings and logs.
+ * A service account key works in the same header.
+ */
+export declare function resolveConfig(overrides?: Partial<CplnConfig>): CplnConfig;
+/**
+ * Build the `Authorization` header value.
+ *
+ * The spec declares two schemes on the same header: `serviceAccountKey` is an
+ * apiKey sent bare, `jwt` is an HTTP bearer token. They are distinguishable by
+ * shape — a JWT is three base64url segments and always starts `eyJ` — so a
+ * caller does not have to say which kind of credential they have. An
+ * already-prefixed value is passed through so an explicit `Bearer …` works too.
+ */
+export declare function authorization(token: string): string;
+/** The transport, injectable so tests need no network. */
+export interface CplnHttp {
+    get(path: string): Promise<unknown>;
+}
+/** The default transport — `fetch` with the documented auth header. */
+export declare function defaultCplnHttp(config: CplnConfig): CplnHttp;
+/**
+ * List every resource of one kind in the org, keyed by name.
+ *
+ * Returns an empty map for a 404, which the API uses for a kind the org has
+ * none of as well as for one the token cannot see — the distinction is not
+ * available here, and the observer treats an absent resource as absent either
+ * way.
+ */
+export declare function listKind(http: CplnHttp, config: CplnConfig, kind: CplnKind): Promise<Map<string, CplnResource>>;
+//# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExD,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAOD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4DAA4D;AAC5D,qBAAa,oBAAqB,SAAQ,KAAK;CAAG;AAElD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,SAAS,GAAE,OAAO,CAAC,UAAU,CAAM,GAAG,UAAU,CAmB7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED,0DAA0D;AAC1D,MAAM,WAAW,QAAQ;IACvB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrC;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAc5D;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAOpC"}

package/dist/codegen/docs-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=docs-cli.d.ts.map

package/dist/codegen/docs-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/docs-cli.ts"],"names":[],"mappings":""}

package/dist/codegen/docs.d.ts

@@ -0,0 +1,17 @@
+/**
+ * cpln documentation generator.
+ *
+ * Calls the core `docsPipeline` with cpln-specific config. The prose pages live
+ * as authored `.mdx` under `docs/pages/`, each naming its Diátaxis quadrant in
+ * frontmatter (chant #1731 / #1733); the pipeline reads them, expands markers
+ * and builds the sidebar from the quadrant. Only the overview and the output
+ * format description stay here, because they are interpolated into generated
+ * pages rather than being pages of their own.
+ */
+/**
+ * Generate the documentation site for the cpln lexicon.
+ */
+export declare function generateDocs(options?: {
+    verbose?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=docs.d.ts.map

package/dist/codegen/docs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA0DH;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBjF"}

package/dist/codegen/generate-cli.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env tsx
+/**
+ * CLI entry point for cpln lexicon generation.
+ */
+export {};
+//# sourceMappingURL=generate-cli.d.ts.map

package/dist/codegen/generate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-cli.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-cli.ts"],"names":[],"mappings":";AACA;;GAEG"}

package/dist/codegen/generate-lexicon.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Lexicon registry generator — produces `lexicon-cpln.json`, the metadata the
+ * evaluator and lint engine read for each cpln resource and property type.
+ */
+import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
+import type { CplnParseResult } from "../spec/parse.js";
+import type { NamingStrategy } from "./naming.js";
+export interface CplnLexiconEntry {
+    resourceType: string;
+    kind: "resource" | "property";
+    lexicon: "cpln";
+    /** The `kind` discriminator a manifest carries. Resources only. */
+    cplnKind?: string;
+    /** Whether the resource is addressed under a GVC. Resources only. */
+    gvcScoped?: boolean;
+    /**
+     * Per-property constraints.
+     *
+     * Named to match core's `LexiconEntry` contract rather than the bare
+     * `constraints` it would be natural to call it. The name is load-bearing
+     * twice over: `LexiconIndex.getPropertyNames` derives the LSP's property
+     * completions from *the keys of this object*, and hover reads the enums out
+     * of its values. Under any other key both features return nothing, with no
+     * error — the index simply finds no properties.
+     *
+     * Every writable property gets an entry for the same reason, even when it
+     * carries no constraints at all. A property omitted here is a property that
+     * does not complete.
+     */
+    propertyConstraints?: Record<string, PropertyConstraints>;
+}
+/**
+ * Generate the `lexicon-cpln.json` content.
+ */
+export declare function generateLexiconJSON(results: CplnParseResult[], naming: NamingStrategy): string;
+//# sourceMappingURL=generate-lexicon.d.ts.map

package/dist/codegen/generate-lexicon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-lexicon.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-lexicon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAOhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;OAaG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CA4C9F"}

package/dist/codegen/generate-typescript.d.ts

@@ -0,0 +1,11 @@
+/**
+ * TypeScript declaration generator — produces `index.d.ts` with the eight cpln
+ * resource classes and the property-type classes their specs reach.
+ */
+import type { CplnParseResult } from "../spec/parse.js";
+import type { NamingStrategy } from "./naming.js";
+/**
+ * Generate the complete `.d.ts` content.
+ */
+export declare function generateTypeScriptDeclarations(results: CplnParseResult[], naming: NamingStrategy): string;
+//# sourceMappingURL=generate-typescript.d.ts.map

package/dist/codegen/generate-typescript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-typescript.d.ts","sourceRoot":"","sources":["../../src/codegen/generate-typescript.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAS/C;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,cAAc,GAAG,MAAM,CA8CzG"}

package/dist/codegen/generate.d.ts

@@ -0,0 +1,15 @@
+/**
+ * cpln generation pipeline — core `generatePipeline` with cpln's fetch, parse,
+ * naming and emit callbacks.
+ */
+import { type GenerateOptions, type GenerateResult } from "@intentius/chant/codegen/generate";
+export type { GenerateResult };
+/**
+ * Run the full cpln generation pipeline.
+ */
+export declare function generate(opts?: GenerateOptions): Promise<GenerateResult>;
+/**
+ * Write generated artifacts under `src/generated/`.
+ */
+export declare function writeGeneratedFiles(result: GenerateResult, baseDir: string): void;
+//# sourceMappingURL=generate.d.ts.map

package/dist/codegen/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EAEpB,MAAM,mCAAmC,CAAC;AAY3C,YAAY,EAAE,cAAc,EAAE,CAAC;AAqB/B;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmBlF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAUjF"}

package/dist/codegen/naming.d.ts

@@ -0,0 +1,30 @@
+/**
+ * cpln naming strategy.
+ *
+ * Every generated type is `Cpln::Core::{Name}` with a `{Name}` the parser has
+ * already made unique — `$ref`'d schemas take their upstream name and inline
+ * shapes take their path — so the core strategy's collision phases never fire
+ * and `resolve` returns the last segment unchanged. The value of going through
+ * the core strategy anyway is phase 1a: once this lexicon publishes a surface
+ * snapshot, a name that has shipped stays attached to the type that shipped it
+ * even if an upstream reshuffle would otherwise hand it to a newcomer.
+ */
+import { NamingStrategy as CoreNamingStrategy } from "@intentius/chant/codegen/naming";
+import type { CplnParseResult } from "../spec/parse.js";
+export { propertyTypeName, extractDefName } from "@intentius/chant/codegen/naming";
+export interface CplnNamingOptions {
+    /** A committed `surface.snapshot.json`, when one exists. */
+    snapshot?: {
+        entries?: Record<string, {
+            kind?: string;
+            resourceType?: string;
+        }>;
+    };
+}
+/**
+ * cpln-specific naming strategy.
+ */
+export declare class NamingStrategy extends CoreNamingStrategy {
+    constructor(results: CplnParseResult[], options?: CplnNamingOptions);
+}
+//# sourceMappingURL=naming.d.ts.map

package/dist/codegen/naming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/codegen/naming.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,cAAc,IAAI,kBAAkB,EAIrC,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAoBnF,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,YAAY,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;CACnF;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,kBAAkB;gBACxC,OAAO,EAAE,eAAe,EAAE,EAAE,OAAO,GAAE,iBAAsB;CAUxE"}

package/dist/codegen/package.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Package the cpln lexicon into the distributable bundle under `dist/`.
+ */
+export declare function packageLexicon(options?: {
+    verbose?: boolean;
+    force?: boolean;
+}): Promise<{
+    spec: import("packages/core/src").BundleSpec;
+    stats: {
+        resources: number;
+        properties: number;
+        enums: number;
+        ruleCount: number;
+        skillCount: number;
+    };
+}>;
+//# sourceMappingURL=package.d.ts.map

package/dist/codegen/package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../src/codegen/package.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,wBAAsB,cAAc,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;;;;;;;;;GAuBpF"}

package/dist/composites/cron-job.d.ts

@@ -0,0 +1,60 @@
+/**
+ * CronJob — a scheduled workload, with the constraints cron carries.
+ *
+ * Cron is the workload type with the most *silent* rules: it must not expose
+ * any port, its container has to exit on completion, and probes, autoscaling,
+ * `timeoutSeconds` and `debug` are all accepted and then ignored. Rather than
+ * let a caller set those and wonder why nothing happens, this composite has no
+ * knobs for them.
+ *
+ * A cron workload also deploys to every location in its GVC with no
+ * per-location override, so placement is a property of the GVC, not of this.
+ */
+import { Workload } from "../generated/index.js";
+export interface CronJobProps {
+    /** Workload name. Max 49 characters. */
+    name: string;
+    /** GVC this job is deployed into. */
+    gvc: string;
+    /** Container image. */
+    image: string;
+    /** Cron schedule, standard five-field syntax (e.g. `"0 * * * *"`). */
+    schedule: string;
+    /** Container name (default `main`). */
+    containerName?: string;
+    /** Entrypoint override. */
+    command?: string;
+    /** Arguments passed to the entrypoint. */
+    args?: string[];
+    /** CPU in millicores (default `50m`). */
+    cpu?: string;
+    /** Memory (default `128Mi`). */
+    memory?: string;
+    /** Environment variables, as a plain map. */
+    env?: Record<string, string>;
+    /**
+     * What to do when a run is still going at the next scheduled time
+     * (default `Forbid` — skip the new run rather than overlap).
+     */
+    concurrencyPolicy?: "Allow" | "Forbid" | "Replace";
+    /** Restart behaviour for a failed run (default `Never`). */
+    restartPolicy?: "Never" | "OnFailure";
+    /** Seconds a run may take before it is killed. */
+    activeDeadlineSeconds?: number;
+    /** How many finished runs to retain. */
+    historyLimit?: number;
+    /** Hostnames or CIDRs the job may call out to. Defaults to closed. */
+    outboundAllowCidr?: string[];
+    /** Identity to run as, as a link (`//gvc/GVC/identity/NAME`). */
+    identityLink?: string;
+    /** Tags applied to the workload. */
+    tags?: Record<string, string>;
+    /** Per-member defaults for customizing the underlying resource. */
+    defaults?: {
+        workload?: Partial<ConstructorParameters<typeof Workload>[0]>;
+    };
+}
+export declare const CronJob: import("@intentius/chant").CompositeDefinition<CronJobProps, {
+    workload: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=cron-job.d.ts.map

package/dist/composites/cron-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-job.d.ts","sourceRoot":"","sources":["../../src/composites/cron-job.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACnD,4DAA4D;IAC5D,aAAa,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IACtC,kDAAkD;IAClD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wCAAwC;IACxC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC/D,CAAC;CACH;AAED,eAAO,MAAM,OAAO;;EA+DP,CAAC"}

package/dist/composites/gvc-environment.d.ts

@@ -0,0 +1,47 @@
+/**
+ * GvcEnvironment — a GVC placed in named locations, with its pull secrets.
+ *
+ * Two things belong here rather than at the workload:
+ *
+ * - **Pull secrets are GVC-level** (`spec.pullSecretLinks`), not per-workload.
+ *   Looking for them on a workload is a common wrong turn, and only the
+ *   `docker`, `ecr` and `gcp` secret types are valid as pull secrets.
+ * - **Placement is GVC-level.** Location links use the full org-qualified path
+ *   (`/org/ORG/location/aws-us-east-1`), which is why this takes an `org`.
+ *
+ * The location id format is `<provider>-<region>`: `aws-us-east-1`,
+ * `gcp-us-central1`, `azure-eastus`.
+ */
+import { Gvc } from "../generated/index.js";
+export interface GvcEnvironmentProps {
+    /** GVC name. */
+    name: string;
+    /** Org the GVC belongs to. Needed to build location links. */
+    org: string;
+    /** Location ids to place workloads in, e.g. `["aws-us-east-1"]`. */
+    locations: string[];
+    /**
+     * Names of secrets used to pull private images. Only `docker`, `ecr` and
+     * `gcp` secret types are valid here.
+     */
+    pullSecrets?: string[];
+    /**
+     * Public endpoint naming scheme (default `org`, the default for new GVCs):
+     * `{workload}-{gvcAlias}.{orgPrefix}.cpln.app`.
+     */
+    endpointNamingFormat?: "default" | "legacy" | "org";
+    /** Environment variables inherited by every workload in the GVC. */
+    env?: Record<string, string>;
+    /** Enable KEDA autoscaling for standard and stateful workloads in this GVC. */
+    keda?: boolean;
+    /** Tags applied to the GVC. */
+    tags?: Record<string, string>;
+    /** Per-member defaults for customizing the underlying resource. */
+    defaults?: {
+        gvc?: Partial<ConstructorParameters<typeof Gvc>[0]>;
+    };
+}
+export declare const GvcEnvironment: import("@intentius/chant").CompositeDefinition<GvcEnvironmentProps, {
+    gvc: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=gvc-environment.d.ts.map

package/dist/composites/gvc-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gvc-environment.d.ts","sourceRoot":"","sources":["../../src/composites/gvc-environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAKnC,MAAM,WAAW,mBAAmB;IAClC,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,oEAAoE;IACpE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAC;IACpD,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACrD,CAAC;CACH;AAED,eAAO,MAAM,cAAc;;EAqDP,CAAC"}

package/dist/composites/index.d.ts

@@ -0,0 +1,13 @@
+export { GvcEnvironment } from "./gvc-environment.js";
+export type { GvcEnvironmentProps } from "./gvc-environment.js";
+export { ServerlessService } from "./serverless-service.js";
+export type { ServerlessServiceProps } from "./serverless-service.js";
+export { CronJob } from "./cron-job.js";
+export type { CronJobProps } from "./cron-job.js";
+export { StatefulService } from "./stateful-service.js";
+export type { StatefulServiceProps } from "./stateful-service.js";
+export { SecretAccess, identityLink, secretRef } from "./secret-access.js";
+export type { SecretAccessProps } from "./secret-access.js";
+export { PublicDomain, isApexDomain } from "./public-domain.js";
+export type { PublicDomainProps, DomainRoute } from "./public-domain.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/composites/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACxE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/composites/public-domain.d.ts

@@ -0,0 +1,68 @@
+/**
+ * PublicDomain — a custom domain routed to workloads in one GVC.
+ *
+ * Domains carry several rules that are easy to violate by picking the
+ * combination that reads best rather than the one that works:
+ *
+ * - An **apex domain must use `cname` mode**. NS mode does not support apex,
+ *   and there is no partial-credit failure — the domain simply will not
+ *   validate.
+ * - **NS mode requires the `dns01` certificate challenge**; `http01` is
+ *   rejected outright.
+ * - `gvcLink`, `workloadLink` and `ports[].routes` are **mutually exclusive**
+ *   ways of saying where traffic goes; exactly one may be set.
+ * - Every route in a domain must target workloads in the **same GVC**.
+ *
+ * This composite takes a GVC and a route table, derives the mode when it can,
+ * and refuses the combinations above at build time.
+ */
+import { Domain } from "../generated/index.js";
+export interface DomainRoute {
+    /** Path prefix to match (e.g. `/api`). One of `prefix` or `regex`. */
+    prefix?: string;
+    /** RE2 path regex to match. One of `prefix` or `regex`. */
+    regex?: string;
+    /** Name of the workload in `gvc` to route to. */
+    workload: string;
+    /** Port on the workload (default 8080). */
+    port?: number;
+    /** Rewrite the matched prefix to this before forwarding. */
+    replacePrefix?: string;
+}
+export interface PublicDomainProps {
+    /** The domain name, e.g. `api.example.com` or the apex `example.com`. */
+    name: string;
+    /** The GVC every route targets. */
+    gvc: string;
+    /**
+     * Routes for the domain. Omit to send all traffic to the GVC's default
+     * routing (a `gvcLink` domain) instead.
+     */
+    routes?: DomainRoute[];
+    /**
+     * DNS mode. Defaults to `cname`, which is also the only mode valid for an
+     * apex domain.
+     */
+    dnsMode?: "cname" | "ns";
+    /**
+     * Certificate challenge type. Defaults to `dns01` under `ns` (the only
+     * option there) and `http01` under `cname`.
+     */
+    certChallengeType?: "dns01" | "http01";
+    /** Public port (default 443). */
+    port?: number;
+    /** Protocol (default `http2`). `tcp` requires a dedicated load balancer. */
+    protocol?: "http" | "http2" | "tcp";
+    /** Tags applied to the domain. */
+    tags?: Record<string, string>;
+    /** Per-member defaults for customizing the underlying resource. */
+    defaults?: {
+        domain?: Partial<ConstructorParameters<typeof Domain>[0]>;
+    };
+}
+/** An apex domain has exactly one dot: `example.com`, not `api.example.com`. */
+export declare function isApexDomain(name: string): boolean;
+export declare const PublicDomain: import("@intentius/chant").CompositeDefinition<PublicDomainProps, {
+    domain: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=public-domain.d.ts.map

package/dist/composites/public-domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-domain.d.ts","sourceRoot":"","sources":["../../src/composites/public-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACvB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACvC,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IACpC,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,eAAO,MAAM,YAAY;;EAuEP,CAAC"}

package/dist/composites/secret-access.d.ts

@@ -0,0 +1,78 @@
+/**
+ * SecretAccess — the identity and policy a workload needs to read a secret.
+ *
+ * Control Plane's own documentation calls a partial version of this its number
+ * one support issue: reading a secret at runtime takes three separate steps,
+ * and **missing any one of them fails silently at runtime** rather than at
+ * apply time.
+ *
+ *   1. An identity exists, and the workload's `spec.identityLink` points at it.
+ *   2. A policy grants that identity `reveal` on the secret, with the identity
+ *      named as a principal in a binding.
+ *   3. The workload references the secret in the field-qualified form —
+ *      `cpln://secret/NAME.payload`, not `cpln://secret/NAME`.
+ *
+ * This composite owns steps 1 and 2, and {@link secretRef} exists for step 3 so
+ * the field qualifier is hard to forget.
+ *
+ * The principal link is the part most worth automating. A binding written
+ * against `//identity/NAME` — which reads perfectly naturally, and is what
+ * you would guess — is accepted by the API and then **silently ignored**. Only
+ * the GVC-qualified `//gvc/GVC/identity/NAME` form works. This composite only
+ * emits the qualified form.
+ */
+import { Identity, Policy } from "../generated/index.js";
+export interface SecretAccessProps {
+    /** Identity name. The policy is named `<name>-secret-access` unless overridden. */
+    name: string;
+    /** GVC the identity lives in. Identities cannot be shared across GVCs. */
+    gvc: string;
+    /**
+     * Names of the org-scoped secrets this identity may read. Each becomes a
+     * `//secret/NAME` target link on the policy.
+     */
+    secrets: string[];
+    /** Policy name (default `<name>-secret-access`). */
+    policyName?: string;
+    /**
+     * Permissions granted on the target secrets (default `["reveal"]`).
+     * Control Plane requires the list to be sorted and unique, which this does.
+     */
+    permissions?: string[];
+    /** Tags applied to both resources. */
+    tags?: Record<string, string>;
+    /** Per-member defaults for customizing individual resources. */
+    defaults?: {
+        identity?: Partial<ConstructorParameters<typeof Identity>[0]>;
+        policy?: Partial<ConstructorParameters<typeof Policy>[0]>;
+    };
+}
+export declare const SecretAccess: import("@intentius/chant").CompositeDefinition<SecretAccessProps, {
+    identity: import("@intentius/chant").Declarable & Record<string, string>;
+    policy: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+/**
+ * The GVC-qualified principal link for an identity.
+ *
+ * Exported because this is the form policies must use, and the unqualified one
+ * fails silently.
+ */
+export declare function identityLink(gvc: string, name: string): string;
+/**
+ * A field-qualified secret reference for use in a container's env or volumes.
+ *
+ * The field name is required. `cpln://secret/db.password` resolves; the
+ * unqualified `cpln://secret/db` does not, except for `gcp` secrets mounted as
+ * a file. The field differs by secret type:
+ *
+ * | Type | Field |
+ * |---|---|
+ * | `opaque` | `payload` |
+ * | `dictionary` | any key |
+ * | `userpass` | `username`, `password` |
+ * | `tls` | `cert`, `key` |
+ * | `keypair` | `publicKey`, `privateKey` |
+ * | `aws` | `accessKey`, `secretKey`, `roleArn` |
+ */
+export declare function secretRef(name: string, field: string): string;
+//# sourceMappingURL=secret-access.d.ts.map

package/dist/composites/secret-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-access.d.ts","sourceRoot":"","sources":["../../src/composites/secret-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,eAAO,MAAM,YAAY;;;EAoDP,CAAC;AAEnB;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D"}