@intentius/chant-lexicon-cpln 0.53.0

package/dist/validate-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=validate-cli.d.ts.map

package/dist/validate-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-cli.d.ts","sourceRoot":"","sources":["../src/validate-cli.ts"],"names":[],"mappings":""}

package/dist/validate.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Validate the generated `lexicon-cpln` artifacts.
+ *
+ * The required-names list is the point of this file: it asserts that a
+ * regeneration still produced the surface consumers import. A rename upstream,
+ * a parser change that stops following a `$ref`, or a loosened subtree would
+ * otherwise leave a smaller generated surface that builds fine and is missing
+ * classes nobody notices until an import fails.
+ *
+ * The list spans all three layers deliberately — the eight resources, property
+ * types reached through several different mechanisms (inline nesting, a `$ref`,
+ * a `oneOf` branch, an array item), and the deepest shapes the parser walks to.
+ * A shallow list of the eight resource names would pass while the entire
+ * property-type tree vanished.
+ */
+import { type ValidateResult } from "@intentius/chant/codegen/validate";
+export type { ValidateCheck, ValidateResult } from "@intentius/chant/codegen/validate";
+/**
+ * Validate the generated artifacts.
+ */
+export declare function validate(opts?: {
+    basePath?: string;
+}): Promise<ValidateResult>;
+/** The names `validate` asserts, exported so a test can assert the list itself is deep. */
+export declare const REQUIRED_ARTIFACT_NAMES: readonly string[];
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAGlG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAkEvF;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAQpF;AAED,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAmB,CAAC"}

package/package.json

@@ -0,0 +1,74 @@
+{
+  "name": "@intentius/chant-lexicon-cpln",
+  "version": "0.53.0",
+  "type": "module",
+  "files": [
+    "src/",
+    "dist/"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "development": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./src/index.ts"
+    },
+    "./*": {
+      "development": "./src/*.ts",
+      "types": "./dist/*.d.ts",
+      "default": "./src/*.ts"
+    },
+    "./detect": {
+      "development": "./src/detect.ts",
+      "types": "./dist/detect.d.ts",
+      "default": "./src/detect.ts"
+    },
+    "./lint/post-synth": {
+      "development": "./src/lint/post-synth/index.ts",
+      "types": "./dist/lint/post-synth/index.d.ts",
+      "default": "./src/lint/post-synth/index.ts"
+    },
+    "./manifest": "./dist/manifest.json",
+    "./meta": "./dist/meta.json",
+    "./types": "./dist/types/index.d.ts"
+  },
+  "scripts": {
+    "generate": "tsx src/codegen/generate-cli.ts",
+    "bundle": "tsx src/package-cli.ts",
+    "validate": "tsx src/validate-cli.ts",
+    "docs": "tsx src/codegen/docs-cli.ts",
+    "snapshot": "tsx src/spec/snapshot-cli.ts",
+    "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
+    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+  },
+  "devDependencies": {
+    "@intentius/chant": "*",
+    "tsc-alias": "^1.8.17",
+    "typescript": "^5.9.3"
+  },
+  "peerDependencies": {
+    "@intentius/chant": "^0.53.0",
+    "typescript": "^5.9.3"
+  },
+  "description": "Control Plane (cpln) lexicon for chant — declarative IaC in TypeScript",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/INTENTIUS/chant.git",
+    "directory": "lexicons/cpln"
+  },
+  "homepage": "https://intentius.io/chant",
+  "bugs": {
+    "url": "https://github.com/INTENTIUS/chant/issues"
+  },
+  "keywords": [
+    "infrastructure-as-code",
+    "iac",
+    "typescript",
+    "control-plane",
+    "cpln",
+    "chant"
+  ]
+}

package/src/api.ts

@@ -0,0 +1,134 @@
+/**
+ * Minimal Control Plane REST client.
+ *
+ * Deliberately small: observation needs list-and-index, nothing more. The API
+ * is uniform enough that one `get` covers every kind — `/org/{org}/{kind}` for
+ * org-scoped, `/org/{org}/{kind}` again for the GVC-scoped rollup, which is why
+ * `collectionPath` in `kinds.ts` returns the org-wide form when no GVC is given.
+ * That rollup is what makes observation one request per kind instead of one per
+ * GVC.
+ *
+ * Credentials follow the CLI's own conventions so `chant plan` reads the org a
+ * `cpln` command in the same shell would write to. Nothing here reads a secret
+ * value: `-reveal` is never called.
+ */
+
+import { collectionPath, type CplnKind } from "./kinds";
+
+/** Default API root. `CPLN_ENDPOINT` overrides it for a private deployment. */
+export const DEFAULT_ENDPOINT = "https://api.cpln.io";
+
+/** A resource as the API returns it. Only the envelope is typed. */
+export interface CplnResource {
+  id?: string;
+  name?: string;
+  kind?: string;
+  version?: number;
+  description?: string;
+  tags?: Record<string, unknown>;
+  created?: string;
+  lastModified?: string;
+  links?: Array<{ rel?: string; href?: string }>;
+  spec?: Record<string, unknown>;
+  status?: Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+/** A list response. Control Plane returns `{ kind: "...list", items: [...] }`. */
+interface CplnList {
+  items?: CplnResource[];
+}
+
+export interface CplnConfig {
+  endpoint: string;
+  org: string;
+  token: string;
+}
+
+/** Thrown when there is no org or no token to read with. */
+export class CplnCredentialsError extends Error {}
+
+/**
+ * Resolve endpoint, org and token from the environment.
+ *
+ * `CPLN_TOKEN` is the documented CI variable and the one Control Plane's own
+ * guidance prefers over `--token`, which leaks into process listings and logs.
+ * A service account key works in the same header.
+ */
+export function resolveConfig(overrides: Partial<CplnConfig> = {}): CplnConfig {
+  const endpoint = overrides.endpoint ?? process.env.CPLN_ENDPOINT ?? DEFAULT_ENDPOINT;
+  const org = overrides.org ?? process.env.CPLN_ORG ?? "";
+  const token = overrides.token ?? process.env.CPLN_TOKEN ?? "";
+
+  if (!org) {
+    throw new CplnCredentialsError(
+      "No Control Plane org. Set CPLN_ORG (or pass `org`) — it is the top-level isolation boundary and " +
+        "every read path is scoped to it.",
+    );
+  }
+  if (!token) {
+    throw new CplnCredentialsError(
+      "No Control Plane token. Set CPLN_TOKEN to a service account key or a JWT. Prefer the env var over " +
+        "`--token`, which leaks into logs.",
+    );
+  }
+
+  return { endpoint: endpoint.replace(/\/+$/, ""), org, token };
+}
+
+/**
+ * Build the `Authorization` header value.
+ *
+ * The spec declares two schemes on the same header: `serviceAccountKey` is an
+ * apiKey sent bare, `jwt` is an HTTP bearer token. They are distinguishable by
+ * shape — a JWT is three base64url segments and always starts `eyJ` — so a
+ * caller does not have to say which kind of credential they have. An
+ * already-prefixed value is passed through so an explicit `Bearer …` works too.
+ */
+export function authorization(token: string): string {
+  if (token.startsWith("Bearer ")) return token;
+  return /^eyJ[A-Za-z0-9_-]+\./.test(token) ? `Bearer ${token}` : token;
+}
+
+/** The transport, injectable so tests need no network. */
+export interface CplnHttp {
+  get(path: string): Promise<unknown>;
+}
+
+/** The default transport — `fetch` with the documented auth header. */
+export function defaultCplnHttp(config: CplnConfig): CplnHttp {
+  return {
+    async get(path: string): Promise<unknown> {
+      const response = await fetch(`${config.endpoint}${path}`, {
+        headers: { Authorization: authorization(config.token), Accept: "application/json" },
+      });
+
+      if (response.status === 404) return undefined;
+      if (!response.ok) {
+        throw new Error(`GET ${path} → ${response.status} ${response.statusText}`);
+      }
+      return response.json();
+    },
+  };
+}
+
+/**
+ * List every resource of one kind in the org, keyed by name.
+ *
+ * Returns an empty map for a 404, which the API uses for a kind the org has
+ * none of as well as for one the token cannot see — the distinction is not
+ * available here, and the observer treats an absent resource as absent either
+ * way.
+ */
+export async function listKind(
+  http: CplnHttp,
+  config: CplnConfig,
+  kind: CplnKind,
+): Promise<Map<string, CplnResource>> {
+  const body = (await http.get(collectionPath(kind, config.org))) as CplnList | undefined;
+  const index = new Map<string, CplnResource>();
+  for (const item of body?.items ?? []) {
+    if (typeof item.name === "string") index.set(item.name, item);
+  }
+  return index;
+}

package/src/codegen/docs-cli.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env tsx
+import { generateDocs } from "./docs";
+
+generateDocs({ verbose: true }).catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/src/codegen/docs.ts

@@ -0,0 +1,94 @@
+/**
+ * cpln documentation generator.
+ *
+ * Calls the core `docsPipeline` with cpln-specific config. The prose pages live
+ * as authored `.mdx` under `docs/pages/`, each naming its Diátaxis quadrant in
+ * frontmatter (chant #1731 / #1733); the pipeline reads them, expands markers
+ * and builds the sidebar from the quadrant. Only the overview and the output
+ * format description stay here, because they are interpolated into generated
+ * pages rather than being pages of their own.
+ */
+
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { docsPipeline, writeDocsSite, type DocsConfig } from "@intentius/chant/codegen/docs";
+
+const pkgDir = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+
+const overview = `The **cpln** lexicon declares [Control Plane](https://controlplane.com) infrastructure as typed chant resources. Control Plane is a hybrid multi-cloud platform: workloads deploy into Global Virtual Clouds that span AWS, GCP, Azure and private clouds, with geo-routing, TLS termination and identity-based cloud access handled by the platform.
+
+Types are generated from Control Plane's served OpenAPI document (\`https://api.cpln.io/openapi.json\`), so they track the real API.
+
+Install it with:
+
+\`\`\`bash
+npm install --save-dev @intentius/chant-lexicon-cpln
+\`\`\`
+
+## Quick Start
+
+\`\`\`typescript
+import { Gvc, Workload } from "@intentius/chant-lexicon-cpln";
+
+export const gvc = new Gvc({
+  name: "prod",
+  spec: {
+    staticPlacement: {
+      locationLinks: ["/org/acme/location/aws-us-east-1"],   // placement is GVC-level
+    },
+  },
+});
+
+export const web = new Workload({
+  name: "web",
+  gvc: "prod",
+  spec: {
+    type: "serverless",                                       // exactly one HTTP port
+    containers: [{
+      name: "main",
+      image: "nginx:1.27",
+      ports: [{ number: 8080, protocol: "http" }],
+    }],
+    firewallConfig: {
+      external: { inboundAllowCIDR: ["0.0.0.0/0"] },          // closed by default
+    },
+  },
+});
+\`\`\`
+
+## The loop
+
+1. \`chant build\` — synthesize and lint. The CPL rules catch the silent failures Control Plane does not report: an unqualified identity link, a scale-to-zero that never happens, a secret reference with no field.
+2. \`cpln apply --file dist/cpln.yaml --ready\` — reconcile. Ordering across documents is resolved by \`cpln apply\` itself.
+3. \`chant plan\` — read the live org back and diff. Ownership comes from the \`tags\` marker chant stamps at synthesis.
+`;
+
+const outputFormat = "multi-document Control Plane YAML for `cpln apply --file`";
+
+/**
+ * Generate the documentation site for the cpln lexicon.
+ */
+export async function generateDocs(options?: { verbose?: boolean }): Promise<void> {
+  const config: DocsConfig = {
+    name: "cpln",
+    displayName: "Control Plane",
+    description: "Control Plane (cpln) GVCs, workloads, identities and secrets as typed estate.",
+    distDir: join(pkgDir, "dist"),
+    outDir: join(pkgDir, "docs"),
+    srcDir: join(pkgDir, "src"),
+    basePath: process.env.DOCS_BASE_PATH ?? "/chant/lexicons/cpln/",
+    overview,
+    outputFormat,
+    serviceFromType: (type: string) => type.split("::")[1] ?? type,
+  };
+
+  const result = docsPipeline(config);
+  writeDocsSite(config, result);
+
+  if (options?.verbose) {
+    console.error(
+      `Generated docs: ${result.stats.resources} resources, ${result.stats.properties} properties, ` +
+        `${result.stats.services} services, ${result.stats.rules} rules`,
+    );
+  }
+}

package/src/codegen/generate-cli.ts

@@ -0,0 +1,34 @@
+#!/usr/bin/env tsx
+/**
+ * CLI entry point for cpln lexicon generation.
+ */
+
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+import { generate, writeGeneratedFiles } from "./generate";
+
+const pkgDir = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+
+async function main(): Promise<void> {
+  const verbose = process.argv.includes("--verbose") || process.argv.includes("-v");
+  const force = process.argv.includes("--force") || process.argv.includes("-f");
+
+  console.error("Generating cpln lexicon...");
+
+  const result = await generate({ verbose, force });
+  writeGeneratedFiles(result, pkgDir);
+
+  console.error(
+    `Generated ${result.resources} resources, ${result.properties} property types, ${result.enums} enums`,
+  );
+
+  if (result.warnings.length > 0) {
+    console.error(`${result.warnings.length} warnings:`);
+    for (const w of result.warnings) console.error(`  ${w.file}: ${w.error}`);
+  }
+}
+
+main().catch((err) => {
+  console.error("Generation failed:", err);
+  process.exit(1);
+});

package/src/codegen/generate-lexicon.ts

@@ -0,0 +1,88 @@
+/**
+ * Lexicon registry generator — produces `lexicon-cpln.json`, the metadata the
+ * evaluator and lint engine read for each cpln resource and property type.
+ */
+
+import type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
+import {
+  buildRegistry,
+  serializeRegistry,
+  type RegistryResource,
+} from "@intentius/chant/codegen/generate-registry";
+import { cplnShortName, kindByTypeName } from "../kinds";
+import type { CplnParseResult } from "../spec/parse";
+import type { NamingStrategy } from "./naming";
+
+export interface CplnLexiconEntry {
+  resourceType: string;
+  kind: "resource" | "property";
+  lexicon: "cpln";
+  /** The `kind` discriminator a manifest carries. Resources only. */
+  cplnKind?: string;
+  /** Whether the resource is addressed under a GVC. Resources only. */
+  gvcScoped?: boolean;
+  /**
+   * Per-property constraints.
+   *
+   * Named to match core's `LexiconEntry` contract rather than the bare
+   * `constraints` it would be natural to call it. The name is load-bearing
+   * twice over: `LexiconIndex.getPropertyNames` derives the LSP's property
+   * completions from *the keys of this object*, and hover reads the enums out
+   * of its values. Under any other key both features return nothing, with no
+   * error — the index simply finds no properties.
+   *
+   * Every writable property gets an entry for the same reason, even when it
+   * carries no constraints at all. A property omitted here is a property that
+   * does not complete.
+   */
+  propertyConstraints?: Record<string, PropertyConstraints>;
+}
+
+/**
+ * Generate the `lexicon-cpln.json` content.
+ */
+export function generateLexiconJSON(results: CplnParseResult[], naming: NamingStrategy): string {
+  const registryResources: RegistryResource[] = results.map((r) => ({
+    typeName: r.resource.typeName,
+    attributes: r.resource.attributes,
+    properties: r.resource.properties,
+    propertyTypes: [],
+  }));
+
+  // Every writable property, with its constraints — see `propertyConstraints`.
+  const byTypeName = new Map(results.map((r) => [r.resource.typeName, r] as const));
+
+  const entries = buildRegistry<CplnLexiconEntry>(registryResources, naming, {
+    shortName: cplnShortName,
+    buildEntry: (resource) => {
+      const kind = kindByTypeName(resource.typeName);
+      const entry: CplnLexiconEntry = {
+        resourceType: resource.typeName,
+        kind: kind ? "resource" : "property",
+        lexicon: "cpln",
+      };
+      if (kind) {
+        // Carried on the entry so the serializer and observation can route a
+        // resource without re-deriving the mapping from its class name.
+        entry.cplnKind = kind.kind;
+        entry.gvcScoped = kind.gvcScoped;
+      }
+
+      const parsed = byTypeName.get(resource.typeName);
+      const constraints: Record<string, PropertyConstraints> = {};
+      for (const property of parsed?.resource.properties ?? []) {
+        constraints[property.name] = property.constraints ?? {};
+      }
+      if (Object.keys(constraints).length > 0) entry.propertyConstraints = constraints;
+
+      return entry;
+    },
+    buildPropertyEntry: (resourceType, propertyType) => ({
+      resourceType: `${resourceType}.${propertyType}`,
+      kind: "property",
+      lexicon: "cpln",
+    }),
+  });
+
+  return serializeRegistry(entries);
+}

package/src/codegen/generate-typescript.ts

@@ -0,0 +1,71 @@
+/**
+ * TypeScript declaration generator — produces `index.d.ts` with the eight cpln
+ * resource classes and the property-type classes their specs reach.
+ */
+
+import {
+  writeResourceClass,
+  writePropertyClass,
+  type DtsProperty,
+  type DtsAttribute,
+} from "@intentius/chant/codegen/generate-typescript";
+import type { CplnParseResult } from "../spec/parse";
+import type { NamingStrategy } from "./naming";
+
+interface Entry {
+  tsName: string;
+  isProperty: boolean;
+  properties: DtsProperty[];
+  attributes: DtsAttribute[];
+}
+
+/**
+ * Generate the complete `.d.ts` content.
+ */
+export function generateTypeScriptDeclarations(results: CplnParseResult[], naming: NamingStrategy): string {
+  const lines: string[] = [];
+  lines.push("// Code generated by chant cpln generate. DO NOT EDIT.");
+
+  const entries: Entry[] = [];
+
+  for (const r of results) {
+    const tsName = naming.resolve(r.resource.typeName);
+    if (!tsName) continue;
+
+    entries.push({
+      tsName,
+      isProperty: !!r.isProperty,
+      properties: r.resource.properties.map((p) => ({
+        name: p.name,
+        type: p.tsType,
+        required: p.required,
+        description: p.description,
+      })),
+      attributes: r.resource.attributes.map((a) => ({ name: a.name, type: a.tsType })),
+    });
+  }
+
+  entries.sort((a, b) => a.tsName.localeCompare(b.tsName));
+
+  const resources = entries.filter((e) => !e.isProperty);
+  const propertyTypes = entries.filter((e) => e.isProperty);
+
+  if (resources.length > 0) {
+    lines.push("");
+    lines.push("// --- Control Plane resource classes ---");
+    for (const re of resources) {
+      writeResourceClass(lines, re.tsName, re.properties, re.attributes);
+    }
+  }
+
+  if (propertyTypes.length > 0) {
+    lines.push("");
+    lines.push("// --- Property type classes ---");
+    for (const pe of propertyTypes) {
+      writePropertyClass(lines, pe.tsName, pe.properties);
+    }
+  }
+
+  lines.push("");
+  return lines.join("\n");
+}

package/src/codegen/generate.ts

@@ -0,0 +1,110 @@
+/**
+ * cpln generation pipeline — core `generatePipeline` with cpln's fetch, parse,
+ * naming and emit callbacks.
+ */
+
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import {
+  generatePipeline,
+  writeGeneratedArtifacts,
+  type GenerateOptions,
+  type GenerateResult,
+  type GeneratePipelineConfig,
+} from "@intentius/chant/codegen/generate";
+import {
+  generateRuntimeIndex as coreGenerateRuntimeIndex,
+  type RuntimeIndexEntry,
+  type RuntimeIndexPropertyEntry,
+} from "@intentius/chant/codegen/generate-runtime-index";
+import { fetchSchemas } from "../spec/fetch";
+import { parseCplnOpenAPI, type CplnParseResult } from "../spec/parse";
+import { NamingStrategy } from "./naming";
+import { generateLexiconJSON } from "./generate-lexicon";
+import { generateTypeScriptDeclarations } from "./generate-typescript";
+
+export type { GenerateResult };
+
+const PKG_DIR = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+const SURFACE_SNAPSHOT = join(PKG_DIR, "surface.snapshot.json");
+
+/**
+ * Read the committed surface snapshot, when there is one.
+ *
+ * Absent before the first publish, which is the honest state for a lexicon
+ * with no published names to protect — the naming strategy simply has nothing
+ * to reserve.
+ */
+function readSurfaceSnapshot(): { entries?: Record<string, { kind?: string; resourceType?: string }> } | undefined {
+  if (!existsSync(SURFACE_SNAPSHOT)) return undefined;
+  try {
+    return JSON.parse(readFileSync(SURFACE_SNAPSHOT, "utf-8"));
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Run the full cpln generation pipeline.
+ */
+export async function generate(opts: GenerateOptions = {}): Promise<GenerateResult> {
+  const config: GeneratePipelineConfig<CplnParseResult> = {
+    fetchSchemas: (fetchOpts) => fetchSchemas({ force: fetchOpts.force }),
+
+    // The spec is one document and `parseSchema` is called once with it; the
+    // pipeline accepts an array back, so there is no need for fly's
+    // parse-once-stash-the-rest dance.
+    parseSchema: (_typeName, data) => parseCplnOpenAPI(data),
+
+    createNaming: (results) => new NamingStrategy(results, { snapshot: readSurfaceSnapshot() }),
+
+    generateRegistry: (results, naming) => generateLexiconJSON(results, naming as NamingStrategy),
+
+    generateTypes: (results, naming) => generateTypeScriptDeclarations(results, naming as NamingStrategy),
+
+    generateRuntimeIndex: (results, naming) => buildRuntimeIndex(results, naming as NamingStrategy),
+  };
+
+  return generatePipeline(config, opts);
+}
+
+/**
+ * Write generated artifacts under `src/generated/`.
+ */
+export function writeGeneratedFiles(result: GenerateResult, baseDir: string): void {
+  writeGeneratedArtifacts({
+    baseDir,
+    files: {
+      "lexicon-cpln.json": result.lexiconJSON,
+      "index.d.ts": result.typesDTS,
+      "index.ts": result.indexTS,
+      "runtime.ts": `/**\n * Runtime factory constructors — re-exported from core.\n */\nexport { createResource, createProperty } from "@intentius/chant/runtime";\n`,
+    },
+  });
+}
+
+/**
+ * Build the runtime index with the factory constructor exports.
+ */
+function buildRuntimeIndex(results: CplnParseResult[], naming: NamingStrategy): string {
+  const resourceEntries: RuntimeIndexEntry[] = [];
+  const propertyEntries: RuntimeIndexPropertyEntry[] = [];
+
+  for (const r of results) {
+    const typeName = r.resource.typeName;
+    const tsName = naming.resolve(typeName);
+    if (!tsName) continue;
+
+    if (r.isProperty) {
+      propertyEntries.push({ tsName, resourceType: typeName });
+      continue;
+    }
+
+    const attrs: Record<string, string> = {};
+    for (const attr of r.resource.attributes) attrs[attr.name] = attr.name;
+    resourceEntries.push({ tsName, resourceType: typeName, attrs });
+  }
+
+  return coreGenerateRuntimeIndex(resourceEntries, propertyEntries, { lexiconName: "cpln" });
+}