@intentius/chant-lexicon-cpln 0.53.0

package/src/generated/runtime.ts

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/src/index.ts

@@ -0,0 +1,31 @@
+// Plugin
+export { cplnPlugin } from "./plugin";
+
+// Serializer
+export { cplnSerializer, cplnLink } from "./serializer";
+
+// The modelled kinds and the link/path helpers built on them. Useful to
+// consumers writing their own tooling against a chant-declared cpln estate.
+export {
+  KINDS,
+  KIND_NAMES,
+  kindByName,
+  kindByTypeName,
+  kindByClassName,
+  isCplnResourceType,
+  collectionPath,
+  resourcePath,
+  NAMESPACE,
+  SERVICE,
+} from "./kinds";
+export type { CplnKind } from "./kinds";
+
+// Ownership marker convention (cpln `tags` keys).
+export { CPLN_TAG_OWNERSHIP_KEYS } from "./ownership";
+
+// Composites — opinionated bundles over the generated resources.
+export * from "./composites";
+
+// Generated resources — `Gvc`, `Workload`, `Identity`, `VolumeSet`, `Secret`,
+// `Policy`, `Domain`, `IpSet` and the property types their specs reach.
+export * from "./generated/index";

package/src/init-templates.ts

@@ -0,0 +1,131 @@
+/**
+ * `chant init` scaffolding for cpln projects.
+ *
+ * Three templates, chosen so the default is the shape most people actually
+ * start with and the other two are the two directions it grows in. Each is
+ * written to pass this lexicon's own checks as scaffolded — a template that
+ * emits CPL findings on first build teaches the wrong lesson about what the
+ * findings mean.
+ */
+
+import type { InitTemplateSet } from "@intentius/chant/lexicon";
+
+const DEFAULT = `import { GvcEnvironment, ServerlessService } from "@intentius/chant-lexicon-cpln";
+
+// A GVC and one public serverless service.
+//
+// Placement lives on the GVC, not the workload — locationLinks is what decides
+// where anything in this environment runs. Set CPLN_ORG to your org name.
+const org = process.env.CPLN_ORG ?? "my-org";
+
+export const { gvc } = GvcEnvironment({
+  name: "prod",
+  org,
+  locations: ["aws-us-east-1"],
+});
+
+// Serverless requires exactly one HTTP port, and the external firewall starts
+// closed in both directions — so a public service says so explicitly. Egress is
+// left closed; open it to the hosts this actually calls.
+export const { workload } = ServerlessService({
+  name: "web",
+  gvc: "prod",
+  image: "nginx:1.27",
+  port: 8080,
+  inboundAllowCidr: ["0.0.0.0/0"],
+});
+`;
+
+const WITH_SECRETS = `import {
+  GvcEnvironment,
+  ServerlessService,
+  SecretAccess,
+  Secret,
+  secretRef,
+} from "@intentius/chant-lexicon-cpln";
+
+// A service that reads a secret at runtime.
+//
+// Reading a secret takes three things, and missing any one fails *silently* at
+// runtime rather than at apply: an identity on the workload, a policy granting
+// that identity \`reveal\`, and a field-qualified reference. SecretAccess owns
+// the first two; secretRef() is the third.
+const org = process.env.CPLN_ORG ?? "my-org";
+
+export const { gvc } = GvcEnvironment({
+  name: "prod",
+  org,
+  locations: ["aws-us-east-1"],
+});
+
+// The value is a placeholder. Set the real one with \`cpln secret edit\`, or
+// point this at a value read from the environment at build time — never a
+// literal in source (CPL001).
+export const dbPassword = new Secret({
+  name: "db-password",
+  type: "opaque",
+  data: { payload: process.env.DB_PASSWORD ?? "changeme", encoding: "plain" },
+});
+
+export const { identity, policy } = SecretAccess({
+  name: "web-identity",
+  gvc: "prod",
+  secrets: ["db-password"],
+});
+
+export const { workload } = ServerlessService({
+  name: "web",
+  gvc: "prod",
+  image: "nginx:1.27",
+  port: 8080,
+  inboundAllowCidr: ["0.0.0.0/0"],
+  identityLink: "//gvc/prod/identity/web-identity",
+  env: {
+    DATABASE_PASSWORD: secretRef("db-password", "payload"),
+  },
+});
+`;
+
+const STATEFUL = `import { GvcEnvironment, StatefulService } from "@intentius/chant-lexicon-cpln";
+
+// A stateful service with persistent storage.
+//
+// Both fileSystemType and performanceClass are immutable — changing either
+// later means delete, recreate, and data loss — so they are worth settling
+// before the first apply. ext4 binds to exactly one stateful workload; use
+// "shared" if several workloads need the same volume.
+const org = process.env.CPLN_ORG ?? "my-org";
+
+export const { gvc } = GvcEnvironment({
+  name: "prod",
+  org,
+  locations: ["aws-us-east-1"],
+});
+
+export const { workload, volumeSet } = StatefulService({
+  name: "db",
+  gvc: "prod",
+  image: "postgres:17",
+  mountPath: "/var/lib/postgresql/data",
+  capacityGb: 20,
+  fileSystemType: "ext4",
+  performanceClass: "general-purpose-ssd",
+  ports: [{ number: 5432, protocol: "tcp" }],
+  env: { POSTGRES_DB: "app" },
+});
+`;
+
+/**
+ * Return the scaffold for a template name. Unknown names fall back to the
+ * default rather than erroring — `chant init` treats the name as a hint.
+ */
+export function cplnInitTemplates(template?: string): InitTemplateSet {
+  switch (template) {
+    case "secrets":
+      return { src: { "infra.ts": WITH_SECRETS } };
+    case "stateful":
+      return { src: { "infra.ts": STATEFUL } };
+    default:
+      return { src: { "infra.ts": DEFAULT } };
+  }
+}

package/src/kinds.ts

@@ -0,0 +1,173 @@
+/**
+ * The Control Plane kinds this lexicon models, and the facts about each that
+ * more than one subsystem needs.
+ *
+ * Codegen, the serializer, observation, the LSP providers, the MCP catalog and
+ * the docs generator all need to agree on the same three things: which schema
+ * in the OpenAPI document backs a kind, what its chant type name is, and
+ * whether it is scoped to a GVC. Each of those was, in an earlier draft, a
+ * literal repeated in five files — so a kind added in one place quietly went
+ * missing from the others. This table is the single place a kind is declared.
+ *
+ * Coverage is deliberately the *workload* surface rather than every kind the
+ * API exposes. The org-administration kinds (`group`, `serviceaccount`,
+ * `cloudaccount`, `auditctx`, `user`, `agent`) and `mk8s` are all modellable
+ * from the same spec by adding rows here; they are out of the first pass, not
+ * out of reach. `chant cpln coverage` reports the gap rather than hiding it.
+ */
+
+/** The chant namespace segment for every generated cpln type. */
+export const NAMESPACE = "Cpln";
+
+/** The single service segment. The Control Plane Core API is one service. */
+export const SERVICE = "Core";
+
+export interface CplnKind {
+  /**
+   * The `kind` discriminator as it appears in a `cpln apply` manifest and in
+   * the API's own responses. Also the REST collection segment — the API is
+   * uniform that way, so `/org/{org}/{kind}` is the org-scoped collection and
+   * `/org/{org}/gvc/{gvc}/{kind}` the GVC-scoped one.
+   */
+  kind: string;
+  /** The schema name in `components.schemas` backing this kind. */
+  schema: string;
+  /** The chant type name, e.g. `Cpln::Core::Workload`. */
+  typeName: string;
+  /** The generated TypeScript class name, e.g. `Workload`. */
+  className: string;
+  /**
+   * Whether the kind lives inside a GVC. GVC-scoped kinds get a synthetic
+   * `gvc` property — see `SYNTHETIC_GVC_PROP` in `spec/parse.ts` for why the
+   * spec cannot supply it.
+   */
+  gvcScoped: boolean;
+  /** One-line summary, used for LSP hover, MCP catalog entries and docs. */
+  summary: string;
+}
+
+export const KINDS: CplnKind[] = [
+  {
+    kind: "gvc",
+    schema: "gvc",
+    typeName: `${NAMESPACE}::${SERVICE}::Gvc`,
+    className: "Gvc",
+    gvcScoped: false,
+    summary:
+      "Global Virtual Cloud — the placement and networking boundary every workload, identity and volume set belongs to.",
+  },
+  {
+    kind: "workload",
+    schema: "workload",
+    typeName: `${NAMESPACE}::${SERVICE}::Workload`,
+    className: "Workload",
+    gvcScoped: true,
+    summary:
+      "A running unit of work — serverless, standard, cron, stateful or vm — with its containers, firewall and autoscaling.",
+  },
+  {
+    kind: "identity",
+    schema: "identity",
+    typeName: `${NAMESPACE}::${SERVICE}::Identity`,
+    className: "Identity",
+    gvcScoped: true,
+    summary:
+      "A workload's identity, carrying its cloud-provider access (AWS/GCP/Azure) and network resource grants.",
+  },
+  {
+    kind: "volumeset",
+    schema: "volumeset",
+    typeName: `${NAMESPACE}::${SERVICE}::VolumeSet`,
+    className: "VolumeSet",
+    gvcScoped: true,
+    summary: "Persistent storage attached to stateful workloads, with its performance class and snapshot policy.",
+  },
+  {
+    kind: "secret",
+    schema: "secret",
+    typeName: `${NAMESPACE}::${SERVICE}::Secret`,
+    className: "Secret",
+    gvcScoped: false,
+    summary: "An org-scoped secret — opaque, TLS, keypair, dictionary, or a cloud-provider credential.",
+  },
+  {
+    kind: "policy",
+    schema: "policy",
+    typeName: `${NAMESPACE}::${SERVICE}::Policy`,
+    className: "Policy",
+    gvcScoped: false,
+    summary: "An access policy binding permissions to principals over a target kind, link set, or query.",
+  },
+  {
+    kind: "domain",
+    schema: "domain",
+    typeName: `${NAMESPACE}::${SERVICE}::Domain`,
+    className: "Domain",
+    gvcScoped: false,
+    summary: "A custom domain with its TLS, CORS and per-port routing to workloads.",
+  },
+  {
+    kind: "ipset",
+    schema: "ipset",
+    typeName: `${NAMESPACE}::${SERVICE}::IpSet`,
+    className: "IpSet",
+    gvcScoped: false,
+    summary: "A set of dedicated IP addresses reserved in named locations and bound to a workload.",
+  },
+];
+
+/** Every modelled kind string, in declaration order. */
+export const KIND_NAMES: string[] = KINDS.map((k) => k.kind);
+
+const BY_KIND = new Map(KINDS.map((k) => [k.kind, k] as const));
+const BY_TYPE_NAME = new Map(KINDS.map((k) => [k.typeName, k] as const));
+const BY_CLASS_NAME = new Map(KINDS.map((k) => [k.className, k] as const));
+
+/** Look up a kind by its `kind` discriminator (`"workload"`). */
+export function kindByName(kind: string): CplnKind | undefined {
+  return BY_KIND.get(kind);
+}
+
+/** Look up a kind by chant type name (`"Cpln::Core::Workload"`). */
+export function kindByTypeName(typeName: string): CplnKind | undefined {
+  return BY_TYPE_NAME.get(typeName);
+}
+
+/** Look up a kind by generated class name (`"Workload"`). */
+export function kindByClassName(className: string): CplnKind | undefined {
+  return BY_CLASS_NAME.get(className);
+}
+
+/** Whether a chant type name belongs to a modelled cpln resource (not a property type). */
+export function isCplnResourceType(typeName: string): boolean {
+  return BY_TYPE_NAME.has(typeName);
+}
+
+/**
+ * The REST collection path for a kind, relative to the API root.
+ *
+ * GVC-scoped kinds have two: the writable collection nested under their GVC,
+ * and an org-wide read-only rollup. Observation uses the rollup (one request
+ * per kind instead of one per GVC); apply uses the nested one.
+ */
+export function collectionPath(kind: CplnKind, org: string, gvc?: string): string {
+  if (kind.gvcScoped && gvc) return `/org/${org}/gvc/${gvc}/${kind.kind}`;
+  return `/org/${org}/${kind.kind}`;
+}
+
+/** The path of a single named resource. */
+export function resourcePath(kind: CplnKind, org: string, name: string, gvc?: string): string {
+  return `${collectionPath(kind, org, gvc)}/${name}`;
+}
+
+/** Extract the short name from a chant type name: `Cpln::Core::Workload` → `Workload`. */
+export function cplnShortName(typeName: string): string {
+  const parts = typeName.split("::");
+  return parts[parts.length - 1];
+}
+
+/** Extract the service segment: `Cpln::Core::Workload` → `Core`. */
+export function cplnServiceName(typeName: string): string {
+  const parts = typeName.split("::");
+  return parts.length >= 2 ? parts[1] : SERVICE;
+}

package/src/lint/audit-catalog.ts

@@ -0,0 +1,230 @@
+/**
+ * The cpln lexicon's `chant audit` catalog — metadata for every CPL check.
+ *
+ * Every entry carries `yamlBased: false`. That is not an oversight: all of
+ * cpln's checks read the chant model (`ctx.entities`) rather than the emitted
+ * manifests (`ctx.outputs`), because the facts they need — which GVC a workload
+ * is placed in, which volume set a mount names, whether a policy principal is
+ * GVC-qualified — are relationships between declared resources rather than text
+ * in one document. They fire on `chant build` and cannot fire on an audit of
+ * standalone cpln YAML. `auditRule()` hardcodes `yamlBased: true`, so these are
+ * constructed directly.
+ *
+ * A test asserts this catalog covers every check the plugin registers, so a
+ * check added without an entry here fails the build rather than contributing
+ * nothing to `chant audit` silently.
+ */
+
+import type { Authority, RuleMeta } from "@intentius/chant/audit/catalog";
+
+// ── Authorities ────────────────────────────────────────────────────
+
+const CPLN_WORKLOAD: Authority = {
+  name: "Control Plane — Workload reference",
+  url: "https://docs.controlplane.com/reference/workload",
+};
+const CPLN_SECRETS: Authority = {
+  name: "Control Plane — Secret access model",
+  url: "https://docs.controlplane.com/reference/secret",
+};
+const CPLN_POLICY: Authority = {
+  name: "Control Plane — Policy reference",
+  url: "https://docs.controlplane.com/reference/policy",
+};
+
+/**
+ * An entry with no external citation.
+ *
+ * Deliberately unable to take one. Core asserts two invariants over the
+ * aggregated catalog — an authority citation always means `security`, and it
+ * only attaches to `merge-worthy` — so a citation is not decoration, it is a
+ * claim about the finding's weight. Splitting the constructors makes the pair
+ * unviolatable here rather than caught later by core's test.
+ */
+function rule(
+  id: string,
+  tier: RuleMeta["tier"],
+  category: RuleMeta["category"],
+  title: string,
+  remediation: string,
+): RuleMeta {
+  return { id, tier, fixKind: "guidance", category, title, remediation, yamlBased: false };
+}
+
+/**
+ * A merge-worthy security entry, which is the only kind that may cite an
+ * authority. The tier and category are not parameters because there is only
+ * one legal combination.
+ */
+function securityRule(id: string, title: string, remediation: string, authority: Authority[]): RuleMeta {
+  return {
+    id,
+    tier: "merge-worthy",
+    fixKind: "guidance",
+    category: "security",
+    title,
+    remediation,
+    authority,
+    yamlBased: false,
+  };
+}
+
+export const cplnAuditCatalog: Record<string, RuleMeta> = {
+  // ── Source-level rules ───────────────────────────────────────────
+  CPL001: securityRule(
+    "CPL001",
+    "Literal credential in a cpln declaration",
+    "Store the value as a Secret and reference it as cpln://secret/NAME.FIELD.",
+    [CPLN_SECRETS],
+  ),
+  CPL002: rule(
+    "CPL002",
+    "report-only",
+    "best-practice",
+    "Hand-written Control Plane link where a resource reference would do",
+    "Pass the declared resource; the serializer emits the correct link, GVC qualifier included.",
+  ),
+
+  // ── Security ─────────────────────────────────────────────────────
+  CPL010: securityRule(
+    "CPL010",
+    "Workload allows outbound traffic to every address",
+    "Narrow outboundAllowCIDR, or use outboundAllowHostname with wildcards.",
+    [CPLN_WORKLOAD],
+  ),
+  CPL011: rule(
+    "CPL011",
+    "report-only",
+    "security",
+    "Internal firewall opened to the whole org",
+    'Prefer "same-gvc", or "workload-list" naming the specific workloads.',
+  ),
+  CPL012: securityRule(
+    "CPL012",
+    "Credential-shaped environment variable set to a literal",
+    "Reference a secret: cpln://secret/NAME.FIELD.",
+    [CPLN_SECRETS],
+  ),
+  CPL013: securityRule(
+    "CPL013",
+    "Policy binds an identity by its unqualified link",
+    "Use //gvc/<gvc>/identity/<name>; the bare //identity/<name> form is silently ignored.",
+    [CPLN_POLICY],
+  ),
+  CPL014: rule(
+    "CPL014",
+    "merge-worthy",
+    "correctness",
+    "Secret reference names no field",
+    "Qualify the reference: cpln://secret/NAME.payload, .username, .cert, or a dictionary key.",
+  ),
+
+  // ── Correctness ──────────────────────────────────────────────────
+  CPL020: rule(
+    "CPL020",
+    "merge-worthy",
+    "correctness",
+    "Serverless workload does not expose exactly one HTTP port",
+    "Expose exactly one http/http2 port, or change the workload to type standard.",
+  ),
+  CPL021: rule(
+    "CPL021",
+    "merge-worthy",
+    "correctness",
+    "Cron workload shape is invalid",
+    "Cron requires spec.job.schedule and must expose no ports; no other type may set spec.job.",
+  ),
+  CPL022: rule(
+    "CPL022",
+    "merge-worthy",
+    "correctness",
+    "Container ports conflict",
+    "Use `ports` rather than `port`, and keep port numbers unique across a workload's containers.",
+  ),
+  CPL023: rule(
+    "CPL023",
+    "merge-worthy",
+    "correctness",
+    "Container resources violate a platform floor or the memory-to-CPU ratio",
+    "CPU ≥ 25m, memory ≥ 32Mi, and memory(MiB)/cpu(m) ≤ 8 — or add the cpln/relaxMemoryToCpuRatio tag.",
+  ),
+  CPL024: rule(
+    "CPL024",
+    "merge-worthy",
+    "correctness",
+    "Health-check probe sets no handler, or more than one",
+    "Set exactly one of exec, grpc, tcpSocket, httpGet per probe.",
+  ),
+  CPL025: rule(
+    "CPL025",
+    "merge-worthy",
+    "correctness",
+    "Autoscaling configuration is not a valid combination",
+    "`metric` and `multi` are exclusive; `target` belongs to the single-metric form and caps at 100 for cpu/memory.",
+  ),
+  CPL026: rule(
+    "CPL026",
+    "merge-worthy",
+    "correctness",
+    "minScale 0 with a strategy that cannot scale to zero",
+    "Serverless needs rps or concurrency; standard and stateful need KEDA, enabled at the GVC.",
+  ),
+  CPL027: rule(
+    "CPL027",
+    "merge-worthy",
+    "correctness",
+    "Capacity AI combined with a feature it excludes",
+    "Set defaultOptions.capacityAI false, or drop the CPU-utilization scaling, multi-metric scaling, or GPU.",
+  ),
+  CPL028: rule(
+    "CPL028",
+    "merge-worthy",
+    "correctness",
+    "Volume set capacity, filesystem binding, or mount paths are invalid",
+    "Clear the performance-class capacity floor, mount ext4/xfs only from stateful workloads, and keep mount paths disjoint.",
+  ),
+  CPL029: rule(
+    "CPL029",
+    "merge-worthy",
+    "correctness",
+    "Control Plane link does not resolve, or crosses a GVC boundary",
+    "Point the link at a declared resource in the right GVC; identities cannot be shared across GVCs.",
+  ),
+  CPL030: rule(
+    "CPL030",
+    "merge-worthy",
+    "correctness",
+    "Domain DNS mode, challenge, or routing target is invalid",
+    "Apex domains need cname; ns needs dns01; pick exactly one of gvcLink, workloadLink, ports[].routes.",
+  ),
+
+  // ── Best practice ────────────────────────────────────────────────
+  CPL040: rule(
+    "CPL040",
+    "report-only",
+    "best-practice",
+    "Container image is not pinned",
+    "Pin a version tag or a digest; a scale-from-zero cold start re-pulls.",
+  ),
+  CPL041: rule(
+    "CPL041",
+    "merge-worthy",
+    "correctness",
+    "Image reference uses a registry prefix Control Plane rejects",
+    "Drop the docker.io/ prefix; address this org's own images as //image/NAME:TAG.",
+  ),
+  CPL042: rule(
+    "CPL042",
+    "merge-worthy",
+    "correctness",
+    "GVC declares no placement",
+    "Set spec.staticPlacement.locationLinks, e.g. /org/<org>/location/aws-us-east-1.",
+  ),
+  CPL043: rule(
+    "CPL043",
+    "merge-worthy",
+    "correctness",
+    "Policy target kind, scope, or origin is not well formed",
+    "Pick exactly one target scope, target a policy-targetable kind, and never set origin by hand.",
+  ),
+};

package/src/lint/post-synth/cpl010-unrestricted-outbound.ts

@@ -0,0 +1,41 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readArray } from "../../entity-props";
+import { WORKLOAD, entitiesOfType } from "./helpers";
+
+const ANY_ADDRESS = "0.0.0.0/0";
+
+/**
+ * CPL010: a workload that may call out to the entire internet.
+ *
+ * Inbound `0.0.0.0/0` is how a public service is *supposed* to be written, so
+ * it is not flagged. Outbound `0.0.0.0/0` is different: it is rarely required,
+ * it is the egress path for anything that gets a foothold in the container,
+ * and Control Plane supports hostname rules (with wildcards) precisely so it
+ * does not have to be all-or-nothing.
+ */
+export const unrestrictedOutboundCheck: PostSynthCheck = {
+  id: "CPL010",
+  description: "Workloads should not allow outbound traffic to every address",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+      const outbound = readArray(entity, "spec", "firewallConfig", "external", "outboundAllowCIDR");
+      if (!outbound.includes(ANY_ADDRESS)) continue;
+
+      diagnostics.push({
+        checkId: "CPL010",
+        severity: "warning",
+        message:
+          `Workload "${name}" allows outbound traffic to ${ANY_ADDRESS}. Narrow it to the CIDRs it ` +
+          `actually calls, or use \`outboundAllowHostname\` (wildcards like "*.amazonaws.com" are ` +
+          `supported) so egress is bounded.`,
+        entity: name,
+        lexicon: "cpln",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/cpl011-internal-firewall-scope.ts

@@ -0,0 +1,38 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readString } from "../../entity-props";
+import { GVC, WORKLOAD, entitiesOfType } from "./helpers";
+
+/**
+ * CPL011: internal firewall opened to the whole org.
+ *
+ * `same-org` lets every workload in every GVC reach this one, which crosses the
+ * boundary a GVC exists to draw. `same-gvc` and `workload-list` cover almost
+ * every real case, and `workload-list` works cross-GVC when that is genuinely
+ * needed.
+ */
+export const internalFirewallScopeCheck: PostSynthCheck = {
+  id: "CPL011",
+  description: "Internal firewall should not be opened to the entire org",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+      const allowType = readString(entity, "spec", "firewallConfig", "internal", "inboundAllowType");
+      if (allowType !== "same-org") continue;
+
+      diagnostics.push({
+        checkId: "CPL011",
+        severity: "warning",
+        message:
+          `Workload "${name}" sets internal inboundAllowType "same-org", so every workload in the org — ` +
+          `including other GVCs — can reach it. Prefer "same-gvc", or "workload-list" with the specific ` +
+          `workloads (which also works across GVCs).`,
+        entity: name,
+        lexicon: "cpln",
+      });
+    }
+
+    return diagnostics;
+  },
+};