@intentius/chant-lexicon-cpln 0.53.0

package/dist/integrity.json

@@ -0,0 +1,35 @@
+{
+  "algorithm": "sha256",
+  "artifacts": {
+    "manifest.json": "bca10ad638e0196276b9df8ddc45e7d750cf2fb02ffcc492a891dada505a430c",
+    "meta.json": "02d6ffd90dc3c6f67cd71fdbefcaabbaf7d406f9b1e184eba58f11eef74c2dcb",
+    "types/index.d.ts": "1a5488dcdbb9291e49be14849654267996fc177c384da89e057036b7c947ebbb",
+    "rules/cpl001-no-secret-literals.ts": "c79b537f78dbd26893bd801b3e5c5f30d7326c8c6816a6fd82fb885796f86c61",
+    "rules/cpl002-prefer-resource-reference.ts": "b26b6eb759c1375645e5ed3c4be646bc8b1c459f523f142a8ac782742f4a642e",
+    "rules/cpl010-unrestricted-outbound.ts": "e84ed48216b1d07dce72a7c727f52763001af0fdc2c93614fb615ea5fdfcfec6",
+    "rules/cpl011-internal-firewall-scope.ts": "4685f3e5e584e4475282d1d1f1dd91d3b05447007602b61b498168e346498c5e",
+    "rules/cpl012-no-literal-credential-env.ts": "162c6bd1396337e408cda69b0b1956c734bfa344efe63c952cded7b141539a59",
+    "rules/cpl013-qualified-identity-principal.ts": "785f29831229c3ed1415d292c98f449a920e0d832f07c75763fbc92084e68222",
+    "rules/cpl014-qualified-secret-ref.ts": "cc709354cfb20c865bdd712e950c40555935628132974d0386c106691861a2b1",
+    "rules/cpl020-serverless-single-port.ts": "565f0ecd7974c10bed3dcf46e1ddc5e57f91ee7333805be0b545d01d7ba72401",
+    "rules/cpl021-cron-job-shape.ts": "d81a5272c4e0790eec150102c3f252edd7e0f04da44ec700ebdc670654e35d9b",
+    "rules/cpl022-container-ports.ts": "9567ef8e08625d3b4c66f4ed58d495c8699906dbe06c780d09970d9036f28217",
+    "rules/cpl023-container-resources.ts": "ee97db093285f45a3a52a6031febbf868bc604aa32176a160ee0def4d410cc30",
+    "rules/cpl024-probe-handler.ts": "aab64d67fb9fb65045d990a546448aaf6debc56866a9ebf7c43101cd070b9b27",
+    "rules/cpl025-autoscaling-shape.ts": "a39863c10fbe55d9b89c8fe28db39773332a97327bbb6b448fa75785f150b18c",
+    "rules/cpl026-scale-to-zero.ts": "a1c6ae957047d4d9a5c6ce0af4129bb3bfc50725004a5bdfaecc0a67270a5baf",
+    "rules/cpl027-capacity-ai-conflict.ts": "c2f52a0ed873ce777409f6f2fb60ff1de1e959710721edd62556822e4562f429",
+    "rules/cpl028-volume-set.ts": "641f7f664f358c9a759f0f279eeb18b8fd64c17ba2d21d8beb97eca15425b9d3",
+    "rules/cpl029-link-targets.ts": "26a64903a9f25d0a89bb84133a1c43b35273121225e708033feb42ef46c144cc",
+    "rules/cpl030-domain-routing.ts": "18ec147f4948bd708dd6d055eef84097376e2647a3d34217b9da4f877cb4f729",
+    "rules/cpl040-pinned-image.ts": "68f91691635dbe399e6a747393cd61a39e21a346cb0ab443ba9e6f3c1d495f93",
+    "rules/cpl041-image-reference-form.ts": "37ee6788b896239a3381250ff371bb21e8a5fc1488ec8033cb90f3550b4eebbb",
+    "rules/cpl042-gvc-placement.ts": "eb49773f299e61994ae85df7414bcdd632dba51706af29dde5f7bba695d1ba5c",
+    "rules/cpl043-policy-scope.ts": "8abe174a7ea79e828b9754b9ec6b850e5326f9bec13ea4daf2462f5852e1822e",
+    "rules/helpers.ts": "00a50fc85886b93dc3a3038f766860083c5d4523c39a6d1770a2064e96f62d8f",
+    "skills/chant-cpln.md": "4d69996e9525b5032937a955de25c2afa73938b6336cc186b68bb8e7c661709a",
+    "skills/chant-cpln-workloads.md": "8353909ff18f244f4d4389e74b8d95b04359e97a46ddacb18d669d41d62b6080",
+    "skills/chant-cpln-secrets.md": "8628c2286a7e8e14aa78224fe22ff266dc54b996f4fdb64002fa433213de13a0"
+  },
+  "composite": "797cd0dcabcb03a6d312162b315e918601558fbeba01e2ba24efab2042167b6f"
+}

package/dist/kinds.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The Control Plane kinds this lexicon models, and the facts about each that
+ * more than one subsystem needs.
+ *
+ * Codegen, the serializer, observation, the LSP providers, the MCP catalog and
+ * the docs generator all need to agree on the same three things: which schema
+ * in the OpenAPI document backs a kind, what its chant type name is, and
+ * whether it is scoped to a GVC. Each of those was, in an earlier draft, a
+ * literal repeated in five files — so a kind added in one place quietly went
+ * missing from the others. This table is the single place a kind is declared.
+ *
+ * Coverage is deliberately the *workload* surface rather than every kind the
+ * API exposes. The org-administration kinds (`group`, `serviceaccount`,
+ * `cloudaccount`, `auditctx`, `user`, `agent`) and `mk8s` are all modellable
+ * from the same spec by adding rows here; they are out of the first pass, not
+ * out of reach. `chant cpln coverage` reports the gap rather than hiding it.
+ */
+/** The chant namespace segment for every generated cpln type. */
+export declare const NAMESPACE = "Cpln";
+/** The single service segment. The Control Plane Core API is one service. */
+export declare const SERVICE = "Core";
+export interface CplnKind {
+    /**
+     * The `kind` discriminator as it appears in a `cpln apply` manifest and in
+     * the API's own responses. Also the REST collection segment — the API is
+     * uniform that way, so `/org/{org}/{kind}` is the org-scoped collection and
+     * `/org/{org}/gvc/{gvc}/{kind}` the GVC-scoped one.
+     */
+    kind: string;
+    /** The schema name in `components.schemas` backing this kind. */
+    schema: string;
+    /** The chant type name, e.g. `Cpln::Core::Workload`. */
+    typeName: string;
+    /** The generated TypeScript class name, e.g. `Workload`. */
+    className: string;
+    /**
+     * Whether the kind lives inside a GVC. GVC-scoped kinds get a synthetic
+     * `gvc` property — see `SYNTHETIC_GVC_PROP` in `spec/parse.ts` for why the
+     * spec cannot supply it.
+     */
+    gvcScoped: boolean;
+    /** One-line summary, used for LSP hover, MCP catalog entries and docs. */
+    summary: string;
+}
+export declare const KINDS: CplnKind[];
+/** Every modelled kind string, in declaration order. */
+export declare const KIND_NAMES: string[];
+/** Look up a kind by its `kind` discriminator (`"workload"`). */
+export declare function kindByName(kind: string): CplnKind | undefined;
+/** Look up a kind by chant type name (`"Cpln::Core::Workload"`). */
+export declare function kindByTypeName(typeName: string): CplnKind | undefined;
+/** Look up a kind by generated class name (`"Workload"`). */
+export declare function kindByClassName(className: string): CplnKind | undefined;
+/** Whether a chant type name belongs to a modelled cpln resource (not a property type). */
+export declare function isCplnResourceType(typeName: string): boolean;
+/**
+ * The REST collection path for a kind, relative to the API root.
+ *
+ * GVC-scoped kinds have two: the writable collection nested under their GVC,
+ * and an org-wide read-only rollup. Observation uses the rollup (one request
+ * per kind instead of one per GVC); apply uses the nested one.
+ */
+export declare function collectionPath(kind: CplnKind, org: string, gvc?: string): string;
+/** The path of a single named resource. */
+export declare function resourcePath(kind: CplnKind, org: string, name: string, gvc?: string): string;
+/** Extract the short name from a chant type name: `Cpln::Core::Workload` → `Workload`. */
+export declare function cplnShortName(typeName: string): string;
+/** Extract the service segment: `Cpln::Core::Workload` → `Core`. */
+export declare function cplnServiceName(typeName: string): string;
+//# sourceMappingURL=kinds.d.ts.map

package/dist/kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kinds.d.ts","sourceRoot":"","sources":["../src/kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,SAAS,SAAS,CAAC;AAEhC,6EAA6E;AAC7E,eAAO,MAAM,OAAO,SAAS,CAAC;AAE9B,MAAM,WAAW,QAAQ;IACvB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,KAAK,EAAE,QAAQ,EAoE3B,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,UAAU,EAAE,MAAM,EAA6B,CAAC;AAM7D,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAE7D;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAErE;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEvE;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED,2CAA2C;AAC3C,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGxD"}

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The cpln lexicon's `chant audit` catalog — metadata for every CPL check.
+ *
+ * Every entry carries `yamlBased: false`. That is not an oversight: all of
+ * cpln's checks read the chant model (`ctx.entities`) rather than the emitted
+ * manifests (`ctx.outputs`), because the facts they need — which GVC a workload
+ * is placed in, which volume set a mount names, whether a policy principal is
+ * GVC-qualified — are relationships between declared resources rather than text
+ * in one document. They fire on `chant build` and cannot fire on an audit of
+ * standalone cpln YAML. `auditRule()` hardcodes `yamlBased: true`, so these are
+ * constructed directly.
+ *
+ * A test asserts this catalog covers every check the plugin registers, so a
+ * check added without an entry here fails the build rather than contributing
+ * nothing to `chant audit` silently.
+ */
+import type { RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const cplnAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAsD1E,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA8JrD,CAAC"}

package/dist/lint/post-synth/cpl010-unrestricted-outbound.d.ts

@@ -0,0 +1,12 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL010: a workload that may call out to the entire internet.
+ *
+ * Inbound `0.0.0.0/0` is how a public service is *supposed* to be written, so
+ * it is not flagged. Outbound `0.0.0.0/0` is different: it is rarely required,
+ * it is the egress path for anything that gets a foothold in the container,
+ * and Control Plane supports hostname rules (with wildcards) precisely so it
+ * does not have to be all-or-nothing.
+ */
+export declare const unrestrictedOutboundCheck: PostSynthCheck;
+//# sourceMappingURL=cpl010-unrestricted-outbound.d.ts.map

package/dist/lint/post-synth/cpl010-unrestricted-outbound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl010-unrestricted-outbound.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl010-unrestricted-outbound.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAM9G;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,EAAE,cAyBvC,CAAC"}

package/dist/lint/post-synth/cpl011-internal-firewall-scope.d.ts

@@ -0,0 +1,11 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL011: internal firewall opened to the whole org.
+ *
+ * `same-org` lets every workload in every GVC reach this one, which crosses the
+ * boundary a GVC exists to draw. `same-gvc` and `workload-list` cover almost
+ * every real case, and `workload-list` works cross-GVC when that is genuinely
+ * needed.
+ */
+export declare const internalFirewallScopeCheck: PostSynthCheck;
+//# sourceMappingURL=cpl011-internal-firewall-scope.d.ts.map

package/dist/lint/post-synth/cpl011-internal-firewall-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl011-internal-firewall-scope.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl011-internal-firewall-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,cAyBxC,CAAC"}

package/dist/lint/post-synth/cpl012-no-literal-credential-env.d.ts

@@ -0,0 +1,11 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL012: a credential-shaped env var carrying a literal value.
+ *
+ * The alternative is one string change — `cpln://secret/db.password` — so a
+ * literal here is almost always an oversight rather than a decision. Env values
+ * end up in the workload spec, which is readable by anyone with `get` on the
+ * workload, and in every diff of the manifest.
+ */
+export declare const noLiteralCredentialEnvCheck: PostSynthCheck;
+//# sourceMappingURL=cpl012-no-literal-credential-env.d.ts.map

package/dist/lint/post-synth/cpl012-no-literal-credential-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl012-no-literal-credential-env.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl012-no-literal-credential-env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAgB9G;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,cAiCzC,CAAC"}

package/dist/lint/post-synth/cpl013-qualified-identity-principal.d.ts

@@ -0,0 +1,11 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL013: an identity principal link that Control Plane will ignore.
+ *
+ * `//identity/NAME` is accepted by the policy API and then has no effect. Only
+ * the GVC-qualified `//gvc/GVC/identity/NAME` grants anything. Nothing reports
+ * this — the policy exists, the binding exists, and the permission is simply
+ * never granted.
+ */
+export declare const qualifiedIdentityPrincipalCheck: PostSynthCheck;
+//# sourceMappingURL=cpl013-qualified-identity-principal.d.ts.map

package/dist/lint/post-synth/cpl013-qualified-identity-principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl013-qualified-identity-principal.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl013-qualified-identity-principal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAE,cAgC7C,CAAC"}

package/dist/lint/post-synth/cpl014-qualified-secret-ref.d.ts

@@ -0,0 +1,14 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL014: a secret reference with no field qualifier.
+ *
+ * `cpln://secret/db` resolves to nothing for every secret type except `gcp`,
+ * which is conventionally mounted as a whole JSON file. The field name is not
+ * optional: `opaque` needs `.payload`, `userpass` needs `.username`/`.password`,
+ * `tls` needs `.cert`/`.key`, and a `dictionary` needs one of its keys.
+ *
+ * Volume mounts are exempt — mounting a secret as a directory is the documented
+ * way to consume a `dictionary` or a `gcp` credential file.
+ */
+export declare const qualifiedSecretRefCheck: PostSynthCheck;
+//# sourceMappingURL=cpl014-qualified-secret-ref.d.ts.map

package/dist/lint/post-synth/cpl014-qualified-secret-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl014-qualified-secret-ref.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl014-qualified-secret-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAO9G;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAmCrC,CAAC"}

package/dist/lint/post-synth/cpl020-serverless-single-port.d.ts

@@ -0,0 +1,10 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL020: a serverless workload must expose exactly one HTTP port.
+ *
+ * Not "at least one" and not "any number" — exactly one, and it must be HTTP.
+ * Zero is the more common mistake and the more confusing one, because the
+ * workload deploys and reports healthy while serving nothing.
+ */
+export declare const serverlessSinglePortCheck: PostSynthCheck;
+//# sourceMappingURL=cpl020-serverless-single-port.d.ts.map

package/dist/lint/post-synth/cpl020-serverless-single-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl020-serverless-single-port.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl020-serverless-single-port.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,cA8CvC,CAAC"}

package/dist/lint/post-synth/cpl021-cron-job-shape.d.ts

@@ -0,0 +1,11 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL021: a cron workload needs a schedule and must expose no ports.
+ *
+ * Cron cannot serve traffic, so a port on one is always a misunderstanding —
+ * usually a workload converted from serverless with the ports left behind. A
+ * missing `spec.job.schedule` is the other half: `spec.job` is *required* for
+ * cron and forbidden for every other type.
+ */
+export declare const cronJobShapeCheck: PostSynthCheck;
+//# sourceMappingURL=cpl021-cron-job-shape.d.ts.map

package/dist/lint/post-synth/cpl021-cron-job-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl021-cron-job-shape.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl021-cron-job-shape.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,cAmD/B,CAAC"}

package/dist/lint/post-synth/cpl022-container-ports.d.ts

@@ -0,0 +1,10 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL022: `port` and `ports` are mutually exclusive, and port numbers must be
+ * unique across every container in a workload.
+ *
+ * The duplicate case is the one worth catching: two containers each binding
+ * 8080 is accepted at author time, rejected at apply, and reads as correct.
+ */
+export declare const containerPortsCheck: PostSynthCheck;
+//# sourceMappingURL=cpl022-container-ports.d.ts.map

package/dist/lint/post-synth/cpl022-container-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl022-container-ports.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl022-container-ports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,cAoDjC,CAAC"}

package/dist/lint/post-synth/cpl023-container-resources.d.ts

@@ -0,0 +1,12 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL023: CPU and memory floors, and the memory-to-CPU ratio.
+ *
+ * The ratio is the non-obvious one. `memory(MiB) / cpu(millicores)` must be
+ * ≤ 8, so `2Gi` of memory needs at least 256 millicores of CPU — a workload
+ * asking for lots of memory and a little CPU is rejected, which surprises
+ * people coming from Kubernetes where the two are independent. The
+ * `cpln/relaxMemoryToCpuRatio` tag raises the ceiling to 32.
+ */
+export declare const containerResourcesCheck: PostSynthCheck;
+//# sourceMappingURL=cpl023-container-resources.d.ts.map

package/dist/lint/post-synth/cpl023-container-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl023-container-resources.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl023-container-resources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAY9G;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAiErC,CAAC"}

package/dist/lint/post-synth/cpl024-probe-handler.d.ts

@@ -0,0 +1,10 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL024: a probe must set exactly one handler.
+ *
+ * Zero is the interesting case: a `readinessProbe` with only
+ * `initialDelaySeconds` and `periodSeconds` set looks configured and probes
+ * nothing.
+ */
+export declare const probeHandlerCheck: PostSynthCheck;
+//# sourceMappingURL=cpl024-probe-handler.d.ts.map

package/dist/lint/post-synth/cpl024-probe-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl024-probe-handler.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl024-probe-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAO9G;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,cAoC/B,CAAC"}

package/dist/lint/post-synth/cpl025-autoscaling-shape.d.ts

@@ -0,0 +1,11 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL025: mutually exclusive autoscaling fields, and the `target` ceiling.
+ *
+ * `metric` and `multi` are alternatives, not layers; `target` belongs to the
+ * single-metric form and is rejected alongside `multi`; and with cpu or memory
+ * as the metric, `target` is a utilization percentage, so above 100 it is not
+ * an aggressive setting but an invalid one.
+ */
+export declare const autoscalingShapeCheck: PostSynthCheck;
+//# sourceMappingURL=cpl025-autoscaling-shape.d.ts.map

package/dist/lint/post-synth/cpl025-autoscaling-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl025-autoscaling-shape.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl025-autoscaling-shape.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAW9G;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAgFnC,CAAC"}

package/dist/lint/post-synth/cpl026-scale-to-zero.d.ts

@@ -0,0 +1,11 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL026: scale-to-zero that will not happen.
+ *
+ * `minScale: 0` is accepted on any workload type. It only *takes effect* for
+ * serverless with `rps` or `concurrency`, or for standard/stateful under KEDA.
+ * Everywhere else the workload holds at one replica and the cost saving that
+ * motivated the setting never arrives — with nothing reported.
+ */
+export declare const scaleToZeroCheck: PostSynthCheck;
+//# sourceMappingURL=cpl026-scale-to-zero.d.ts.map

package/dist/lint/post-synth/cpl026-scale-to-zero.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl026-scale-to-zero.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl026-scale-to-zero.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAW9G;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,cA+C9B,CAAC"}

package/dist/lint/post-synth/cpl027-capacity-ai-conflict.d.ts

@@ -0,0 +1,13 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL027: Capacity AI combined with something it excludes.
+ *
+ * Capacity AI resizes CPU and memory from observed usage, and it is **on by
+ * default** for serverless, standard and cron — so these conflicts are usually
+ * reached by adding CPU autoscaling or a GPU to a workload that never opted
+ * into Capacity AI in the first place. Each conflict has the same root: the
+ * other feature needs a stable resource baseline that Capacity AI is actively
+ * moving.
+ */
+export declare const capacityAiConflictCheck: PostSynthCheck;
+//# sourceMappingURL=cpl027-capacity-ai-conflict.d.ts.map

package/dist/lint/post-synth/cpl027-capacity-ai-conflict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl027-capacity-ai-conflict.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl027-capacity-ai-conflict.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,cA+DrC,CAAC"}

package/dist/lint/post-synth/cpl028-volume-set.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const volumeSetCheck: PostSynthCheck;
+//# sourceMappingURL=cpl028-volume-set.d.ts.map

package/dist/lint/post-synth/cpl028-volume-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl028-volume-set.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl028-volume-set.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAqB9G,eAAO,MAAM,cAAc,EAAE,cA2J5B,CAAC"}

package/dist/lint/post-synth/cpl029-link-targets.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const linkTargetsCheck: PostSynthCheck;
+//# sourceMappingURL=cpl029-link-targets.d.ts.map

package/dist/lint/post-synth/cpl029-link-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl029-link-targets.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl029-link-targets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AA4D9G,eAAO,MAAM,gBAAgB,EAAE,cA8F9B,CAAC"}

package/dist/lint/post-synth/cpl030-domain-routing.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const domainRoutingCheck: PostSynthCheck;
+//# sourceMappingURL=cpl030-domain-routing.d.ts.map

package/dist/lint/post-synth/cpl030-domain-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl030-domain-routing.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl030-domain-routing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAS9G,eAAO,MAAM,kBAAkB,EAAE,cA+HhC,CAAC"}

package/dist/lint/post-synth/cpl040-pinned-image.d.ts

@@ -0,0 +1,11 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL040: an image reference that is not pinned.
+ *
+ * `:latest`, or no tag at all (which *means* `:latest`), makes what runs a
+ * function of when the workload last happened to pull. On a serverless
+ * workload that scales to zero and cold-starts, that can be several times a
+ * day, so two replicas of "the same" deploy can be different builds.
+ */
+export declare const pinnedImageCheck: PostSynthCheck;
+//# sourceMappingURL=cpl040-pinned-image.d.ts.map

package/dist/lint/post-synth/cpl040-pinned-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl040-pinned-image.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl040-pinned-image.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAO9G;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,cAgC9B,CAAC"}

package/dist/lint/post-synth/cpl041-image-reference-form.d.ts

@@ -0,0 +1,12 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL041: registry prefixes Control Plane does not want in a workload spec.
+ *
+ * Two documented traps. `docker.io/` must never be added to a public image —
+ * the exact string `nginx:latest` works and `docker.io/library/nginx:latest`
+ * does not. And `<org>.registry.cpln.io/…` is the hostname for `docker login`
+ * and `docker push` only; inside a workload spec the org's own images are
+ * addressed as `//image/NAME:TAG`.
+ */
+export declare const imageReferenceFormCheck: PostSynthCheck;
+//# sourceMappingURL=cpl041-image-reference-form.d.ts.map

package/dist/lint/post-synth/cpl041-image-reference-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl041-image-reference-form.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl041-image-reference-form.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cA8CrC,CAAC"}

package/dist/lint/post-synth/cpl042-gvc-placement.d.ts

@@ -0,0 +1,10 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL042: a GVC with nowhere to run.
+ *
+ * Placement is a GVC-level decision, and a GVC with neither `locationLinks` nor
+ * a `locationQuery` accepts workloads and schedules them nowhere. The workloads
+ * apply cleanly and never become ready.
+ */
+export declare const gvcPlacementCheck: PostSynthCheck;
+//# sourceMappingURL=cpl042-gvc-placement.d.ts.map

package/dist/lint/post-synth/cpl042-gvc-placement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl042-gvc-placement.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl042-gvc-placement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAO9G;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,cA0C/B,CAAC"}

package/dist/lint/post-synth/cpl043-policy-scope.d.ts

@@ -0,0 +1,16 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/**
+ * CPL043: policy target and scope hygiene.
+ *
+ * Three separate ways to write a policy that applies to nothing:
+ *
+ * - `targetKind` naming a kind that cannot be a policy target. `ipset` and
+ *   `mk8s` are governed through their parent, so a policy against them is
+ *   accepted and inert.
+ * - More than one of `target`, `targetLinks`, `targetQuery`, which are three
+ *   alternative ways of saying the same thing.
+ * - Setting `origin` by hand. The system sets it; a user-created policy is
+ *   `default` and `builtin` policies cannot be modified at all.
+ */
+export declare const policyScopeCheck: PostSynthCheck;
+//# sourceMappingURL=cpl043-policy-scope.d.ts.map

package/dist/lint/post-synth/cpl043-policy-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl043-policy-scope.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/cpl043-policy-scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAO9G;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,EAAE,cA8F9B,CAAC"}

package/dist/lint/post-synth/helpers.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared reading and parsing for the CPL post-synth checks.
+ *
+ * Each check lives in its own file named for its id, so `CPL027` is greppable
+ * to one place. What they have in common lands here rather than being repeated
+ * or, worse, drifting: the workload-type default, the port enumeration that has
+ * to span both `port` and `ports`, and the quantity parsers.
+ *
+ * Named `helpers.ts` deliberately — the completeness checker's post-synth count
+ * excludes that filename, so a support module is not miscounted as a check.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+export declare const WORKLOAD: string;
+export declare const GVC: string;
+export declare const POLICY: string;
+export declare const DOMAIN: string;
+export declare const VOLUMESET: string;
+/** Control Plane defaults an unset workload type to `serverless`. */
+export declare function workloadType(entity: unknown): string;
+/** The autoscaling block from `defaultOptions`. */
+export declare function autoscalingOf(entity: unknown): unknown;
+/** Every port a workload's containers expose, across both `port` and `ports`. */
+export declare function exposedPorts(entity: unknown): number[];
+/** Parse a CPU quantity (`"50m"`, `"1"`, `"1.5"`) to millicores. */
+export declare function parseCpuMillicores(value: string | undefined): number | undefined;
+/** Parse a memory quantity (`"128Mi"`, `"1Gi"`, `"512M"`) to MiB. */
+export declare function parseMemoryMib(value: string | undefined): number | undefined;
+/**
+ * The tag of an image reference, or undefined when untagged.
+ *
+ * A colon in a registry host's port (`registry:5000/app`) is not a tag, so only
+ * a colon after the last slash counts.
+ */
+export declare function imageTag(image: string): string | undefined;
+export interface ParsedLink {
+    kind: string;
+    name: string;
+    gvc?: string;
+}
+/** Parse a Control Plane link, or return undefined if it is not one. */
+export declare function parseLink(value: string): ParsedLink | undefined;
+/** Iterate entities of one type. Re-exported so checks import one module. */
+export { entitiesOfType } from "../../entity-props.js";
+export type { Declarable };
+//# sourceMappingURL=helpers.d.ts.map

package/dist/lint/post-synth/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAI9D,eAAO,MAAM,QAAQ,QAAmC,CAAC;AACzD,eAAO,MAAM,GAAG,QAA8B,CAAC;AAC/C,eAAO,MAAM,MAAM,QAAiC,CAAC;AACrD,eAAO,MAAM,MAAM,QAAiC,CAAC;AACrD,eAAO,MAAM,SAAS,QAAoC,CAAC;AAE3D,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,mDAAmD;AACnD,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAEtD;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,CAWtD;AAED,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMhF;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAmB5E;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI1D;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAOD,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAQ/D;AAED,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,CAAC"}

package/dist/lint/post-synth/index.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const postSynthChecks: PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/post-synth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAsBvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAqB3C,CAAC"}

package/dist/lint/rules/cpl001-no-secret-literals.d.ts

@@ -0,0 +1,3 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const noSecretLiteralsRule: LintRule;
+//# sourceMappingURL=cpl001-no-secret-literals.d.ts.map

package/dist/lint/rules/cpl001-no-secret-literals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl001-no-secret-literals.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/cpl001-no-secret-literals.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAsCxF,eAAO,MAAM,oBAAoB,EAAE,QA2ClC,CAAC"}

package/dist/lint/rules/cpl002-prefer-resource-reference.d.ts

@@ -0,0 +1,3 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+export declare const preferResourceReferenceRule: LintRule;
+//# sourceMappingURL=cpl002-prefer-resource-reference.d.ts.map

package/dist/lint/rules/cpl002-prefer-resource-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpl002-prefer-resource-reference.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/cpl002-prefer-resource-reference.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AA0BxF,eAAO,MAAM,2BAA2B,EAAE,QA2CzC,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -0,0 +1,6 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+export { noSecretLiteralsRule } from "./cpl001-no-secret-literals.js";
+export { preferResourceReferenceRule } from "./cpl002-prefer-resource-reference.js";
+/** All source-level lint rules provided by this lexicon (imported by plugin.ts). */
+export declare const rules: LintRule[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAI3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAEjF,oFAAoF;AACpF,eAAO,MAAM,KAAK,EAAE,QAAQ,EAAwD,CAAC"}

package/dist/lsp/completions.d.ts

@@ -0,0 +1,7 @@
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+/**
+ * LSP completions for cpln resources — class names after `new `, property
+ * names inside a constructor.
+ */
+export declare function completions(ctx: CompletionContext): CompletionItem[];
+//# sourceMappingURL=completions.d.ts.map

package/dist/lsp/completions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAmBpF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEpE"}

package/dist/lsp/hover.d.ts

@@ -0,0 +1,4 @@
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+/** Provide LSP hover information for cpln resources. */
+export declare function hover(ctx: HoverContext): HoverInfo | undefined;
+//# sourceMappingURL=hover.d.ts.map

package/dist/lsp/hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AA6H1E,wDAAwD;AACxD,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}

package/dist/manifest.json

@@ -0,0 +1,6 @@
+{
+  "name": "cpln",
+  "version": "0.53.0",
+  "chantVersion": ">=0.1.0",
+  "namespace": "Cpln"
+}