@intentius/chant-lexicon-render 0.124.30 → 0.124.32

package/dist/lint/post-synth/ren012-free-plan-cannot-scale.js

@@ -0,0 +1,41 @@
+/**
+ * REN012: The free instance type cannot scale.
+ *
+ * Render's `free` plan runs a single instance and cannot autoscale; a
+ * `numInstances > 1` or an enabled `autoscaling` block on a free service is
+ * rejected at create/patch time. Persistent disks are also unavailable on
+ * free. Catch all three at synth time with a message that says which.
+ */
+import { readProps, isService, kindOf } from "./render-helpers.js";
+export const ren012 = {
+    id: "REN012",
+    description: "A free-plan service cannot set numInstances > 1, autoscaling, or a disk",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of ctx.entities) {
+            if (!isService(entity))
+                continue;
+            const details = readProps(readProps(entity).serviceDetails);
+            if (details.plan !== "free")
+                continue;
+            const problems = [];
+            if (typeof details.numInstances === "number" && details.numInstances > 1)
+                problems.push(`numInstances: ${details.numInstances}`);
+            const autoscaling = readProps(details.autoscaling);
+            if (autoscaling.enabled === true)
+                problems.push("autoscaling");
+            if (details.disk !== undefined)
+                problems.push("a disk");
+            if (problems.length > 0) {
+                diagnostics.push({
+                    checkId: "REN012",
+                    severity: "error",
+                    message: `${kindOf(entity)} "${name}" is on the free plan but sets ${problems.join(", ")} — the free instance type runs one instance, cannot autoscale, and has no persistent disk; pick a paid plan (starter or above)`,
+                    entity: name,
+                    lexicon: "render",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/render-helpers.js

@@ -0,0 +1,34 @@
+/**
+ * Shared helpers for the render post-synth checks. Not a check itself, so the
+ * generated barrel skips it (the scanner only picks up exported PostSynthChecks).
+ */
+import { isServiceEntityType } from "../../catalog.js";
+/**
+ * Read an entity or property's constructor props. Nested Declarables
+ * (WebServiceDetails, Image, ServiceDisk) stash their args under a
+ * non-enumerable `props`; a plain inline object carries them directly. Handle
+ * both so a check behaves the same whether the user authored
+ * `serviceDetails: { runtime }` or `serviceDetails: new WebServiceDetails({ runtime })`.
+ */
+export function readProps(value) {
+    if (value && typeof value === "object") {
+        const nested = value.props;
+        if (nested && typeof nested === "object")
+            return nested;
+        return value;
+    }
+    return {};
+}
+/** The entityType of a declarable, or undefined. */
+export function entityTypeOf(value) {
+    return value?.entityType;
+}
+/** True when the entity is one of the five service kinds. */
+export function isService(value) {
+    return isServiceEntityType(entityTypeOf(value));
+}
+/** The short kind (`WebService`) from an entity type, for messages. */
+export function kindOf(value) {
+    const t = entityTypeOf(value) ?? "";
+    return t.slice(t.lastIndexOf("::") + 2);
+}

package/dist/lint/rules/index.js

@@ -0,0 +1,8 @@
+import { validRegionRule } from "./valid-region.js";
+import { noSecretLiteralsRule } from "./no-secret-literals.js";
+import { validCronScheduleRule } from "./valid-cron-schedule.js";
+export { validRegionRule } from "./valid-region.js";
+export { noSecretLiteralsRule } from "./no-secret-literals.js";
+export { validCronScheduleRule, isValidCronSchedule } from "./valid-cron-schedule.js";
+/** All lint rules provided by the render lexicon. */
+export const rules = [validRegionRule, noSecretLiteralsRule, validCronScheduleRule];

package/dist/lint/rules/no-secret-literals.js

@@ -0,0 +1,68 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * Env-var keys that carry a credential. Kept conservative on purpose — an
+ * inline value under one of these keys is very likely a real secret.
+ */
+const SECRET_KEY_PATTERN = /(?:^|[_-])(?:password|passwd|secret|token|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|credential|auth[_-]?token)(?:$|[_-])/i;
+/**
+ * Values that are references or placeholders, not literal secrets: shell/
+ * interpolation references ($FOO, ${FOO}) and secret-manager style references.
+ */
+const REFERENCE_VALUE_PATTERN = /^(?:\$\{?[A-Za-z0-9_]+\}?|(?:secret|ref|env|vault):\S+)$/;
+/**
+ * REN002: No secret literals in env vars
+ *
+ * Flags an `envVars` (or `secretFiles`) entry whose `key` looks like a
+ * credential and whose `value` is a plain string literal. Render can generate
+ * the value (`generateValue: true`), it can come from an EnvGroup or from
+ * another resource's attribute (`db.internalConnectionString`), or from the
+ * process environment at build time — anything but a literal in source that
+ * ends up in git and in the build output.
+ */
+export const noSecretLiteralsRule = {
+    id: "REN002",
+    severity: "warning",
+    category: "security",
+    description: "Secret env-var values must not be written inline — use generateValue, an EnvGroup, or a reference",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function literalOf(init) {
+            return ts.isStringLiteral(init) || ts.isNoSubstitutionTemplateLiteral(init) ? init.text : undefined;
+        }
+        function visit(node) {
+            // `{ key: "DB_PASSWORD", value: "hunter2" }` — an object literal with a
+            // secret-looking `key` and a literal `value`.
+            if (ts.isObjectLiteralExpression(node)) {
+                let key;
+                let valueNode;
+                for (const prop of node.properties) {
+                    if (!ts.isPropertyAssignment(prop))
+                        continue;
+                    const name = prop.name.getText(sourceFile).replace(/^["']|["']$/g, "");
+                    if (name === "key")
+                        key = literalOf(prop.initializer);
+                    if (name === "value")
+                        valueNode = prop.initializer;
+                }
+                if (key && valueNode) {
+                    const value = literalOf(valueNode);
+                    if (value !== undefined && value.length >= 4 && SECRET_KEY_PATTERN.test(key) && !REFERENCE_VALUE_PATTERN.test(value.trim())) {
+                        const { line, character } = sourceFile.getLineAndCharacterOfPosition(valueNode.getStart(sourceFile));
+                        diagnostics.push({
+                            file: sourceFile.fileName,
+                            line: line + 1,
+                            column: character + 1,
+                            ruleId: "REN002",
+                            severity: "warning",
+                            message: `Possible inline secret for env var "${key}". Use \`generateValue: true\`, an EnvGroup, a resource attribute (e.g. db.internalConnectionString), or process.env — not a literal.`,
+                        });
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/valid-cron-schedule.js

@@ -0,0 +1,44 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/** One cron field: `*`, a number, a range, a list, or any of those with a `/step`. */
+const FIELD = String.raw `(?:\*|\d+(?:-\d+)?)(?:,(?:\*|\d+(?:-\d+)?))*(?:\/\d+)?`;
+const CRON_5 = new RegExp(`^${FIELD}(?:\\s+${FIELD}){4}$`);
+/** True for a standard five-field cron expression (Render accepts no seconds field or macros). */
+export function isValidCronSchedule(s) {
+    return CRON_5.test(s.trim());
+}
+/**
+ * REN003: Valid cron schedule
+ *
+ * A CronJob's `schedule` must be a standard five-field cron expression
+ * (`minute hour day-of-month month day-of-week`). Render rejects `@hourly`-style
+ * macros and six-field (seconds) expressions at create time; catch them at build.
+ */
+export const validCronScheduleRule = {
+    id: "REN003",
+    severity: "error",
+    category: "correctness",
+    description: "A cron job schedule must be a five-field cron expression",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isPropertyAssignment(node) && node.name.getText(sourceFile) === "schedule") {
+                const init = node.initializer;
+                if (ts.isStringLiteral(init) && !isValidCronSchedule(init.text)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(init.getStart(sourceFile));
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "REN003",
+                        severity: "error",
+                        message: `Invalid cron schedule "${init.text}". Use five fields, e.g. "0 * * * *" (hourly) or "*/15 * * * *" (every 15 minutes); Render accepts no @macros or seconds field.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/valid-region.js

@@ -0,0 +1,43 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * Render's regions, per the `region` enum in the Public API spec. The generated
+ * types already narrow `region` to this union, so a typo is a compile error in
+ * a typed project; this rule gives the same answer with a clearer message, and
+ * fires in contexts the type checker does not reach (a `.js` stack, a value
+ * that has been widened to `string`).
+ */
+export const KNOWN_REGIONS = new Set(["frankfurt", "oregon", "ohio", "singapore", "virginia"]);
+/**
+ * REN001: Valid Render region
+ *
+ * A service, datastore, or Key Value `region` must be a Render region.
+ */
+export const validRegionRule = {
+    id: "REN001",
+    severity: "error",
+    category: "correctness",
+    description: "A region must be a Render region (frankfurt, oregon, ohio, singapore, virginia)",
+    check(context) {
+        const { sourceFile } = context;
+        const diagnostics = [];
+        function visit(node) {
+            if (ts.isPropertyAssignment(node) && node.name.getText(sourceFile) === "region") {
+                const init = node.initializer;
+                if (ts.isStringLiteral(init) && init.text.length > 0 && !KNOWN_REGIONS.has(init.text)) {
+                    const { line, character } = sourceFile.getLineAndCharacterOfPosition(init.getStart(sourceFile));
+                    diagnostics.push({
+                        file: sourceFile.fileName,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "REN001",
+                        severity: "error",
+                        message: `Unknown Render region "${init.text}". Use one of: ${[...KNOWN_REGIONS].join(", ")}.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sourceFile);
+        return diagnostics;
+    },
+};

package/dist/lsp/completions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEpE"}
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAapF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAEpE"}

package/dist/lsp/completions.js

@@ -0,0 +1,20 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconCompletions } from "@intentius/chant/lsp/lexicon-providers";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-render.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide render completions based on context — the resource classes
+ * (WebService, Postgres, EnvGroup, ...) and their property entities, from the
+ * generated registry.
+ */
+export function completions(ctx) {
+    return lexiconCompletions(ctx, getIndex(), "Render resource");
+}

package/dist/lsp/hover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAc1E;;GAEG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAc1E;;GAEG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAE9D"}

package/dist/lsp/hover.js

@@ -0,0 +1,49 @@
+import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
+import { LexiconIndex, lexiconHover } from "@intentius/chant/lsp/lexicon-providers";
+import { CATALOG } from "../catalog.js";
+const require = createRequire(moduleSourceUrl(import.meta.url));
+let cachedIndex = null;
+function getIndex() {
+    if (cachedIndex)
+        return cachedIndex;
+    const data = require("../generated/lexicon-render.json");
+    cachedIndex = new LexiconIndex(data);
+    return cachedIndex;
+}
+/**
+ * Provide hover information for render entity types.
+ */
+export function hover(ctx) {
+    return lexiconHover(ctx, getIndex(), resourceHover);
+}
+function resourceHover(className, entry) {
+    const lines = [];
+    lines.push(`**${className}**`);
+    lines.push("");
+    lines.push(`Render type: \`${entry.resourceType}\``);
+    lines.push("");
+    const cat = CATALOG[entry.resourceType];
+    if (entry.kind === "resource" && cat) {
+        lines.push(`*Resource — created with \`POST ${cat.collection}\` on the Render Public API and reconciled by name*`);
+        if (cat.marked) {
+            lines.push("");
+            lines.push("Carries chant's `CHANT_MANAGED_BY` env-var ownership marker; eligible for owned-only prune.");
+        }
+        else if (cat.boundary === "service") {
+            lines.push("");
+            lines.push("Inherits its parent service's ownership verdict (service boundary); pruned when the service is chant-owned and this is undeclared.");
+        }
+        else {
+            lines.push("");
+            lines.push("No ownership marker channel: verdict is `unknown`; never auto-pruned.");
+        }
+    }
+    else if (entry.kind === "resource") {
+        lines.push("*Resource — a Render Public API object*");
+    }
+    else {
+        lines.push("*Property — a nested value in a Render resource declaration*");
+    }
+    return { contents: lines.join("\n") };
+}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "render",
-  "version": "0.124.30",
+  "version": "0.124.32",
   "chantVersion": ">=0.1.0",
   "namespace": "Render"
 }

package/dist/op/activities/fake-render.js

@@ -0,0 +1,271 @@
+/**
+ * An in-memory stand-in for the Render Public API, for tests. Implements the
+ * slice of routes the applier and the observation seam use — list/create/
+ * patch/delete for every collection in the catalog, service env vars, env
+ * group vars and links, deploys, connection-info, owners — with Render's list
+ * envelope (`[{ service: {...}, cursor }]`) and id prefixes. Not an emulator of
+ * Render's semantics beyond what chant relies on; it exists so the reconcile
+ * loop is tested end to end without an account.
+ */
+export class FakeRender {
+    constructor() {
+        this.owners = [{ id: "tea-1", name: "Acme", email: "ops@acme.test", type: "team" }];
+        this.collections = {
+            "/services": { key: "service", prefix: "srv", items: new Map() },
+            "/postgres": { key: "postgres", prefix: "dpg", items: new Map() },
+            "/key-value": { key: "keyValue", prefix: "red", items: new Map() },
+            "/env-groups": { key: "envGroup", prefix: "evg", items: new Map() },
+            "/projects": { key: "project", prefix: "prj", items: new Map() },
+            "/environments": { key: "environment", prefix: "evm", items: new Map() },
+            "/disks": { key: "disk", prefix: "dsk", items: new Map() },
+            "/registrycredentials": { key: "registryCredential", prefix: "rgc", items: new Map() },
+            "/webhooks": { key: "webhook", prefix: "whk", items: new Map() },
+        };
+        /** serviceId → env vars */
+        this.serviceEnv = new Map();
+        /** serviceId → deploys (newest first) */
+        this.deploys = new Map();
+        /** serviceId → custom domains */
+        this.domains = new Map();
+        /** Every call, for assertions. */
+        this.calls = [];
+        /** Deploys go live after this many polls (0 = immediately). */
+        this.deployPolls = 0;
+        this.counter = 0;
+    }
+    id(prefix) {
+        this.counter++;
+        return `${prefix}-${String(this.counter).padStart(20, "0")}`;
+    }
+    /** Seed a resource directly. */
+    seed(collection, rec) {
+        const c = this.collections[collection];
+        const id = typeof rec.id === "string" ? rec.id : this.id(c.prefix);
+        const full = { id, createdAt: "2026-01-01T00:00:00Z", updatedAt: "2026-01-01T00:00:00Z", ...rec };
+        c.items.set(id, full);
+        if (collection === "/services") {
+            this.serviceEnv.set(id, [...(rec.envVars ?? [])]);
+            this.deploys.set(id, [{ id: this.id("dep"), status: "live" }]);
+        }
+        return full;
+    }
+    service(name) {
+        return [...this.collections["/services"].items.values()].find((s) => s.name === name);
+    }
+    http() {
+        return async (method, url, body) => {
+            const u = new URL(url);
+            const path = u.pathname.replace(/^\/v1/, "");
+            this.calls.push({ method, path, body });
+            return this.route(method, path, u.searchParams, body);
+        };
+    }
+    json(status, value) {
+        return { status, text: value === undefined ? "" : JSON.stringify(value) };
+    }
+    route(method, path, q, body) {
+        const b = (body ?? {});
+        if (path === "/owners" && method === "GET") {
+            return this.json(200, this.owners.map((o) => ({ owner: o, cursor: String(o.id) })));
+        }
+        // Service sub-resources.
+        let m = path.match(/^\/services\/([^/]+)\/env-vars$/);
+        if (m) {
+            const id = m[1];
+            if (!this.collections["/services"].items.has(id))
+                return this.json(404, { message: "not found" });
+            if (method === "GET") {
+                return this.json(200, (this.serviceEnv.get(id) ?? []).map((e) => ({ envVar: e, cursor: e.key })));
+            }
+            if (method === "PUT") {
+                const list = body.map((e) => ({
+                    key: e.key,
+                    value: e.value ?? (e.generateValue ? `gen-${e.key}` : ""),
+                }));
+                this.serviceEnv.set(id, list);
+                return this.json(200, list.map((e) => ({ envVar: e, cursor: e.key })));
+            }
+        }
+        m = path.match(/^\/services\/([^/]+)\/deploys$/);
+        if (m && method === "GET") {
+            const list = this.deploys.get(m[1]) ?? [];
+            return this.json(200, list.map((d) => ({ deploy: this.tickDeploy(d), cursor: d.id })));
+        }
+        m = path.match(/^\/services\/([^/]+)\/deploys\/([^/]+)$/);
+        if (m && method === "GET") {
+            const d = (this.deploys.get(m[1]) ?? []).find((x) => x.id === m[2]);
+            if (!d)
+                return this.json(404, { message: "not found" });
+            return this.json(200, this.tickDeploy(d));
+        }
+        m = path.match(/^\/services\/([^/]+)\/custom-domains$/);
+        if (m) {
+            const id = m[1];
+            if (!this.collections["/services"].items.has(id))
+                return this.json(404, { message: "not found" });
+            const list = this.domains.get(id) ?? [];
+            if (method === "GET")
+                return this.json(200, list.map((d) => ({ customDomain: d, cursor: d.id })));
+            if (method === "POST") {
+                const d = { id: this.id("cd"), name: b.name, domainType: "apex", verificationStatus: "unverified", createdAt: "2026-01-01T00:00:00Z" };
+                list.push(d);
+                this.domains.set(id, list);
+                return this.json(201, [d]);
+            }
+        }
+        m = path.match(/^\/services\/([^/]+)\/custom-domains\/([^/]+)$/);
+        if (m && method === "DELETE") {
+            const list = this.domains.get(m[1]) ?? [];
+            const idx = list.findIndex((d) => d.id === m[2] || d.name === m[2]);
+            if (idx < 0)
+                return this.json(404, {});
+            list.splice(idx, 1);
+            return this.json(204, undefined);
+        }
+        // Datastore connection info.
+        m = path.match(/^\/(postgres|key-value)\/([^/]+)\/connection-info$/);
+        if (m && method === "GET") {
+            const c = this.collections[`/${m[1]}`];
+            const rec = c.items.get(m[2]);
+            if (!rec)
+                return this.json(404, {});
+            return this.json(200, {
+                internalConnectionString: `internal://${rec.name}`,
+                externalConnectionString: `external://${rec.name}`,
+                psqlCommand: `psql ${rec.name}`,
+                cliCommand: `redis-cli ${rec.name}`,
+            });
+        }
+        // Env group vars and links.
+        m = path.match(/^\/env-groups\/([^/]+)\/env-vars\/([^/]+)$/);
+        if (m) {
+            const grp = this.collections["/env-groups"].items.get(m[1]);
+            if (!grp)
+                return this.json(404, {});
+            const vars = grp.envVars ?? [];
+            const key = decodeURIComponent(m[2]);
+            if (method === "PUT") {
+                const value = typeof b.value === "string" ? b.value : `gen-${key}`;
+                const idx = vars.findIndex((v) => v.key === key);
+                if (idx >= 0)
+                    vars[idx] = { key, value };
+                else
+                    vars.push({ key, value });
+                grp.envVars = vars;
+                return this.json(200, { key, value });
+            }
+            if (method === "DELETE") {
+                grp.envVars = vars.filter((v) => v.key !== key);
+                return this.json(204, undefined);
+            }
+        }
+        m = path.match(/^\/env-groups\/([^/]+)\/services\/([^/]+)$/);
+        if (m && method === "POST") {
+            const grp = this.collections["/env-groups"].items.get(m[1]);
+            if (!grp)
+                return this.json(404, {});
+            const links = grp.serviceLinks ?? [];
+            if (!links.some((l) => l.id === m[2]))
+                links.push({ id: m[2], name: m[2], type: "web_service" });
+            grp.serviceLinks = links;
+            return this.json(200, grp);
+        }
+        // Collections.
+        for (const [collection, c] of Object.entries(this.collections)) {
+            if (path === collection) {
+                if (method === "GET") {
+                    let items = [...c.items.values()];
+                    const name = q.get("name");
+                    const ownerId = q.get("ownerId");
+                    const projectId = q.get("projectId");
+                    const serviceId = q.get("serviceId");
+                    if (name)
+                        items = items.filter((i) => i.name === name);
+                    // Disks/domains carry no ownerId field on the wire; Render scopes them
+                    // server-side. The fake has one owner, so only filter what has one.
+                    if (ownerId)
+                        items = items.filter((i) => (i.ownerId === undefined && i.owner === undefined) || i.ownerId === ownerId || i.owner?.id === ownerId);
+                    if (projectId)
+                        items = items.filter((i) => i.projectId === projectId);
+                    if (serviceId)
+                        items = items.filter((i) => i.serviceId === serviceId);
+                    return this.json(200, items.map((i) => ({ [c.key]: i, cursor: String(i.id) })));
+                }
+                if (method === "POST") {
+                    const id = this.id(c.prefix);
+                    const rec = { ...b, id, createdAt: "2026-01-01T00:00:00Z", updatedAt: "2026-01-01T00:00:00Z" };
+                    if (collection === "/services") {
+                        const env = (b.envVars ?? []).map((e) => ({
+                            key: e.key,
+                            value: e.value ?? `gen-${e.key}`,
+                        }));
+                        delete rec.envVars;
+                        delete rec.secretFiles;
+                        rec.dashboardUrl = `https://dashboard.render.com/web/${id}`;
+                        rec.slug = String(b.name);
+                        rec.suspended = "not_suspended";
+                        this.serviceEnv.set(id, env);
+                        const dep = { id: this.id("dep"), status: this.deployPolls > 0 ? "build_in_progress" : "live" };
+                        this.deploys.set(id, [dep]);
+                        c.items.set(id, rec);
+                        return this.json(201, { service: rec, deployId: dep.id });
+                    }
+                    if (collection === "/env-groups") {
+                        rec.envVars = (b.envVars ?? []).map((e) => ({
+                            key: e.key,
+                            value: e.value ?? `gen-${e.key}`,
+                        }));
+                        rec.serviceLinks = (b.serviceIds ?? []).map((sid) => ({ id: sid, name: sid, type: "web_service" }));
+                        delete rec.serviceIds;
+                    }
+                    if (collection === "/projects") {
+                        rec.owner = { id: b.ownerId, name: "Acme", email: "", type: "team" };
+                        rec.environmentIds = [];
+                    }
+                    if (collection === "/postgres" || collection === "/key-value") {
+                        rec.owner = { id: b.ownerId, name: "Acme", email: "", type: "team" };
+                        rec.status = "available";
+                        rec.dashboardUrl = `https://dashboard.render.com/d/${id}`;
+                    }
+                    c.items.set(id, rec);
+                    return this.json(201, rec);
+                }
+            }
+            const one = path.match(new RegExp(`^${collection.replace(/[-/]/g, "\\$&")}/([^/]+)$`));
+            if (one) {
+                const id = one[1];
+                const rec = c.items.get(id);
+                if (!rec)
+                    return this.json(404, { message: "not found" });
+                if (method === "GET")
+                    return this.json(200, rec);
+                if (method === "PATCH") {
+                    const updated = { ...rec, ...b, updatedAt: "2026-01-02T00:00:00Z" };
+                    if (rec.serviceDetails && b.serviceDetails) {
+                        updated.serviceDetails = { ...rec.serviceDetails, ...b.serviceDetails };
+                    }
+                    c.items.set(id, updated);
+                    if (collection === "/services") {
+                        const deps = this.deploys.get(id) ?? [];
+                        deps.unshift({ id: this.id("dep"), status: "live" });
+                    }
+                    return this.json(200, updated);
+                }
+                if (method === "DELETE") {
+                    c.items.delete(id);
+                    return this.json(204, undefined);
+                }
+            }
+        }
+        return this.json(404, { message: `fake-render: no route for ${method} ${path}` });
+    }
+    /** Advance a pending deploy toward `live` on each poll. */
+    tickDeploy(d) {
+        if (d.status !== "live" && this.deployPolls > 0) {
+            this.deployPolls--;
+            if (this.deployPolls === 0)
+                d.status = "live";
+        }
+        return { ...d };
+    }
+}

package/dist/op/activities/index.js

@@ -0,0 +1,8 @@
+/**
+ * render Op activities — resolved by the core activity registry when a
+ * project's `chant.config.ts` lists the `render` lexicon. Contributes the
+ * native Render API applier (`renderApply`), which speaks the Render Public
+ * API directly (no CLI, no Blueprint, no state file), and its teardown twin
+ * (`renderDelete`).
+ */
+export { renderApply, renderApplyDetailed, renderDelete, toApplyResult, resolveEndpoint, parsePlan, orderPlan, collectDependencies, configEqual, diffForPatch, envVarsToMap, declaredEnvVarsToMap, envVarsDiffer, isChantOwned, ownershipOf, planOwnership, inStack, defaultRenderHttp, listAll, getOne, resolveOwner, findExisting, resolveAttribute, resolveMarkers, create, patch, remove, readServiceEnvVars, putServiceEnvVars, reconcileEnvGroupVars, linkEnvGroupServices, latestDeploy, waitForDeploy, DEFAULT_RENDER_BASE_URL, } from "./render-apply.js";