@intentius/chant-lexicon-render 0.124.31 → 0.124.33

package/dist/coverage.js

@@ -0,0 +1,29 @@
+/**
+ * Coverage analysis for the render lexicon — how much of the generated Render
+ * API surface the lexicon's typed resources cover. Thin wrapper over the shared
+ * `computeCoverage`, mirroring the fly/gcp peers.
+ */
+import { existsSync, readFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import { computeCoverage, overallPct, formatSummary, formatVerbose, checkThresholds, } from "@intentius/chant/codegen/coverage";
+export { computeCoverage, overallPct, formatSummary, formatVerbose, checkThresholds };
+/** Run coverage analysis for the render lexicon. */
+export async function analyzeRenderCoverage(opts) {
+    const basePath = opts?.basePath ?? dirname(dirname(fileURLToPath(import.meta.url)));
+    const lexiconPath = join(basePath, "src", "generated", "lexicon-render.json");
+    if (!existsSync(lexiconPath)) {
+        throw new Error(`Generated lexicon not found at ${lexiconPath}. Run "chant dev generate" first.`);
+    }
+    const report = computeCoverage(readFileSync(lexiconPath, "utf-8"));
+    console.error(opts?.verbose ? formatVerbose(report) : formatSummary(report));
+    if (typeof opts?.minOverall === "number") {
+        const result = checkThresholds(report, { minOverallPct: opts.minOverall });
+        if (!result.ok) {
+            for (const v of result.violations)
+                console.error(`  FAIL: ${v}`);
+            throw new Error("Coverage below threshold");
+        }
+    }
+    return report;
+}

package/dist/describe-resources.js

@@ -0,0 +1,325 @@
+/**
+ * Live introspection of Render resources — the read-back seam for chant's
+ * plan/drift machinery.
+ *
+ * The write path (renderApply) already GETs live state to decide
+ * create/update/unchanged and to prune owned orphans. This surfaces that same
+ * read side through the standard `describeResources` seam so core's change set
+ * and `chant lifecycle plan` can see live Render state and classify
+ * create/update/delete/adopt/noop.
+ *
+ * Peer of fly's describe-resources: list what is live, key it by chant entity
+ * name, attach an ownership verdict. Two-tier ownership, matching the applier:
+ *
+ *   - Services and env groups carry the primary marker (`CHANT_MANAGED_BY`,
+ *     RENDER_ENV_OWNERSHIP_KEYS) in their env vars, so their verdict is
+ *     per-resource: `owned` when marked, else `foreign`.
+ *   - Disks and custom domains carry no marker but hang off a service, so
+ *     they inherit the parent's verdict (the service boundary — fly's app
+ *     boundary, one level down); undeclared ones under an owned declared
+ *     service surface as owned orphans.
+ *   - Datastores, projects, environments, registry credentials, and webhooks
+ *     carry no marker channel and no boundary, so their verdict is `unknown`
+ *     — the change set never escalates `unknown` to a delete. When the
+ *     `owned` filter asks for those types, this logs that no verdict is
+ *     available rather than silently returning everything.
+ *
+ * Endpoint + auth reuse the applier verbatim (resolveEndpoint /
+ * RENDER_API_BASE_URL / RENDER_API_KEY), so plan reads the same target
+ * renderApply writes. Undeclared chant-marked services and env groups in the
+ * workspace are also returned (as orphans keyed by `<type>/<name>`), so a
+ * declared-then-removed service shows up as a delete candidate.
+ */
+import { observation, unobservedAll } from "@intentius/chant/observation";
+import { CATALOG, ENTITY_TYPES, ENTITY_TYPE_OF_SERVICE, catalogEntry, isServiceEntityType } from "./catalog.js";
+import { isOwnerMarker, isRefMarker } from "./serializer.js";
+import { resolveEndpoint, defaultRenderHttp, parsePlan, orderPlan, listAll, getOne, readServiceEnvVars, envVarsToMap, isChantOwned, resolveOwner, } from "./op/activities/render-apply.js";
+/** Live service/datastore states that mean "gone or going" — not live. */
+const NOT_LIVE = new Set(["deleted", "deleting"]);
+/** Live resource → chant status string. */
+function statusOf(rec) {
+    if (typeof rec.status === "string")
+        return rec.status; // datastores
+    if (rec.suspended === "suspended")
+        return "suspended";
+    if (typeof rec.verificationStatus === "string")
+        return rec.verificationStatus; // custom domains
+    return "deployed";
+}
+/**
+ * List live Render resources and return them keyed by chant entity name, each
+ * tagged with an ownership verdict the core change set reads to decide whether
+ * an orphan is a delete (owned) or an adopt candidate (foreign). Reused by
+ * `renderPlugin.describeResources`.
+ *
+ * `http` is injectable for tests; the default reuses the applier's fetch client
+ * (bearer token from RENDER_API_KEY).
+ */
+export async function describeResources(options, http = defaultRenderHttp(), signal) {
+    const result = {};
+    const unobserved = {};
+    // Without a readable plan there is nothing to key a read by, so chant never
+    // asks Render anything — every declared entity is unobserved, not absent.
+    if (!options.buildOutput) {
+        return observation(result, unobservedAll(options.entities.keys(), "read-failed", "no render plan in the build output to read back", options.entities));
+    }
+    let plan;
+    try {
+        plan = parsePlan(options.buildOutput);
+    }
+    catch (err) {
+        return observation(result, unobservedAll(options.entities.keys(), "read-failed", `build output is not a readable render plan: ${err instanceof Error ? err.message : String(err)}`, options.entities));
+    }
+    const ctx = { base: resolveEndpoint({ endpoint: options.endpoint }) };
+    const owned = options.owned ?? false;
+    const typeOf = (entityName, fallback) => options.entities.get(entityName)?.entityType ?? fallback;
+    // The workspace: needed to scope every list. Resolved once; a failure here
+    // is a whole-read failure (no credentials / no workspace), reported per entity.
+    let ownerId;
+    try {
+        ownerId = await resolveOwner(ctx, { ownerId: options.ownerId }, http, signal);
+    }
+    catch (err) {
+        return observation(result, unobservedAll(options.entities.keys(), "no-credentials", err instanceof Error ? err.message : String(err), options.entities));
+    }
+    let ordered;
+    try {
+        ordered = orderPlan(plan);
+    }
+    catch (err) {
+        return observation(result, unobservedAll(options.entities.keys(), "read-failed", err instanceof Error ? err.message : String(err), options.entities));
+    }
+    // Live ids by entity, so a child's `{ $ref }` (Disk.serviceId, Environment.
+    // projectId, CustomDomain path) resolves to the parent's live id when the
+    // parent exists. A missing parent means the child cannot exist yet — it is
+    // reported absent, which is exactly the create the plan should propose.
+    const liveId = new Map();
+    // Service verdicts by live id, so a disk/domain can inherit its parent's.
+    const serviceVerdict = new Map();
+    // Declared children by `${serviceId}:${name}`, for the orphan scan.
+    const declaredChildren = new Set();
+    // Declared services and env groups by natural key, so the workspace-wide
+    // marker scan below can tell an orphan from a declared one.
+    const declaredServices = new Set();
+    const declaredGroups = new Set();
+    let loggedUnknown = false;
+    const noteUnknown = () => {
+        if (loggedUnknown || !owned)
+            return;
+        loggedUnknown = true;
+        console.warn("[render] datastores, projects, environments, registry credentials and webhooks carry no ownership marker — their verdict is unknown; --owned withholds them rather than guessing");
+    };
+    for (const [entityName, req] of ordered) {
+        const entry = catalogEntry(req.entityType);
+        if (isServiceEntityType(req.entityType))
+            declaredServices.add(`${req.body.type}:${req.name}`);
+        if (req.entityType === ENTITY_TYPES.envGroup)
+            declaredGroups.add(req.name);
+        // Resolve the path/body references this read depends on.
+        let endpoint = req.endpoint;
+        let unresolved = false;
+        for (const [k, v] of Object.entries(req.pathParams ?? {})) {
+            const id = isRefMarker(v) ? liveId.get(v.$ref) : typeof v === "string" ? v : undefined;
+            if (!id) {
+                unresolved = true;
+                break;
+            }
+            endpoint = endpoint.replace(`{${k}}`, encodeURIComponent(id));
+        }
+        if (unresolved)
+            continue; // parent absent → child absent (in neither map)
+        const query = {};
+        if (entry.filters.name)
+            query.name = req.name;
+        if (entry.filters.ownerId)
+            query.ownerId = typeof req.body.ownerId === "string" && !isOwnerMarker(req.body.ownerId) ? req.body.ownerId : ownerId;
+        let scopeId;
+        if (req.entityType === ENTITY_TYPES.environment) {
+            scopeId = isRefMarker(req.body.projectId) ? liveId.get(req.body.projectId.$ref) : typeof req.body.projectId === "string" ? req.body.projectId : undefined;
+            if (!scopeId)
+                continue;
+            query.projectId = scopeId;
+        }
+        if (req.entityType === ENTITY_TYPES.disk) {
+            scopeId = isRefMarker(req.body.serviceId) ? liveId.get(req.body.serviceId.$ref) : typeof req.body.serviceId === "string" ? req.body.serviceId : undefined;
+            if (!scopeId)
+                continue;
+            query.serviceId = scopeId;
+        }
+        const listPath = req.entityType === ENTITY_TYPES.customDomain ? endpoint : entry.collection;
+        let candidates;
+        try {
+            candidates = await listAll(ctx, listPath, query, entry.listKey, http, signal);
+        }
+        catch (err) {
+            unobserved[entityName] = {
+                type: req.entityType,
+                reason: "read-failed",
+                detail: err instanceof Error ? err.message : String(err),
+                queried: `${ctx.base}${listPath}`,
+            };
+            continue;
+        }
+        const live = candidates.find((c) => {
+            if (c.name !== req.name)
+                return false;
+            if (isServiceEntityType(req.entityType) && c.type !== req.body.type)
+                return false;
+            if (scopeId && req.entityType === ENTITY_TYPES.environment && c.projectId !== scopeId)
+                return false;
+            if (scopeId && req.entityType === ENTITY_TYPES.disk && c.serviceId !== scopeId)
+                return false;
+            return true;
+        });
+        if (!live || (typeof live.status === "string" && NOT_LIVE.has(live.status)))
+            continue; // absent
+        const id = typeof live.id === "string" ? live.id : undefined;
+        if (id)
+            liveId.set(entityName, id);
+        // Ownership verdict: the marker for services and env groups; the parent
+        // service's verdict for disks and custom domains (service boundary);
+        // unknown for the rest.
+        let ownership;
+        if (entry.marked && id) {
+            let env;
+            if (isServiceEntityType(req.entityType)) {
+                env = await readServiceEnvVars(ctx, id, http, signal);
+            }
+            else {
+                const full = (await getOne(ctx, `${entry.collection}/${id}`, http, signal)) ?? live;
+                env = envVarsToMap(full.envVars);
+            }
+            ownership = isChantOwned(env) ? "owned" : "foreign";
+            if (isServiceEntityType(req.entityType))
+                serviceVerdict.set(id, ownership);
+        }
+        else if (entry.boundary === "service") {
+            const raw = req.entityType === ENTITY_TYPES.customDomain ? req.pathParams?.serviceId : req.body.serviceId;
+            const parentId = isRefMarker(raw) ? liveId.get(raw.$ref) : typeof raw === "string" ? raw : undefined;
+            if (parentId)
+                declaredChildren.add(`${parentId}:${req.name}`);
+            let verdict = parentId ? serviceVerdict.get(parentId) : undefined;
+            if (!verdict && parentId) {
+                // Parent named by literal id (not declared here): read its marker.
+                verdict = isChantOwned(await readServiceEnvVars(ctx, parentId, http, signal)) ? "owned" : "foreign";
+                serviceVerdict.set(parentId, verdict);
+            }
+            ownership = verdict ?? "unknown";
+        }
+        else {
+            ownership = "unknown";
+            noteUnknown();
+        }
+        if (owned && ownership !== "owned") {
+            unobserved[entityName] = {
+                type: req.entityType,
+                reason: "filtered",
+                detail: ownership === "foreign"
+                    ? "live resource carries no chant ownership marker and --owned was requested"
+                    : "resource kind has no ownership marker channel and --owned was requested",
+            };
+            continue;
+        }
+        result[entityName] = {
+            type: typeOf(entityName, req.entityType),
+            physicalId: id,
+            status: statusOf(live),
+            lastUpdated: typeof live.updatedAt === "string" ? live.updatedAt : undefined,
+            ownership,
+            attributes: pruneUndefined({
+                id,
+                name: live.name,
+                dashboardUrl: live.dashboardUrl,
+                type: live.type,
+                region: live.serviceDetails?.region ?? live.region,
+                environmentId: live.environmentId,
+                projectId: live.projectId,
+                serviceId: live.serviceId,
+            }),
+        };
+    }
+    // Orphans: chant-marked services and env groups in the workspace that the
+    // plan does not declare — delete candidates for the change set.
+    try {
+        for (const svc of await listAll(ctx, "/services", { ownerId }, "service", http, signal)) {
+            const id = typeof svc.id === "string" ? svc.id : undefined;
+            const name = typeof svc.name === "string" ? svc.name : "";
+            const type = typeof svc.type === "string" ? svc.type : "";
+            if (!id)
+                continue;
+            const declared = declaredServices.has(`${type}:${name}`);
+            const verdict = serviceVerdict.get(id) ?? (isChantOwned(await readServiceEnvVars(ctx, id, http, signal)) ? "owned" : "foreign");
+            if (verdict !== "owned")
+                continue;
+            if (!declared) {
+                const entityType = ENTITY_TYPE_OF_SERVICE[type] ?? ENTITY_TYPES.webService;
+                result[`${CATALOG[entityType].kind}/${name}`] = {
+                    type: entityType,
+                    physicalId: id,
+                    status: statusOf(svc),
+                    lastUpdated: typeof svc.updatedAt === "string" ? svc.updatedAt : undefined,
+                    ownership: "owned",
+                    attributes: pruneUndefined({ id, name, dashboardUrl: svc.dashboardUrl, type }),
+                };
+                continue; // its children go with it
+            }
+            // Service boundary: undeclared disks and custom domains under a declared
+            // owned service are owned orphans too.
+            for (const disk of await listAll(ctx, "/disks", { serviceId: id, ownerId }, "disk", http, signal)) {
+                const diskId = typeof disk.id === "string" ? disk.id : undefined;
+                const diskName = typeof disk.name === "string" ? disk.name : "";
+                if (!diskId || disk.serviceId !== id || declaredChildren.has(`${id}:${diskName}`))
+                    continue;
+                result[`Disk/${diskName}`] = {
+                    type: ENTITY_TYPES.disk,
+                    physicalId: diskId,
+                    status: "deployed",
+                    ownership: "owned",
+                    attributes: pruneUndefined({ id: diskId, name: diskName, serviceId: id, mountPath: disk.mountPath, sizeGB: disk.sizeGB }),
+                };
+            }
+            for (const domain of await listAll(ctx, `/services/${id}/custom-domains`, {}, "customDomain", http, signal)) {
+                const domainId = typeof domain.id === "string" ? domain.id : undefined;
+                const domainName = typeof domain.name === "string" ? domain.name : "";
+                if (!domainId || declaredChildren.has(`${id}:${domainName}`))
+                    continue;
+                result[`CustomDomain/${domainName}`] = {
+                    type: ENTITY_TYPES.customDomain,
+                    physicalId: domainId,
+                    status: statusOf(domain),
+                    ownership: "owned",
+                    attributes: pruneUndefined({ id: domainId, name: domainName, serviceId: id }),
+                };
+            }
+        }
+        for (const grp of await listAll(ctx, "/env-groups", { ownerId }, "envGroup", http, signal)) {
+            const id = typeof grp.id === "string" ? grp.id : undefined;
+            const name = typeof grp.name === "string" ? grp.name : "";
+            if (!id || declaredGroups.has(name))
+                continue;
+            const full = (await getOne(ctx, `/env-groups/${id}`, http, signal)) ?? grp;
+            if (!isChantOwned(envVarsToMap(full.envVars)))
+                continue;
+            result[`EnvGroup/${name}`] = {
+                type: ENTITY_TYPES.envGroup,
+                physicalId: id,
+                status: "deployed",
+                lastUpdated: typeof grp.updatedAt === "string" ? grp.updatedAt : undefined,
+                ownership: "owned",
+                attributes: { id, name },
+            };
+        }
+    }
+    catch (err) {
+        console.warn(`[render] orphan scan failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return observation(result, unobserved);
+}
+function pruneUndefined(obj) {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (v !== undefined)
+            out[k] = v;
+    }
+    return out;
+}

package/dist/detect.js

@@ -0,0 +1,27 @@
+/**
+ * Template detection for the render lexicon.
+ *
+ * `chant import` parses a template file as JSON and asks each installed lexicon
+ * whether it recognizes the shape. render's importable source is the serializer
+ * plan (what `chant build` emits and `renderApply` POSTs): an object keyed by
+ * entity name whose values carry a `Render::…` entityType and a `POST` request.
+ */
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** A single request as the serializer emits it. */
+function isRenderRequest(v) {
+    if (!isRecord(v))
+        return false;
+    return typeof v.entityType === "string" && v.entityType.startsWith("Render::") && typeof v.endpoint === "string" && "body" in v;
+}
+/** The serializer's whole output: entity name → request. */
+export function isSerializerPlan(v) {
+    if (!isRecord(v))
+        return false;
+    const values = Object.values(v);
+    return values.length > 0 && values.every(isRenderRequest);
+}
+export function detectTemplate(data) {
+    return isSerializerPlan(data);
+}

package/dist/generated/index.js

@@ -0,0 +1,40 @@
+// Code generated by chant generate. DO NOT EDIT.
+import { createResource, createProperty } from "./runtime.js";
+export const BackgroundWorker = /* @__PURE__ */ createResource("Render::Services::BackgroundWorker", "render", { "id": "id", "buildSourceId": "buildSourceId", "createdAt": "createdAt", "dashboardUrl": "dashboardUrl", "imagePath": "imagePath", "notifyOnFail": "notifyOnFail", "registryCredential": "registryCredential", "slug": "slug", "suspended": "suspended", "suspenders": "suspenders", "updatedAt": "updatedAt" });
+export const CronJob = /* @__PURE__ */ createResource("Render::Services::CronJob", "render", { "id": "id", "buildSourceId": "buildSourceId", "createdAt": "createdAt", "dashboardUrl": "dashboardUrl", "imagePath": "imagePath", "notifyOnFail": "notifyOnFail", "registryCredential": "registryCredential", "slug": "slug", "suspended": "suspended", "suspenders": "suspenders", "updatedAt": "updatedAt" });
+export const CustomDomain = /* @__PURE__ */ createResource("Render::Services::CustomDomain", "render", { "id": "id", "domainType": "domainType", "publicSuffix": "publicSuffix", "redirectForName": "redirectForName", "verificationStatus": "verificationStatus", "createdAt": "createdAt", "server": "server" });
+export const Disk = /* @__PURE__ */ createResource("Render::Services::Disk", "render", { "id": "id", "createdAt": "createdAt", "updatedAt": "updatedAt" });
+export const EnvGroup = /* @__PURE__ */ createResource("Render::Config::EnvGroup", "render", { "id": "id", "createdAt": "createdAt", "updatedAt": "updatedAt", "serviceLinks": "serviceLinks" });
+export const Environment = /* @__PURE__ */ createResource("Render::Projects::Environment", "render", { "id": "id", "databasesIds": "databasesIds", "redisIds": "redisIds", "serviceIds": "serviceIds", "envGroupIds": "envGroupIds" });
+export const KeyValue = /* @__PURE__ */ createResource("Render::Datastores::KeyValue", "render", { "id": "id", "createdAt": "createdAt", "updatedAt": "updatedAt", "status": "status", "owner": "owner", "options": "options", "version": "version", "maintenance": "maintenance", "internalConnectionString": "internalConnectionString", "externalConnectionString": "externalConnectionString", "cliCommand": "cliCommand" });
+export const Postgres = /* @__PURE__ */ createResource("Render::Datastores::Postgres", "render", { "id": "id", "createdAt": "createdAt", "updatedAt": "updatedAt", "expiresAt": "expiresAt", "dashboardUrl": "dashboardUrl", "highAvailabilityEnabled": "highAvailabilityEnabled", "maintenance": "maintenance", "owner": "owner", "primaryPostgresID": "primaryPostgresID", "role": "role", "status": "status", "suspended": "suspended", "suspenders": "suspenders", "diskAutoscalingEnabled": "diskAutoscalingEnabled", "internalConnectionString": "internalConnectionString", "externalConnectionString": "externalConnectionString", "psqlCommand": "psqlCommand" });
+export const PrivateService = /* @__PURE__ */ createResource("Render::Services::PrivateService", "render", { "id": "id", "buildSourceId": "buildSourceId", "createdAt": "createdAt", "dashboardUrl": "dashboardUrl", "imagePath": "imagePath", "notifyOnFail": "notifyOnFail", "registryCredential": "registryCredential", "slug": "slug", "suspended": "suspended", "suspenders": "suspenders", "updatedAt": "updatedAt" });
+export const Project = /* @__PURE__ */ createResource("Render::Projects::Project", "render", { "id": "id", "createdAt": "createdAt", "updatedAt": "updatedAt", "owner": "owner", "environmentIds": "environmentIds" });
+export const RegistryCredential = /* @__PURE__ */ createResource("Render::Config::RegistryCredential", "render", { "id": "id", "updatedAt": "updatedAt" });
+export const StaticSite = /* @__PURE__ */ createResource("Render::Services::StaticSite", "render", { "id": "id", "buildSourceId": "buildSourceId", "createdAt": "createdAt", "dashboardUrl": "dashboardUrl", "imagePath": "imagePath", "notifyOnFail": "notifyOnFail", "registryCredential": "registryCredential", "slug": "slug", "suspended": "suspended", "suspenders": "suspenders", "updatedAt": "updatedAt" });
+export const Webhook = /* @__PURE__ */ createResource("Render::Config::Webhook", "render", { "id": "id", "secret": "secret" });
+export const WebService = /* @__PURE__ */ createResource("Render::Services::WebService", "render", { "id": "id", "buildSourceId": "buildSourceId", "createdAt": "createdAt", "dashboardUrl": "dashboardUrl", "imagePath": "imagePath", "notifyOnFail": "notifyOnFail", "registryCredential": "registryCredential", "slug": "slug", "suspended": "suspended", "suspenders": "suspenders", "updatedAt": "updatedAt" });
+export const Autoscaling = /* @__PURE__ */ createProperty("Render::Services::Autoscaling", "render");
+export const AutoscalingCriteria = /* @__PURE__ */ createProperty("Render::Services::AutoscalingCriteria", "render");
+export const AutoscalingCriterion = /* @__PURE__ */ createProperty("Render::Services::AutoscalingCriterion", "render");
+export const BackgroundWorkerDetails = /* @__PURE__ */ createProperty("Render::Services::BackgroundWorkerDetails", "render");
+export const BuildFilter = /* @__PURE__ */ createProperty("Render::Services::BuildFilter", "render");
+export const CidrBlockAndDescription = /* @__PURE__ */ createProperty("Render::Services::CidrBlockAndDescription", "render");
+export const CronJobDetails = /* @__PURE__ */ createProperty("Render::Services::CronJobDetails", "render");
+export const DockerDetails = /* @__PURE__ */ createProperty("Render::Services::DockerDetails", "render");
+export const EnvVar = /* @__PURE__ */ createProperty("Render::Services::EnvVar", "render");
+export const GeneratedEnvVar = /* @__PURE__ */ createProperty("Render::Services::GeneratedEnvVar", "render");
+export const Header = /* @__PURE__ */ createProperty("Render::Services::Header", "render");
+export const Image = /* @__PURE__ */ createProperty("Render::Services::Image", "render");
+export const MaintenanceMode = /* @__PURE__ */ createProperty("Render::Services::MaintenanceMode", "render");
+export const NativeEnvironmentDetails = /* @__PURE__ */ createProperty("Render::Services::NativeEnvironmentDetails", "render");
+export const Previews = /* @__PURE__ */ createProperty("Render::Services::Previews", "render");
+export const PrivateServiceDetails = /* @__PURE__ */ createProperty("Render::Services::PrivateServiceDetails", "render");
+export const ProjectEnvironment = /* @__PURE__ */ createProperty("Render::Services::ProjectEnvironment", "render");
+export const ReadReplica = /* @__PURE__ */ createProperty("Render::Services::ReadReplica", "render");
+export const Route = /* @__PURE__ */ createProperty("Render::Services::Route", "render");
+export const SecretFile = /* @__PURE__ */ createProperty("Render::Services::SecretFile", "render");
+export const ServiceDisk = /* @__PURE__ */ createProperty("Render::Services::ServiceDisk", "render");
+export const StaticSiteDetails = /* @__PURE__ */ createProperty("Render::Services::StaticSiteDetails", "render");
+export const WebServiceDetails = /* @__PURE__ */ createProperty("Render::Services::WebServiceDetails", "render");
+// Re-exports for convenience

package/dist/generated/runtime.js

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/dist/index.js

@@ -0,0 +1,21 @@
+// Plugin
+export { renderPlugin } from "./plugin.js";
+// Serializer (+ the marker shapes the applier resolves)
+export { renderSerializer, isRefMarker, isAttrMarker, isOwnerMarker } from "./serializer.js";
+// Pseudo-parameters — environment-resolved values (`Render.OwnerId`,
+// `Render.Region`) usable in place of hard-coded strings.
+export { Render, OwnerId, Region, PseudoParameter } from "./pseudo.js";
+// Ownership marker convention (env-var keys on services and env groups)
+export { RENDER_ENV_OWNERSHIP_KEYS } from "./ownership.js";
+// The resource catalog: entity type → REST collection, identity, ordering.
+export { CATALOG, ENTITY_TYPES, SERVICE_TYPE_OF, catalogEntry, isServiceEntityType } from "./catalog.js";
+// Deploy Op composite + typed step builders. `renderDeploy` returns a
+// `build → renderApply [→ verify] [→ teardown]` Op; the step builders wrap the
+// generic `activity()` so the render activities resolve by name.
+export { renderDeploy, renderApplyStep, renderDeleteStep } from "./composites/render-deploy.js";
+// Generated resources — export everything from generated index.
+// Provides `WebService`, `StaticSite`, `PrivateService`, `BackgroundWorker`,
+// `CronJob`, `Postgres`, `KeyValue`, `EnvGroup`, `Project`, `Environment`,
+// `Disk`, `CustomDomain`, `RegistryCredential`, `Webhook`, and the property
+// types (`WebServiceDetails`, `Image`, `ServiceDisk`, ...) for authoring.
+export * from "./generated/index.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "b8d06b29abe933adb0986e2f40781154f62bb86949d80149150a617fa8d3a322",
+    "manifest.json": "1e19cf063669752c1e524c89d7932b4bd5fe9f3bc461fb9e9363ef3b6a4fcc0f",
     "meta.json": "1af07221f8eedfaec1fcd2c26d396554b7fef33769541fb484331bbb505b2603",
     "types/index.d.ts": "0a7a7f086e16d043cc58281bb517fc18d0ba977664347b27a8593e53c79b43d0",
     "rules/no-secret-literals.ts": "6afb75ac75bc77c25bc6b5a1a31351a581831a9ae0fb41cbdb4ac7cad2d0e42d",
@@ -14,5 +14,5 @@
     "skills/chant-render.md": "1a6743636165d86851cf102686a0c8ac3601c1d322dc97eff0ff64bd8e494abd",
     "skills/chant-render-patterns.md": "3a7e395bcd478c8253ae2f45b0a09d3b45d08075a49781aa07e8bb7f0ac7ef8d"
   },
-  "composite": "d00d82fc5e7f2da9bba45e9167e234258e0a888783fb4c03224ede1098229944"
+  "composite": "10883069f2c28c7f07c8dd405b83cca68b771079476d6c2fe45442745b2ed5d2"
 }

package/dist/lint/audit-catalog.js

@@ -0,0 +1,23 @@
+/**
+ * The render lexicon's chant audit catalog — metadata for the REN post-synth
+ * checks, contributed via `renderPlugin.auditCatalog()`.
+ *
+ * All entries carry `yamlBased: false`: each check reads the chant model
+ * (`ctx.entities`) rather than the emitted plan, because what they need — the
+ * runtime, the plan tier, whether a source was named — lives in the typed
+ * graph. So they fire on `chant build` and cannot fire on an audit of a
+ * standalone Render config.
+ */
+import { renderAuditLineage } from "./audit-lineage.js";
+import { applyLineage } from "@intentius/chant/audit/catalog";
+/** Entity-based rule: everything render ships. */
+function rule(id, tier, category, title, remediation) {
+    return { id, tier, fixKind: "guidance", category, title, remediation, yamlBased: false };
+}
+export const renderAuditCatalog = {
+    REN010: rule("REN010", "merge-worthy", "correctness", "Native-runtime service has no build/start command", "Set `envSpecificDetails: new NativeEnvironmentDetails({ buildCommand, startCommand })` on the service."),
+    REN011: rule("REN011", "merge-worthy", "correctness", "Service has no source (repo or image)", "Set `repo` for a git-backed service, or `image: new Image({ imagePath })` for an image-backed one."),
+    REN012: rule("REN012", "merge-worthy", "correctness", "Free-plan service configured to scale or mount a disk", "Move the service to a paid instance type, or drop numInstances/autoscaling/disk."),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(renderAuditCatalog, renderAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,8 @@
+export const renderAuditLineage = {
+    REN010: [
+        { tool: "render-docs", rule: "buildCommand / startCommand", url: "https://render.com/docs/blueprint-spec#buildcommand", relation: "overlaps" },
+    ],
+    REN012: [
+        { tool: "render-docs", rule: "Free web services limitations", url: "https://render.com/docs/free#persistent-disks", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/index.js

@@ -0,0 +1,8 @@
+import { ren010 } from "./ren010-native-runtime-requires-commands.js";
+import { ren011 } from "./ren011-service-requires-source.js";
+import { ren012 } from "./ren012-free-plan-cannot-scale.js";
+export const postSynthChecks = [
+    ren010,
+    ren011,
+    ren012,
+];

package/dist/lint/post-synth/ren010-native-runtime-requires-commands.js

@@ -0,0 +1,43 @@
+/**
+ * REN010: A native-runtime service must say how to build and start.
+ *
+ * Render's native runtimes (node, python, ruby, go, rust, elixir) need a
+ * `buildCommand` and a `startCommand` in `envSpecificDetails`; without them the
+ * API rejects the create (or, on some paths, accepts it and the first deploy
+ * fails). `docker` reads a Dockerfile and `image` pulls a prebuilt image, so
+ * neither needs commands. Static sites have no runtime.
+ */
+import { ENTITY_TYPES } from "../../catalog.js";
+import { readProps, entityTypeOf, isService, kindOf } from "./render-helpers.js";
+const NATIVE_RUNTIMES = new Set(["node", "python", "ruby", "go", "rust", "elixir"]);
+export const ren010 = {
+    id: "REN010",
+    description: "A native-runtime service must set envSpecificDetails.buildCommand and startCommand",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of ctx.entities) {
+            if (!isService(entity) || entityTypeOf(entity) === ENTITY_TYPES.staticSite)
+                continue;
+            const details = readProps(readProps(entity).serviceDetails);
+            const runtime = details.runtime;
+            if (typeof runtime !== "string" || !NATIVE_RUNTIMES.has(runtime))
+                continue;
+            const env = readProps(details.envSpecificDetails);
+            const missing = [];
+            if (typeof env.buildCommand !== "string" || env.buildCommand.length === 0)
+                missing.push("buildCommand");
+            if (typeof env.startCommand !== "string" || env.startCommand.length === 0)
+                missing.push("startCommand");
+            if (missing.length > 0) {
+                diagnostics.push({
+                    checkId: "REN010",
+                    severity: "error",
+                    message: `${kindOf(entity)} "${name}" uses the ${runtime} runtime but sets no ${missing.join(" or ")} — add envSpecificDetails: new NativeEnvironmentDetails({ buildCommand, startCommand })`,
+                    entity: name,
+                    lexicon: "render",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/ren011-service-requires-source.js

@@ -0,0 +1,45 @@
+/**
+ * REN011: A service needs a source — a repo or an image.
+ *
+ * Every Render service is either git-backed (`repo`, built on Render) or
+ * image-backed (`image.imagePath`, pulled from a registry). One that names
+ * neither has nothing to deploy and is rejected at create time; one that uses
+ * the `image` runtime without an `image` is the same mistake spelled
+ * differently. Static sites are always git-backed.
+ */
+import { readProps, isService, kindOf } from "./render-helpers.js";
+export const ren011 = {
+    id: "REN011",
+    description: "A service must have a repo (git-backed) or an image (image-backed)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of ctx.entities) {
+            if (!isService(entity))
+                continue;
+            const props = readProps(entity);
+            const repo = typeof props.repo === "string" && props.repo.length > 0;
+            const imagePath = readProps(props.image).imagePath;
+            const image = typeof imagePath === "string" && imagePath.length > 0;
+            const runtime = readProps(props.serviceDetails).runtime;
+            if (!repo && !image) {
+                diagnostics.push({
+                    checkId: "REN011",
+                    severity: "error",
+                    message: `${kindOf(entity)} "${name}" has neither a repo nor an image — set repo: "https://github.com/…" or image: new Image({ imagePath: "docker.io/…" })`,
+                    entity: name,
+                    lexicon: "render",
+                });
+            }
+            else if (runtime === "image" && !image) {
+                diagnostics.push({
+                    checkId: "REN011",
+                    severity: "error",
+                    message: `${kindOf(entity)} "${name}" uses runtime "image" but sets no image.imagePath`,
+                    entity: name,
+                    lexicon: "render",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};