@intentius/chant-lexicon-render 0.53.0

package/dist/ownership.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The render lexicon's ownership convention, declared here so core carries no
+ * render-specific branch — the #686 seam: each lexicon owns its key names; core
+ * keeps only the generic stamp/detect logic (@intentius/chant/ownership).
+ *
+ * Render has no tags or labels on any resource. What it does have, on the two
+ * kinds chant creates most and prunes — services and env groups — is a
+ * key/value store the API writes and reads back verbatim: environment
+ * variables. chant stamps `CHANT_MANAGED_BY=chant` (+ `CHANT_STACK` /
+ * `CHANT_ENV`) into a service's or env group's env vars at serialize time and
+ * reads them back through `GET .../env-vars`; that is the primary marker and
+ * the basis for owned-only prune. A service without it is never modified or
+ * deleted by a prune. The keys are upper-snake because that is what an env var
+ * is; the values are exactly what every other lexicon stamps.
+ *
+ * Disks and custom domains carry no marker either, but they hang off a
+ * service, so they inherit the parent's verdict — the service boundary, one
+ * level down from fly's app boundary. An undeclared disk under a chant-owned
+ * service is chant's and is pruned; one under a foreign service is foreign.
+ *
+ * Datastores, projects, environments, registry credentials, and webhooks
+ * carry no channel and no boundary. Their verdict is `unknown` (never
+ * `foreign`, never `owned`): the change set never escalates `unknown` to a
+ * delete, so an undeclared Postgres is never pruned. Removing one is an
+ * explicit `renderDelete` of a plan that names it.
+ */
+import type { ChannelKeys } from "@intentius/chant/ownership";
+/** Env-var keys for chant's ownership markers on services and env groups. */
+export declare const RENDER_ENV_OWNERSHIP_KEYS: ChannelKeys;
+/** True when a key is one of chant's marker env vars. */
+export declare function isOwnershipKey(key: string): boolean;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,EAAE,WAIvC,CAAC;AAEF,yDAAyD;AACzD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMnD"}

package/dist/package-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=package-cli.d.ts.map

package/dist/package-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-cli.d.ts","sourceRoot":"","sources":["../src/package-cli.ts"],"names":[],"mappings":""}

package/dist/plugin.d.ts

@@ -0,0 +1,8 @@
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+/**
+ * render lexicon plugin.
+ *
+ * Implements all required LexiconPlugin lifecycle methods.
+ */
+export declare const renderPlugin: LexiconPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAmB,MAAM,0BAA0B,CAAC;AAY/E;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,aAgP1B,CAAC"}

package/dist/pseudo.d.ts

@@ -0,0 +1,21 @@
+import { PseudoParameter } from "@intentius/chant/pseudo-parameter";
+export { PseudoParameter };
+/**
+ * Render pseudo-parameters — environment-resolved values a project references
+ * without hard-coding. Each serializes to a `{ Ref: "Render::..." }` marker
+ * that the serializer resolves from an environment variable at build time (see
+ * PSEUDO_ENV_MAP in ./serializer.ts), mirroring fly's `Fly.OrgSlug`.
+ *
+ *   - OwnerId → the workspace (team or personal) id (RENDER_OWNER_ID), e.g. `tea-…`.
+ *     Every ownerId chant fills in defaults to this, so a stack rarely names it.
+ *   - Region  → the target region (RENDER_REGION), default `oregon`.
+ */
+export declare const OwnerId: PseudoParameter, Region: PseudoParameter;
+/**
+ * Render namespace containing all pseudo-parameters.
+ */
+export declare const Render: {
+    readonly OwnerId: PseudoParameter;
+    readonly Region: PseudoParameter;
+};
+//# sourceMappingURL=pseudo.d.ts.map

package/dist/pseudo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pseudo.d.ts","sourceRoot":"","sources":["../src/pseudo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA0B,MAAM,mCAAmC,CAAC;AAE5F,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;;;;;;GASG;AACH,eAAO,MAAQ,OAAO,mBAAE,MAAM,iBAG5B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,MAAM;;;CAGT,CAAC"}

package/dist/rules/no-secret-literals.ts

@@ -0,0 +1,73 @@
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import * as ts from "typescript";
+
+/**
+ * Env-var keys that carry a credential. Kept conservative on purpose — an
+ * inline value under one of these keys is very likely a real secret.
+ */
+const SECRET_KEY_PATTERN = /(?:^|[_-])(?:password|passwd|secret|token|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|credential|auth[_-]?token)(?:$|[_-])/i;
+
+/**
+ * Values that are references or placeholders, not literal secrets: shell/
+ * interpolation references ($FOO, ${FOO}) and secret-manager style references.
+ */
+const REFERENCE_VALUE_PATTERN = /^(?:\$\{?[A-Za-z0-9_]+\}?|(?:secret|ref|env|vault):\S+)$/;
+
+/**
+ * REN002: No secret literals in env vars
+ *
+ * Flags an `envVars` (or `secretFiles`) entry whose `key` looks like a
+ * credential and whose `value` is a plain string literal. Render can generate
+ * the value (`generateValue: true`), it can come from an EnvGroup or from
+ * another resource's attribute (`db.internalConnectionString`), or from the
+ * process environment at build time — anything but a literal in source that
+ * ends up in git and in the build output.
+ */
+export const noSecretLiteralsRule: LintRule = {
+  id: "REN002",
+  severity: "warning",
+  category: "security",
+  description: "Secret env-var values must not be written inline — use generateValue, an EnvGroup, or a reference",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const { sourceFile } = context;
+    const diagnostics: LintDiagnostic[] = [];
+
+    function literalOf(init: ts.Expression): string | undefined {
+      return ts.isStringLiteral(init) || ts.isNoSubstitutionTemplateLiteral(init) ? init.text : undefined;
+    }
+
+    function visit(node: ts.Node): void {
+      // `{ key: "DB_PASSWORD", value: "hunter2" }` — an object literal with a
+      // secret-looking `key` and a literal `value`.
+      if (ts.isObjectLiteralExpression(node)) {
+        let key: string | undefined;
+        let valueNode: ts.Expression | undefined;
+        for (const prop of node.properties) {
+          if (!ts.isPropertyAssignment(prop)) continue;
+          const name = prop.name.getText(sourceFile).replace(/^["']|["']$/g, "");
+          if (name === "key") key = literalOf(prop.initializer);
+          if (name === "value") valueNode = prop.initializer;
+        }
+        if (key && valueNode) {
+          const value = literalOf(valueNode);
+          if (value !== undefined && value.length >= 4 && SECRET_KEY_PATTERN.test(key) && !REFERENCE_VALUE_PATTERN.test(value.trim())) {
+            const { line, character } = sourceFile.getLineAndCharacterOfPosition(valueNode.getStart(sourceFile));
+            diagnostics.push({
+              file: sourceFile.fileName,
+              line: line + 1,
+              column: character + 1,
+              ruleId: "REN002",
+              severity: "warning",
+              message: `Possible inline secret for env var "${key}". Use \`generateValue: true\`, an EnvGroup, a resource attribute (e.g. db.internalConnectionString), or process.env — not a literal.`,
+            });
+          }
+        }
+      }
+      ts.forEachChild(node, visit);
+    }
+
+    visit(sourceFile);
+    return diagnostics;
+  },
+};

package/dist/rules/ren010-native-runtime-requires-commands.ts

@@ -0,0 +1,47 @@
+/**
+ * REN010: A native-runtime service must say how to build and start.
+ *
+ * Render's native runtimes (node, python, ruby, go, rust, elixir) need a
+ * `buildCommand` and a `startCommand` in `envSpecificDetails`; without them the
+ * API rejects the create (or, on some paths, accepts it and the first deploy
+ * fails). `docker` reads a Dockerfile and `image` pulls a prebuilt image, so
+ * neither needs commands. Static sites have no runtime.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { ENTITY_TYPES } from "../../catalog";
+import { readProps, entityTypeOf, isService, kindOf } from "./render-helpers";
+
+const NATIVE_RUNTIMES = new Set(["node", "python", "ruby", "go", "rust", "elixir"]);
+
+export const ren010: PostSynthCheck = {
+  id: "REN010",
+  description: "A native-runtime service must set envSpecificDetails.buildCommand and startCommand",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of ctx.entities) {
+      if (!isService(entity) || entityTypeOf(entity) === ENTITY_TYPES.staticSite) continue;
+      const details = readProps(readProps(entity).serviceDetails);
+      const runtime = details.runtime;
+      if (typeof runtime !== "string" || !NATIVE_RUNTIMES.has(runtime)) continue;
+
+      const env = readProps(details.envSpecificDetails);
+      const missing: string[] = [];
+      if (typeof env.buildCommand !== "string" || env.buildCommand.length === 0) missing.push("buildCommand");
+      if (typeof env.startCommand !== "string" || env.startCommand.length === 0) missing.push("startCommand");
+      if (missing.length > 0) {
+        diagnostics.push({
+          checkId: "REN010",
+          severity: "error",
+          message: `${kindOf(entity)} "${name}" uses the ${runtime} runtime but sets no ${missing.join(" or ")} — add envSpecificDetails: new NativeEnvironmentDetails({ buildCommand, startCommand })`,
+          entity: name,
+          lexicon: "render",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/ren011-service-requires-source.ts

@@ -0,0 +1,50 @@
+/**
+ * REN011: A service needs a source — a repo or an image.
+ *
+ * Every Render service is either git-backed (`repo`, built on Render) or
+ * image-backed (`image.imagePath`, pulled from a registry). One that names
+ * neither has nothing to deploy and is rejected at create time; one that uses
+ * the `image` runtime without an `image` is the same mistake spelled
+ * differently. Static sites are always git-backed.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readProps, isService, kindOf } from "./render-helpers";
+
+export const ren011: PostSynthCheck = {
+  id: "REN011",
+  description: "A service must have a repo (git-backed) or an image (image-backed)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of ctx.entities) {
+      if (!isService(entity)) continue;
+      const props = readProps(entity);
+      const repo = typeof props.repo === "string" && props.repo.length > 0;
+      const imagePath = readProps(props.image).imagePath;
+      const image = typeof imagePath === "string" && imagePath.length > 0;
+      const runtime = readProps(props.serviceDetails).runtime;
+
+      if (!repo && !image) {
+        diagnostics.push({
+          checkId: "REN011",
+          severity: "error",
+          message: `${kindOf(entity)} "${name}" has neither a repo nor an image — set repo: "https://github.com/…" or image: new Image({ imagePath: "docker.io/…" })`,
+          entity: name,
+          lexicon: "render",
+        });
+      } else if (runtime === "image" && !image) {
+        diagnostics.push({
+          checkId: "REN011",
+          severity: "error",
+          message: `${kindOf(entity)} "${name}" uses runtime "image" but sets no image.imagePath`,
+          entity: name,
+          lexicon: "render",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/ren012-free-plan-cannot-scale.ts

@@ -0,0 +1,43 @@
+/**
+ * REN012: The free instance type cannot scale.
+ *
+ * Render's `free` plan runs a single instance and cannot autoscale; a
+ * `numInstances > 1` or an enabled `autoscaling` block on a free service is
+ * rejected at create/patch time. Persistent disks are also unavailable on
+ * free. Catch all three at synth time with a message that says which.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readProps, isService, kindOf } from "./render-helpers";
+
+export const ren012: PostSynthCheck = {
+  id: "REN012",
+  description: "A free-plan service cannot set numInstances > 1, autoscaling, or a disk",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of ctx.entities) {
+      if (!isService(entity)) continue;
+      const details = readProps(readProps(entity).serviceDetails);
+      if (details.plan !== "free") continue;
+
+      const problems: string[] = [];
+      if (typeof details.numInstances === "number" && details.numInstances > 1) problems.push(`numInstances: ${details.numInstances}`);
+      const autoscaling = readProps(details.autoscaling);
+      if (autoscaling.enabled === true) problems.push("autoscaling");
+      if (details.disk !== undefined) problems.push("a disk");
+      if (problems.length > 0) {
+        diagnostics.push({
+          checkId: "REN012",
+          severity: "error",
+          message: `${kindOf(entity)} "${name}" is on the free plan but sets ${problems.join(", ")} — the free instance type runs one instance, cannot autoscale, and has no persistent disk; pick a paid plan (starter or above)`,
+          entity: name,
+          lexicon: "render",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/render-helpers.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared helpers for the render post-synth checks. Not a check itself, so the
+ * generated barrel skips it (the scanner only picks up exported PostSynthChecks).
+ */
+
+import { isServiceEntityType } from "../../catalog";
+
+/**
+ * Read an entity or property's constructor props. Nested Declarables
+ * (WebServiceDetails, Image, ServiceDisk) stash their args under a
+ * non-enumerable `props`; a plain inline object carries them directly. Handle
+ * both so a check behaves the same whether the user authored
+ * `serviceDetails: { runtime }` or `serviceDetails: new WebServiceDetails({ runtime })`.
+ */
+export function readProps(value: unknown): Record<string, unknown> {
+  if (value && typeof value === "object") {
+    const nested = (value as { props?: unknown }).props;
+    if (nested && typeof nested === "object") return nested as Record<string, unknown>;
+    return value as Record<string, unknown>;
+  }
+  return {};
+}
+
+/** The entityType of a declarable, or undefined. */
+export function entityTypeOf(value: unknown): string | undefined {
+  return (value as { entityType?: string } | undefined)?.entityType;
+}
+
+/** True when the entity is one of the five service kinds. */
+export function isService(value: unknown): boolean {
+  return isServiceEntityType(entityTypeOf(value));
+}
+
+/** The short kind (`WebService`) from an entity type, for messages. */
+export function kindOf(value: unknown): string {
+  const t = entityTypeOf(value) ?? "";
+  return t.slice(t.lastIndexOf("::") + 2);
+}

package/dist/rules/valid-cron-schedule.ts

@@ -0,0 +1,51 @@
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import * as ts from "typescript";
+
+/** One cron field: `*`, a number, a range, a list, or any of those with a `/step`. */
+const FIELD = String.raw`(?:\*|\d+(?:-\d+)?)(?:,(?:\*|\d+(?:-\d+)?))*(?:\/\d+)?`;
+const CRON_5 = new RegExp(`^${FIELD}(?:\\s+${FIELD}){4}$`);
+
+/** True for a standard five-field cron expression (Render accepts no seconds field or macros). */
+export function isValidCronSchedule(s: string): boolean {
+  return CRON_5.test(s.trim());
+}
+
+/**
+ * REN003: Valid cron schedule
+ *
+ * A CronJob's `schedule` must be a standard five-field cron expression
+ * (`minute hour day-of-month month day-of-week`). Render rejects `@hourly`-style
+ * macros and six-field (seconds) expressions at create time; catch them at build.
+ */
+export const validCronScheduleRule: LintRule = {
+  id: "REN003",
+  severity: "error",
+  category: "correctness",
+  description: "A cron job schedule must be a five-field cron expression",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const { sourceFile } = context;
+    const diagnostics: LintDiagnostic[] = [];
+
+    function visit(node: ts.Node): void {
+      if (ts.isPropertyAssignment(node) && node.name.getText(sourceFile) === "schedule") {
+        const init = node.initializer;
+        if (ts.isStringLiteral(init) && !isValidCronSchedule(init.text)) {
+          const { line, character } = sourceFile.getLineAndCharacterOfPosition(init.getStart(sourceFile));
+          diagnostics.push({
+            file: sourceFile.fileName,
+            line: line + 1,
+            column: character + 1,
+            ruleId: "REN003",
+            severity: "error",
+            message: `Invalid cron schedule "${init.text}". Use five fields, e.g. "0 * * * *" (hourly) or "*/15 * * * *" (every 15 minutes); Render accepts no @macros or seconds field.`,
+          });
+        }
+      }
+      ts.forEachChild(node, visit);
+    }
+
+    visit(sourceFile);
+    return diagnostics;
+  },
+};

package/dist/rules/valid-region.ts

@@ -0,0 +1,49 @@
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import * as ts from "typescript";
+
+/**
+ * Render's regions, per the `region` enum in the Public API spec. The generated
+ * types already narrow `region` to this union, so a typo is a compile error in
+ * a typed project; this rule gives the same answer with a clearer message, and
+ * fires in contexts the type checker does not reach (a `.js` stack, a value
+ * that has been widened to `string`).
+ */
+export const KNOWN_REGIONS = new Set<string>(["frankfurt", "oregon", "ohio", "singapore", "virginia"]);
+
+/**
+ * REN001: Valid Render region
+ *
+ * A service, datastore, or Key Value `region` must be a Render region.
+ */
+export const validRegionRule: LintRule = {
+  id: "REN001",
+  severity: "error",
+  category: "correctness",
+  description: "A region must be a Render region (frankfurt, oregon, ohio, singapore, virginia)",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const { sourceFile } = context;
+    const diagnostics: LintDiagnostic[] = [];
+
+    function visit(node: ts.Node): void {
+      if (ts.isPropertyAssignment(node) && node.name.getText(sourceFile) === "region") {
+        const init = node.initializer;
+        if (ts.isStringLiteral(init) && init.text.length > 0 && !KNOWN_REGIONS.has(init.text)) {
+          const { line, character } = sourceFile.getLineAndCharacterOfPosition(init.getStart(sourceFile));
+          diagnostics.push({
+            file: sourceFile.fileName,
+            line: line + 1,
+            column: character + 1,
+            ruleId: "REN001",
+            severity: "error",
+            message: `Unknown Render region "${init.text}". Use one of: ${[...KNOWN_REGIONS].join(", ")}.`,
+          });
+        }
+      }
+      ts.forEachChild(node, visit);
+    }
+
+    visit(sourceFile);
+    return diagnostics;
+  },
+};

package/dist/serializer.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Render serializer.
+ *
+ * Turns declared `WebService`, `Postgres`, `EnvGroup`, `Project`, ... resources
+ * into the JSON create bodies the Render Public API accepts, so the applier can
+ * POST them straight through.
+ *
+ * Output shape — a JSON object keyed by entity name. Each value is a single
+ * Render request plus the identity the applier reconciles by:
+ *
+ *   {
+ *     "<entityName>": {
+ *       "kind": "WebService",                       // generated class name
+ *       "entityType": "Render::Services::WebService",
+ *       "endpoint": "/services",                    // create collection
+ *       "method": "POST",
+ *       "name": "my-web",                           // reconcile key (Render has no client-chosen ids)
+ *       "body": { ... },                            // the create body
+ *       "pathParams": { "serviceId": { "$ref": "web" } }   // for child collections
+ *     }
+ *   }
+ *
+ * Cross-resource references. Render identifies resources by server-assigned
+ * ids, so a Disk's `serviceId` or an Environment's `projectId` cannot be known
+ * at build time. A declared resource passed where an id is expected serializes
+ * to `{ "$ref": "<entityName>" }`; an attribute read (`db.internalConnectionString`)
+ * to `{ "$attr": { "entity": "<entityName>", "attribute": "..." } }`. The applier
+ * resolves both once the target exists.
+ *
+ * Ownership. Every serialized service and env group carries the
+ * `CHANT_MANAGED_BY=chant` marker (plus the stack/env identity from
+ * `context.ownership`) merged into `envVars`, even when the author supplied
+ * none. See ./ownership.ts for why env vars.
+ *
+ * `ownerId`. Every owner-scoped body gets `ownerId` filled from `Render.OwnerId`
+ * (`RENDER_OWNER_ID`) when the author omitted it. When that is unset too, an
+ * `{ "$owner": true }` marker is left for the applier, which resolves it from
+ * `GET /owners` when the token sees exactly one workspace.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { Serializer, SerializeContext } from "@intentius/chant/serializer";
+import type { LexiconOutput } from "@intentius/chant/lexicon-output";
+/** A cross-resource id reference the applier resolves after the target exists. */
+export interface RefMarker {
+    $ref: string;
+}
+/** An attribute read the applier resolves from the live target. */
+export interface AttrMarker {
+    $attr: {
+        entity: string;
+        attribute: string;
+    };
+}
+/** The workspace placeholder left when neither the author nor `RENDER_OWNER_ID` named one. */
+export interface OwnerMarker {
+    $owner: true;
+}
+export declare function isRefMarker(v: unknown): v is RefMarker;
+export declare function isAttrMarker(v: unknown): v is AttrMarker;
+export declare function isOwnerMarker(v: unknown): v is OwnerMarker;
+/** A single Render REST call the applier can issue, plus its reconcile identity. */
+export interface RenderRequest {
+    kind: string;
+    entityType: string;
+    endpoint: string;
+    method: "POST";
+    /** The human name Render will show and chant reconciles by. */
+    name: string;
+    body: Record<string, unknown>;
+    /** Path placeholders in `endpoint` (child collections). */
+    pathParams?: Record<string, unknown>;
+}
+/** The serializer's whole output: entity name → request. */
+export type RenderPlan = Record<string, RenderRequest>;
+/**
+ * Recursively replace pseudo-parameters with their resolved environment value.
+ * Handles both a raw `PseudoParameter` instance and the already-walked
+ * `{ Ref: "Render::X" }` shape. Everything else passes through untouched.
+ */
+export declare function resolvePseudoParameters(value: unknown): unknown;
+/**
+ * Merge chant's ownership marker into an `envVars` list. The marker wins over
+ * any colliding user key so ownership can never be silently unset; the user's
+ * ordering is otherwise preserved.
+ */
+export declare function stampOwnership(envVars: unknown, marker: Record<string, string>): unknown[];
+/**
+ * Serialize a render partition into the plan document `renderApply` consumes.
+ *
+ * Split out of the `Serializer` object so callers that need the concrete
+ * document — the applier, its tests, the `describeResources` fixtures — get
+ * `string` rather than the interface's `string | SerializerResult` union.
+ */
+export declare function serializeRender(entities: Map<string, Declarable>, _outputs?: LexiconOutput[], context?: SerializeContext): string;
+/**
+ * Render serializer.
+ */
+export declare const renderSerializer: Serializer;
+//# sourceMappingURL=serializer.d.ts.map

package/dist/serializer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAOrE,kFAAkF;AAClF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C;AAED,8FAA8F;AAC9F,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,CAAC;CACd;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,SAAS,CAEtD;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,UAAU,CAGxD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,WAAW,CAE1D;AAED,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAkDvD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAuB/D;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,EAAE,CAK1F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,QAAQ,CAAC,EAAE,aAAa,EAAE,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,MAAM,CA4ER;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAI9B,CAAC"}