@intentius/chant-lexicon-azure 0.124.30 → 0.124.32

package/dist/composites/container-instance.js

@@ -0,0 +1,36 @@
+/**
+ * ContainerInstance composite — Container Group.
+ *
+ * Creates a Container Group with managed identity and no public IP by default.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { containerGroups } from "../generated/index.js";
+export const ContainerInstance = Composite((props) => {
+    const { name, location = "[resourceGroup().location]", image = "mcr.microsoft.com/hello-world", cpu = 1, memoryInGb = 1.5, port = 80, publicIp = false, tags = {}, defaults, } = props;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const containerGroup = new containerGroups(mergeDefaults({
+        name,
+        location,
+        tags: mergedTags,
+        identity: { type: "SystemAssigned" },
+        osType: "Linux",
+        restartPolicy: "OnFailure",
+        ipAddress: {
+            type: publicIp ? "Public" : "Private",
+            ports: [{ protocol: "TCP", port }],
+        },
+        containers: [
+            {
+                name: `${name}-container`,
+                properties: {
+                    image,
+                    ports: [{ port }],
+                    resources: {
+                        requests: { cpu, memoryInGB: memoryInGb },
+                    },
+                },
+            },
+        ],
+    }, defaults?.containerGroup), { apiVersion: "2023-05-01" });
+    return { containerGroup };
+}, "ContainerInstance");

package/dist/composites/container-registry.js

@@ -0,0 +1,62 @@
+/**
+ * ContainerRegistrySecure composite — Azure Container Registry with security hardening.
+ *
+ * A higher-level construct for deploying an ACR with
+ * admin user disabled, content trust, and quarantine policy.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { ContainerRegistry } from "../generated/index.js";
+/**
+ * Create a ContainerRegistrySecure composite — returns an
+ * Azure Container Registry with security best practices.
+ *
+ * @example
+ * ```ts
+ * import { ContainerRegistrySecure } from "@intentius/chant-lexicon-azure";
+ *
+ * const { registry } = ContainerRegistrySecure({
+ *   name: "myacr01",
+ *   sku: "Premium",
+ *   tags: { environment: "production" },
+ * });
+ *
+ * export { registry };
+ * ```
+ */
+export const ContainerRegistrySecure = Composite((props) => {
+    const { name, sku = "Premium", location = "[resourceGroup().location]", tags = {}, defaults, } = props;
+    const commonTags = {
+        "managed-by": "chant",
+        ...tags,
+    };
+    const registry = new ContainerRegistry(mergeDefaults({
+        name,
+        location,
+        tags: commonTags,
+        sku: {
+            name: sku,
+        },
+        adminUserEnabled: false,
+        publicNetworkAccess: "Enabled",
+        networkRuleBypassOptions: "AzureServices",
+        zoneRedundancy: "Disabled",
+        policies: {
+            quarantinePolicy: {
+                status: "enabled",
+            },
+            trustPolicy: {
+                type: "Notary",
+                status: "enabled",
+            },
+            retentionPolicy: {
+                days: 30,
+                status: "enabled",
+            },
+        },
+        encryption: {
+            status: "disabled",
+        },
+        dataEndpointEnabled: false,
+    }, defaults?.registry), { apiVersion: "2023-07-01" });
+    return { registry };
+}, "ContainerRegistrySecure");

package/dist/composites/cosmos-database.js

@@ -0,0 +1,56 @@
+/**
+ * CosmosDatabase composite — Cosmos DB Account + SQL Database + Container.
+ *
+ * Creates a Cosmos DB Account with automatic failover, network ACL deny,
+ * and TLS 1.2, plus a SQL Database and Container.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { CosmosDb, databaseAccounts_sqlDatabases, databaseAccounts_sqlDatabases_containers, } from "../generated/index.js";
+export const CosmosDatabase = Composite((props) => {
+    const { name, location = "[resourceGroup().location]", partitionKeyPath = "/id", tags = {}, defaults, } = props;
+    const databaseName = props.databaseName ?? `${name}-db`;
+    const containerName = props.containerName ?? `${name}-container`;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const account = new CosmosDb(mergeDefaults({
+        name,
+        location,
+        tags: mergedTags,
+        kind: "GlobalDocumentDB",
+        databaseAccountOfferType: "Standard",
+        enableAutomaticFailover: true,
+        minimalTlsVersion: "Tls12",
+        publicNetworkAccess: "Disabled",
+        networkAclBypass: "None",
+        consistencyPolicy: {
+            defaultConsistencyLevel: "Session",
+        },
+        locations: [
+            { locationName: location, failoverPriority: 0, isZoneRedundant: false },
+        ],
+    }, defaults?.account), { apiVersion: "2023-11-15" });
+    const database = new databaseAccounts_sqlDatabases(mergeDefaults({
+        name: `${name}/${databaseName}`,
+        resource: { id: databaseName },
+    }, defaults?.database), {
+        apiVersion: "2023-11-15",
+        DependsOn: [
+            `[resourceId('Microsoft.DocumentDB/databaseAccounts', '${name}')]`,
+        ],
+    });
+    const container = new databaseAccounts_sqlDatabases_containers(mergeDefaults({
+        name: `${name}/${databaseName}/${containerName}`,
+        resource: {
+            id: containerName,
+            partitionKey: {
+                paths: [partitionKeyPath],
+                kind: "Hash",
+            },
+        },
+    }, defaults?.container), {
+        apiVersion: "2023-11-15",
+        DependsOn: [
+            `[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', '${name}', '${databaseName}')]`,
+        ],
+    });
+    return { account, database, container };
+}, "CosmosDatabase");

package/dist/composites/from-arm.js

@@ -0,0 +1,47 @@
+/**
+ * Stamps non-enumerable Declarable properties onto plain ARM resource objects
+ * so that collectEntities() / isDeclarable() recognizes them.
+ *
+ * All original enumerable properties stay intact — existing tests that
+ * access `.type`, `.properties`, `.tags`, etc. are unaffected.
+ */
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+/** ARM meta-fields that are NOT part of the flattened props. */
+const ARM_META_FIELDS = new Set(["type", "apiVersion", "dependsOn"]);
+/**
+ * Mark a plain ARM resource object as Declarable so the build pipeline
+ * discovers and serializes it.
+ *
+ * Adds non-enumerable: DECLARABLE_MARKER, entityType, lexicon, props, attributes.
+ * The `props` object is a flattened merge of top-level fields + `properties.*`.
+ */
+export function markAsAzureResource(obj) {
+    const type = obj.type;
+    const dependsOn = obj.dependsOn;
+    // Flatten: top-level non-meta fields + properties.*
+    const props = {};
+    for (const [key, value] of Object.entries(obj)) {
+        if (ARM_META_FIELDS.has(key) || key === "properties")
+            continue;
+        props[key] = value;
+    }
+    if (typeof obj.properties === "object" && obj.properties !== null) {
+        for (const [key, value] of Object.entries(obj.properties)) {
+            props[key] = value;
+        }
+    }
+    const apiVersion = obj.apiVersion;
+    const attributes = {};
+    if (dependsOn) {
+        attributes.DependsOn = dependsOn;
+    }
+    if (apiVersion) {
+        attributes.apiVersion = apiVersion;
+    }
+    Object.defineProperty(obj, DECLARABLE_MARKER, { value: true, enumerable: false });
+    Object.defineProperty(obj, "entityType", { value: type, enumerable: false });
+    Object.defineProperty(obj, "lexicon", { value: "azure", enumerable: false });
+    Object.defineProperty(obj, "props", { value: props, enumerable: false, configurable: true });
+    Object.defineProperty(obj, "attributes", { value: attributes, enumerable: false, configurable: true });
+    return obj;
+}

package/dist/composites/function-app.js

@@ -0,0 +1,57 @@
+/**
+ * FunctionApp composite — Consumption Function App with security defaults.
+ *
+ * Creates an App Service Plan (Y1 Consumption), Function App, and
+ * Storage Account with SystemAssigned identity, HTTPS-only, TLS 1.2,
+ * and FTPS disabled.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { AppServicePlan, AppService as AppServiceResource, StorageAccount, } from "../generated/index.js";
+export const FunctionApp = Composite((props) => {
+    const { name, location = "[resourceGroup().location]", runtime = "node", runtimeVersion = "~4", tags = {}, defaults, } = props;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const storageName = `${name.replace(/[^a-z0-9]/g, "")}st`;
+    const storageAccount = new StorageAccount(mergeDefaults({
+        name: storageName,
+        location,
+        tags: mergedTags,
+        sku: { name: "Standard_LRS" },
+        kind: "StorageV2",
+        supportsHttpsTrafficOnly: true,
+        minimumTlsVersion: "TLS1_2",
+        allowBlobPublicAccess: false,
+    }, defaults?.storageAccount), { apiVersion: "2023-01-01" });
+    const plan = new AppServicePlan(mergeDefaults({
+        name: `${name}-plan`,
+        location,
+        tags: mergedTags,
+        sku: { name: "Y1", tier: "Dynamic" },
+        kind: "functionapp",
+        reserved: true,
+    }, defaults?.plan), { apiVersion: "2023-01-01" });
+    const functionApp = new AppServiceResource(mergeDefaults({
+        name,
+        location,
+        tags: mergedTags,
+        kind: "functionapp",
+        identity: { type: "SystemAssigned" },
+        serverFarmId: `[resourceId('Microsoft.Web/serverfarms', '${name}-plan')]`,
+        httpsOnly: true,
+        siteConfig: {
+            minTlsVersion: "1.2",
+            ftpsState: "Disabled",
+            appSettings: [
+                { name: "AzureWebJobsStorage", value: `[concat('DefaultEndpointsProtocol=https;AccountName=', '${storageName}', ';AccountKey=', listKeys(resourceId('Microsoft.Storage/storageAccounts', '${storageName}'), '2023-01-01').keys[0].value)]` },
+                { name: "FUNCTIONS_EXTENSION_VERSION", value: runtimeVersion },
+                { name: "FUNCTIONS_WORKER_RUNTIME", value: runtime },
+            ],
+        },
+    }, defaults?.functionApp), {
+        apiVersion: "2023-01-01",
+        DependsOn: [
+            `[resourceId('Microsoft.Web/serverfarms', '${name}-plan')]`,
+            `[resourceId('Microsoft.Storage/storageAccounts', '${storageName}')]`,
+        ],
+    });
+    return { plan, functionApp, storageAccount };
+}, "FunctionApp");

package/dist/composites/index.js

@@ -0,0 +1,16 @@
+export { StorageAccountSecure } from "./storage-account.js";
+export { VnetDefault } from "./vnet-default.js";
+export { VmLinux } from "./vm-linux.js";
+export { AppService } from "./app-service.js";
+export { AksCluster } from "./aks-cluster.js";
+export { SqlDatabase } from "./sql-database.js";
+export { KeyVaultSecure } from "./keyvault.js";
+export { ContainerRegistrySecure } from "./container-registry.js";
+export { FunctionApp } from "./function-app.js";
+export { ServiceBusPipeline } from "./service-bus-pipeline.js";
+export { CosmosDatabase } from "./cosmos-database.js";
+export { ApplicationGateway } from "./application-gateway.js";
+export { ContainerInstance } from "./container-instance.js";
+export { RedisCache } from "./redis-cache.js";
+export { PrivateEndpoint } from "./private-endpoint.js";
+export { GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink } from "./landing-zone.js";

package/dist/composites/keyvault.js

@@ -0,0 +1,69 @@
+/**
+ * KeyVaultSecure composite — Key Vault with security hardening.
+ *
+ * A higher-level construct for deploying an Azure Key Vault with
+ * soft delete, purge protection, and RBAC-ready access policies.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { KeyVault } from "../generated/index.js";
+/**
+ * Create a KeyVaultSecure composite — returns a Key Vault
+ * with security best practices.
+ *
+ * @example
+ * ```ts
+ * import { KeyVaultSecure } from "@intentius/chant-lexicon-azure";
+ *
+ * const { vault } = KeyVaultSecure({
+ *   name: "my-keyvault",
+ *   tenantId: "00000000-0000-0000-0000-000000000000",
+ *   accessPolicies: [
+ *     {
+ *       tenantId: "00000000-0000-0000-0000-000000000000",
+ *       objectId: "11111111-1111-1111-1111-111111111111",
+ *       permissions: { secrets: ["get", "list", "set"] },
+ *     },
+ *   ],
+ * });
+ *
+ * export { vault };
+ * ```
+ */
+export const KeyVaultSecure = Composite((props) => {
+    const { name, tenantId, accessPolicies = [], location = "[resourceGroup().location]", tags = {}, defaults, } = props;
+    const commonTags = {
+        "managed-by": "chant",
+        ...tags,
+    };
+    const vault = new KeyVault(mergeDefaults({
+        name,
+        location,
+        tags: commonTags,
+        tenantId,
+        sku: {
+            family: "A",
+            name: "standard",
+        },
+        accessPolicies: accessPolicies.map((policy) => ({
+            tenantId: policy.tenantId,
+            objectId: policy.objectId,
+            permissions: {
+                ...(policy.permissions.keys && { keys: policy.permissions.keys }),
+                ...(policy.permissions.secrets && { secrets: policy.permissions.secrets }),
+                ...(policy.permissions.certificates && { certificates: policy.permissions.certificates }),
+            },
+        })),
+        enabledForDeployment: false,
+        enabledForDiskEncryption: false,
+        enabledForTemplateDeployment: false,
+        enableSoftDelete: true,
+        softDeleteRetentionInDays: 90,
+        enablePurgeProtection: true,
+        enableRbacAuthorization: false,
+        networkAcls: {
+            bypass: "AzureServices",
+            defaultAction: "Allow",
+        },
+    }, defaults?.vault), { apiVersion: "2023-02-01" });
+    return { vault };
+}, "KeyVaultSecure");

package/dist/composites/landing-zone.js

@@ -0,0 +1,119 @@
+/**
+ * Landing-zone bootstrap composites — the Azure slice.
+ *
+ * Fixed-shape resources for greenfield creation of the recommended
+ * governance foundation. The evaluability rules (EVL002/004) require
+ * composites to declare a fixed set of resources, so these carry the
+ * foundation only; arbitrary management-group/subscription trees are
+ * authored as config with `landingZoneConfig()` (../governance.ts) and
+ * reconciled by an external governance reconciler, and further groups/subscriptions
+ * are declared as ordinary resources.
+ *
+ * A single ARM template cannot mix deployment scopes (AZR030, #1545), so
+ * unlike the AWS/GCP slices the foundation splits per scope — each
+ * composite emits at exactly one scope and belongs in its own project:
+ *
+ *   // tenant-scope project (management groups + subscription tenant policy)
+ *   const lz = GovernanceFoundation({});
+ *   // management-group-scope project, deployed to the tenant root group —
+ *   // policy resources also deploy at subscription scope, so the project
+ *   // pins the scope explicitly
+ *   export const scope = deploymentScope("managementGroup");
+ *   const gb = GovernanceBaseline({});
+ *   const lr = LocationRestriction({ locations: ["westeurope"] });
+ *   const al = ActivityLogSink({ workspaceId: "/subscriptions/.../workspaces/audit", location: "westeurope" });
+ *
+ * There is no OrganizationRoot analog — the tenant and its root management
+ * group come from Entra ID, not the resource API, so greenfield and
+ * brownfield both start from the existing tenant.
+ */
+import { Composite } from "@intentius/chant";
+import { ManagementGroup, PolicyAssignment, PolicyDefinition, policies as SubscriptionTenantPolicy, } from "../generated/index.js";
+import { ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID, DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS, locationRestriction, } from "../governance.js";
+function policyDefinition(name, policy) {
+    return new PolicyDefinition({
+        name,
+        displayName: policy.displayName,
+        description: policy.description,
+        mode: policy.mode ?? "All",
+        policyType: "Custom",
+        ...(policy.parameters && { parameters: policy.parameters }),
+        policyRule: policy.policyRule,
+    });
+}
+/**
+ * The explicit DependsOn (by ARM name) orders the assignment after its
+ * definition — the serializer's inference only reads plain resourceId()
+ * expressions, not managementGroupResourceId(). Management-group assignment
+ * names are capped at 24 characters.
+ */
+function policyAssignment(name, definitionName, policy) {
+    return new PolicyAssignment({
+        name,
+        displayName: policy.displayName,
+        policyDefinitionId: `[managementGroupResourceId('Microsoft.Authorization/policyDefinitions', '${definitionName}')]`,
+    }, { DependsOn: definitionName });
+}
+/**
+ * Security / Infrastructure / Sandbox / Workloads management groups with
+ * subscriptions blocked from leaving the tenant — the same baseline
+ * `landingZoneConfig()` declares. Deploys at tenant scope.
+ */
+export const GovernanceFoundation = Composite((props) => {
+    const group = (name) => new ManagementGroup({
+        name,
+        displayName: name,
+        ...(props.parentId && {
+            details: { parent: { id: `/providers/Microsoft.Management/managementGroups/${props.parentId}` } },
+        }),
+    });
+    const subscriptionTenantPolicy = new SubscriptionTenantPolicy({
+        name: "default",
+        blockSubscriptionsLeavingTenant: props.blockSubscriptionsLeavingTenant ?? true,
+    });
+    return {
+        mgSecurity: group("Security"),
+        mgInfrastructure: group("Infrastructure"),
+        mgSandbox: group("Sandbox"),
+        mgWorkloads: group("Workloads"),
+        subscriptionTenantPolicy,
+    };
+}, "GovernanceFoundation");
+/**
+ * `deny-classic-resources` and `deny-unmanaged-disks` defined and assigned
+ * at the management group the project deploys to (the tenant root group for
+ * the `landingZoneConfig()` baseline). Custom policy definitions cannot
+ * deploy at tenant scope, which is why this is not part of
+ * GovernanceFoundation.
+ */
+export const GovernanceBaseline = Composite(() => {
+    return {
+        definitionDenyClassicResources: policyDefinition("deny-classic-resources", DENY_CLASSIC_RESOURCES),
+        definitionDenyUnmanagedDisks: policyDefinition("deny-unmanaged-disks", DENY_UNMANAGED_DISKS),
+        assignmentDenyClassicResources: policyAssignment("deny-classic", "deny-classic-resources", DENY_CLASSIC_RESOURCES),
+        assignmentDenyUnmanagedDisks: policyAssignment("deny-unmanaged", "deny-unmanaged-disks", DENY_UNMANAGED_DISKS),
+    };
+}, "GovernanceBaseline");
+export const LocationRestriction = Composite((props) => {
+    const policy = locationRestriction(props.locations);
+    return {
+        definitionLocationRestriction: policyDefinition("location-restriction", policy),
+        assignmentLocationRestriction: policyAssignment("allowed-locations", "location-restriction", policy),
+    };
+}, "LocationRestriction");
+/**
+ * Assigns the built-in DeployIfNotExists policy that streams every
+ * subscription's activity log into a Log Analytics workspace — current and
+ * future subscriptions under the management group alike.
+ */
+export const ActivityLogSink = Composite((props) => {
+    const assignmentActivityLogSink = new PolicyAssignment({
+        name: "activity-log-sink",
+        location: props.location,
+        identity: { type: "SystemAssigned" },
+        displayName: "Stream activity logs to Log Analytics",
+        policyDefinitionId: ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID,
+        parameters: { logAnalytics: { value: props.workspaceId } },
+    });
+    return { assignmentActivityLogSink };
+}, "ActivityLogSink");

package/dist/composites/private-endpoint.js

@@ -0,0 +1,61 @@
+/**
+ * PrivateEndpoint composite — Private Endpoint + Private DNS Zone + DNS Zone Group.
+ *
+ * Creates a Private Endpoint for a target resource along with a Private DNS Zone
+ * and DNS Zone Group for private connectivity.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { privateEndpoints, PrivateDnsZone, privateEndpoints_privateDnsZoneGroups, privateDnsZones_virtualNetworkLinks, } from "../generated/index.js";
+export const PrivateEndpoint = Composite((props) => {
+    const { name, location = "[resourceGroup().location]", targetResourceId, groupId, subnetId, privateDnsZoneName, vnetId, tags = {}, defaults, } = props;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const privateEndpoint = new privateEndpoints(mergeDefaults({
+        name,
+        location,
+        tags: mergedTags,
+        subnet: { id: subnetId },
+        privateLinkServiceConnections: [
+            {
+                name: `${name}-connection`,
+                properties: {
+                    privateLinkServiceId: targetResourceId,
+                    groupIds: [groupId],
+                },
+            },
+        ],
+    }, defaults?.privateEndpoint), { apiVersion: "2023-05-01" });
+    const privateDnsZone = new PrivateDnsZone(mergeDefaults({
+        name: privateDnsZoneName,
+        location: "global",
+        tags: mergedTags,
+    }, defaults?.privateDnsZone), { apiVersion: "2020-06-01" });
+    const vnetLink = new privateDnsZones_virtualNetworkLinks(mergeDefaults({
+        name: `${privateDnsZoneName}/${name}-vnet-link`,
+        location: "global",
+        virtualNetwork: { id: vnetId },
+        registrationEnabled: false,
+    }, defaults?.vnetLink), {
+        apiVersion: "2020-06-01",
+        DependsOn: [
+            `[resourceId('Microsoft.Network/privateDnsZones', '${privateDnsZoneName}')]`,
+        ],
+    });
+    const dnsZoneGroup = new privateEndpoints_privateDnsZoneGroups(mergeDefaults({
+        name: `${name}/${name}-dns-group`,
+        privateDnsZoneConfigs: [
+            {
+                name: "config1",
+                properties: {
+                    privateDnsZoneId: `[resourceId('Microsoft.Network/privateDnsZones', '${privateDnsZoneName}')]`,
+                },
+            },
+        ],
+    }, defaults?.dnsZoneGroup), {
+        apiVersion: "2023-05-01",
+        DependsOn: [
+            `[resourceId('Microsoft.Network/privateEndpoints', '${name}')]`,
+            `[resourceId('Microsoft.Network/privateDnsZones', '${privateDnsZoneName}')]`,
+        ],
+    });
+    return { privateEndpoint, privateDnsZone, dnsZoneGroup, vnetLink };
+}, "PrivateEndpoint");

package/dist/composites/redis-cache.js

@@ -0,0 +1,21 @@
+/**
+ * RedisCache composite — Azure Cache for Redis.
+ *
+ * Creates a Redis Cache with non-SSL port disabled and TLS 1.2.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { RedisCache as RedisCacheResource } from "../generated/index.js";
+export const RedisCache = Composite((props) => {
+    const { name, location = "[resourceGroup().location]", sku = "Standard", family = "C", capacity = 1, tags = {}, defaults, } = props;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const redisCache = new RedisCacheResource(mergeDefaults({
+        name,
+        location,
+        tags: mergedTags,
+        sku: { name: sku, family, capacity },
+        enableNonSslPort: false,
+        minimumTlsVersion: "1.2",
+        redisConfiguration: {},
+    }, defaults?.redisCache), { apiVersion: "2023-08-01" });
+    return { redisCache };
+}, "RedisCache");

package/dist/composites/service-bus-pipeline.js

@@ -0,0 +1,54 @@
+/**
+ * ServiceBusPipeline composite — ServiceBus Namespace with Queue or Topic.
+ *
+ * Creates a ServiceBus Namespace and either a Queue (default) or a
+ * Topic + Subscription. Enforces TLS 1.2 and Standard SKU.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { ServiceBusNamespace, namespaces_queues, Sbnamespaces_topics, namespaces_topics_subscriptions, } from "../generated/index.js";
+export const ServiceBusPipeline = Composite((props) => {
+    const { name, location = "[resourceGroup().location]", useTopic = false, tags = {}, defaults, } = props;
+    const entityName = props.entityName ?? (useTopic ? `${name}-topic` : `${name}-queue`);
+    const subscriptionName = props.subscriptionName ?? `${entityName}-sub`;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const namespace = new ServiceBusNamespace(mergeDefaults({
+        name,
+        location,
+        tags: mergedTags,
+        sku: { name: "Standard", tier: "Standard" },
+        minimumTlsVersion: "1.2",
+    }, defaults?.namespace), { apiVersion: "2022-10-01-preview" });
+    if (useTopic) {
+        const topic = new Sbnamespaces_topics(mergeDefaults({
+            name: `${name}/${entityName}`,
+            maxSizeInMegabytes: 1024,
+        }, defaults?.topic), {
+            apiVersion: "2022-10-01-preview",
+            DependsOn: [
+                `[resourceId('Microsoft.ServiceBus/namespaces', '${name}')]`,
+            ],
+        });
+        const subscription = new namespaces_topics_subscriptions(mergeDefaults({
+            name: `${name}/${entityName}/${subscriptionName}`,
+            maxDeliveryCount: 10,
+        }, defaults?.subscription), {
+            apiVersion: "2022-10-01-preview",
+            DependsOn: [
+                `[resourceId('Microsoft.ServiceBus/namespaces/topics', '${name}', '${entityName}')]`,
+            ],
+        });
+        return { namespace, topic, subscription };
+    }
+    const queue = new namespaces_queues(mergeDefaults({
+        name: `${name}/${entityName}`,
+        maxSizeInMegabytes: 1024,
+        lockDuration: "PT1M",
+        maxDeliveryCount: 10,
+    }, defaults?.queue), {
+        apiVersion: "2022-10-01-preview",
+        DependsOn: [
+            `[resourceId('Microsoft.ServiceBus/namespaces', '${name}')]`,
+        ],
+    });
+    return { namespace, queue };
+}, "ServiceBusPipeline");

package/dist/composites/sql-database.js

@@ -0,0 +1,62 @@
+/**
+ * SqlDatabase composite — SQL Server + Database + Firewall Rule.
+ *
+ * A higher-level construct for deploying an Azure SQL Database with
+ * a logical server, a database, and a firewall rule allowing Azure services.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { SqlServer, SqlDatabase as SqlDatabaseResource, SqlFirewallRule } from "../generated/index.js";
+/**
+ * Create a SqlDatabase composite — returns a SQL Server, Database,
+ * and Firewall Rule.
+ *
+ * @example
+ * ```ts
+ * import { SqlDatabase } from "@intentius/chant-lexicon-azure";
+ *
+ * const { server, database, firewallRule } = SqlDatabase({
+ *   name: "my-sql-server",
+ *   adminLogin: "sqladmin",
+ *   adminPassword: "P@ssw0rd!",
+ *   sku: "S1",
+ * });
+ *
+ * export { server, database, firewallRule };
+ * ```
+ */
+export const SqlDatabase = Composite((props) => {
+    const { name, adminLogin, adminPassword, sku = "S0", location = "[resourceGroup().location]", tags = {}, defaults, } = props;
+    const commonTags = {
+        "managed-by": "chant",
+        ...tags,
+    };
+    const dbName = `${name}-db`;
+    const server = new SqlServer(mergeDefaults({
+        name,
+        location,
+        tags: commonTags,
+        administratorLogin: adminLogin,
+        administratorLoginPassword: adminPassword,
+        version: "12.0",
+        minimalTlsVersion: "1.2",
+        publicNetworkAccess: "Enabled",
+    }, defaults?.server), { apiVersion: "2022-05-01-preview" });
+    const database = new SqlDatabaseResource(mergeDefaults({
+        name: `${name}/${dbName}`,
+        location,
+        tags: commonTags,
+        sku: {
+            name: sku,
+        },
+        collation: "SQL_Latin1_General_CP1_CI_AS",
+        maxSizeBytes: 2147483648,
+        catalogCollation: "SQL_Latin1_General_CP1_CI_AS",
+        zoneRedundant: false,
+    }, defaults?.database), { apiVersion: "2022-05-01-preview" });
+    const firewallRule = new SqlFirewallRule(mergeDefaults({
+        name: `${name}/AllowAllAzureIps`,
+        startIpAddress: "0.0.0.0",
+        endIpAddress: "0.0.0.0",
+    }, defaults?.firewallRule), { apiVersion: "2022-05-01-preview" });
+    return { server, database, firewallRule };
+}, "SqlDatabase");