@intentius/chant-lexicon-azure 0.124.38 → 0.124.39

package/dist/composites/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/composites/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAu1B5C,CAAC"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/composites/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,eAAO,MAAM,gBAAgB,EAAE,cAAc,EA+8B5C,CAAC"}

package/dist/composites/catalog.js

@@ -167,6 +167,126 @@ export const compositeCatalog = [
             }
         ]
     },
+    {
+        "name": "ContainerAppNetwork",
+        "lexicon": "azure",
+        "description": "A VNet with a subnet delegated to `Microsoft.App/environments`, for ContainerAppSite environments to sit in.",
+        "bundles": [
+            "Subnet",
+            "VirtualNetwork"
+        ],
+        "params": [
+            {
+                "name": "name",
+                "type": "string",
+                "required": true,
+                "description": "Network name prefix: the VNet is `<name>-vnet`, its subnet `apps`."
+            },
+            {
+                "name": "location",
+                "type": "string",
+                "required": false,
+                "description": "Azure region (default: resource group location)."
+            },
+            {
+                "name": "addressSpace",
+                "type": "string",
+                "required": false,
+                "description": "VNet address space (default: \"10.0.0.0/16\")."
+            },
+            {
+                "name": "subnetPrefix",
+                "type": "string",
+                "required": false,
+                "description": "The environment subnet's prefix, a /23 or larger (default: \"10.0.0.0/23\")."
+            },
+            {
+                "name": "tags",
+                "type": "Record<string, string>",
+                "required": false,
+                "description": "Resource tags."
+            },
+            {
+                "name": "defaults",
+                "type": "{ virtualNetwork?: Partial<ConstructorParameters<typeof VirtualNetwork>[0]>; subnet?: Partial<ConstructorParameters<t...",
+                "required": false,
+                "description": "Per-member defaults."
+            }
+        ]
+    },
+    {
+        "name": "ContainerAppSite",
+        "lexicon": "azure",
+        "description": "A Container Apps environment in a subnet, shipping logs to its own Log Analytics workspace, with one app running as a user-assigned identity.",
+        "bundles": [
+            "LogAnalyticsWorkspace",
+            "ManagedIdentity",
+            "containerApps",
+            "managedEnvironments"
+        ],
+        "params": [
+            {
+                "name": "name",
+                "type": "string",
+                "required": true,
+                "description": "Environment name; the workspace is `<name>-logs` and the identity `<name>-<app>`."
+            },
+            {
+                "name": "app",
+                "type": "string",
+                "required": true,
+                "description": "Container app name."
+            },
+            {
+                "name": "subnetId",
+                "type": "string",
+                "required": true,
+                "description": "Subnet resource ID for the environment, such as a ContainerAppNetwork's `subnet.id`."
+            },
+            {
+                "name": "location",
+                "type": "string",
+                "required": false,
+                "description": "Azure region (default: resource group location)."
+            },
+            {
+                "name": "image",
+                "type": "string",
+                "required": false,
+                "description": "Container image (default: \"mcr.microsoft.com/k8se/quickstart:latest\")."
+            },
+            {
+                "name": "port",
+                "type": "number",
+                "required": false,
+                "description": "Port the container listens on; ingress forwards to it (default: 80)."
+            },
+            {
+                "name": "replicas",
+                "type": "number",
+                "required": false,
+                "description": "Fixed replica count (default: 1)."
+            },
+            {
+                "name": "internal",
+                "type": "boolean",
+                "required": false,
+                "description": "Make the environment reachable only from its VNet (default: false)."
+            },
+            {
+                "name": "tags",
+                "type": "Record<string, string>",
+                "required": false,
+                "description": "Resource tags."
+            },
+            {
+                "name": "defaults",
+                "type": "{ workspace?: Partial<ConstructorParameters<typeof LogAnalyticsWorkspace>[0]>; identity?: Partial<ConstructorParamete...",
+                "required": false,
+                "description": "Per-member defaults."
+            }
+        ]
+    },
     {
         "name": "ContainerInstance",
         "lexicon": "azure",

package/dist/composites/container-app.d.ts

@@ -0,0 +1,102 @@
+/**
+ * ContainerAppNetwork and ContainerAppSite composites: a website on Azure
+ * Container Apps and the network it sits in.
+ *
+ * Split the way the aws lexicon splits VpcDefault from FargateAlb, so several
+ * sites can share one network. Container Apps brings its own ingress and load
+ * balancing, so there is no load balancer to declare.
+ */
+import { VirtualNetwork, Subnet, LogAnalyticsWorkspace, ManagedIdentity, managedEnvironments, containerApps } from "../generated/index.js";
+export interface ContainerAppNetworkProps {
+    /** Network name prefix: the VNet is `<name>-vnet`, its subnet `apps`. */
+    name: string;
+    /** Azure region (default: resource group location). */
+    location?: string;
+    /** VNet address space (default: "10.0.0.0/16"). */
+    addressSpace?: string;
+    /** The environment subnet's prefix, a /23 or larger (default: "10.0.0.0/23"). */
+    subnetPrefix?: string;
+    /** Resource tags. */
+    tags?: Record<string, string>;
+    /** Per-member defaults. */
+    defaults?: {
+        virtualNetwork?: Partial<ConstructorParameters<typeof VirtualNetwork>[0]>;
+        subnet?: Partial<ConstructorParameters<typeof Subnet>[0]>;
+    };
+}
+export interface ContainerAppNetworkResult {
+    virtualNetwork: InstanceType<typeof VirtualNetwork>;
+    subnet: InstanceType<typeof Subnet>;
+}
+/**
+ * A VNet with a subnet delegated to `Microsoft.App/environments`, for
+ * ContainerAppSite environments to sit in.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * ```
+ */
+export declare const ContainerAppNetwork: import("@intentius/chant").CompositeDefinition<ContainerAppNetworkProps, {
+    virtualNetwork: import("@intentius/chant").Declarable & Record<string, string>;
+    subnet: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+export interface ContainerAppSiteProps {
+    /** Environment name; the workspace is `<name>-logs` and the identity `<name>-<app>`. */
+    name: string;
+    /** Container app name. */
+    app: string;
+    /** Subnet resource ID for the environment, such as a ContainerAppNetwork's `subnet.id`. */
+    subnetId: string;
+    /** Azure region (default: resource group location). */
+    location?: string;
+    /** Container image (default: "mcr.microsoft.com/k8se/quickstart:latest"). */
+    image?: string;
+    /** Port the container listens on; ingress forwards to it (default: 80). */
+    port?: number;
+    /** Fixed replica count (default: 1). */
+    replicas?: number;
+    /** Make the environment reachable only from its VNet (default: false). */
+    internal?: boolean;
+    /** Resource tags. */
+    tags?: Record<string, string>;
+    /** Per-member defaults. */
+    defaults?: {
+        workspace?: Partial<ConstructorParameters<typeof LogAnalyticsWorkspace>[0]>;
+        identity?: Partial<ConstructorParameters<typeof ManagedIdentity>[0]>;
+        environment?: Partial<ConstructorParameters<typeof managedEnvironments>[0]>;
+        containerApp?: Partial<ConstructorParameters<typeof containerApps>[0]>;
+    };
+}
+export interface ContainerAppSiteResult {
+    workspace: InstanceType<typeof LogAnalyticsWorkspace>;
+    identity: InstanceType<typeof ManagedIdentity>;
+    environment: InstanceType<typeof managedEnvironments>;
+    containerApp: InstanceType<typeof containerApps>;
+}
+/**
+ * A Container Apps environment in a subnet, shipping logs to its own Log
+ * Analytics workspace, with one app running as a user-assigned identity.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork, ContainerAppSite } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * export const site = ContainerAppSite({
+ *   name: "web",
+ *   app: "frontend",
+ *   subnetId: network.subnet.id,
+ *   image: "nginx:1.27",
+ * });
+ * ```
+ */
+export declare const ContainerAppSite: import("@intentius/chant").CompositeDefinition<ContainerAppSiteProps, {
+    workspace: import("@intentius/chant").Declarable & Record<string, string>;
+    identity: import("@intentius/chant").Declarable & Record<string, string>;
+    environment: import("@intentius/chant").Declarable & Record<string, string>;
+    containerApp: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=container-app.d.ts.map

package/dist/composites/container-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-app.d.ts","sourceRoot":"","sources":["../../src/composites/container-app.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,cAAc,EACd,MAAM,EACN,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,aAAa,EACd,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,wBAAwB;IACvC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,MAAM,EAAE,YAAY,CAAC,OAAO,MAAM,CAAC,CAAC;CACrC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;EA+BP,CAAC;AAE1B,MAAM,WAAW,qBAAqB;IACpC,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,YAAY,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACxE,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;IACtD,QAAQ,EAAE,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;IAC/C,WAAW,EAAE,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACtD,YAAY,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB;;;;;EAsEP,CAAC"}

package/dist/composites/container-app.js

@@ -0,0 +1,113 @@
+/**
+ * ContainerAppNetwork and ContainerAppSite composites: a website on Azure
+ * Container Apps and the network it sits in.
+ *
+ * Split the way the aws lexicon splits VpcDefault from FargateAlb, so several
+ * sites can share one network. Container Apps brings its own ingress and load
+ * balancing, so there is no load balancer to declare.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { VirtualNetwork, Subnet, LogAnalyticsWorkspace, ManagedIdentity, managedEnvironments, containerApps, } from "../generated/index.js";
+/**
+ * A VNet with a subnet delegated to `Microsoft.App/environments`, for
+ * ContainerAppSite environments to sit in.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * ```
+ */
+export const ContainerAppNetwork = Composite((props) => {
+    const { name, location = "[resourceGroup().location]", addressSpace = "10.0.0.0/16", subnetPrefix = "10.0.0.0/23", tags = {}, defaults, } = props;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const vnetName = `${name}-vnet`;
+    const delegations = [{ name: "apps", properties: { serviceName: "Microsoft.App/environments" } }];
+    // The subnet is also listed inline, as VnetDefault does, so a later
+    // deployment of the VNet does not try to remove it.
+    const virtualNetwork = new VirtualNetwork(mergeDefaults({
+        name: vnetName,
+        location,
+        tags: mergedTags,
+        addressSpace: { addressPrefixes: [addressSpace] },
+        subnets: [{ name: "apps", properties: { addressPrefix: subnetPrefix, delegations } }],
+    }, defaults?.virtualNetwork), { apiVersion: "2023-05-01" });
+    const subnet = new Subnet(mergeDefaults({
+        name: `${vnetName}/apps`,
+        addressPrefix: subnetPrefix,
+        delegations,
+    }, defaults?.subnet), { apiVersion: "2023-05-01" });
+    return { virtualNetwork, subnet };
+}, "ContainerAppNetwork");
+/**
+ * A Container Apps environment in a subnet, shipping logs to its own Log
+ * Analytics workspace, with one app running as a user-assigned identity.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork, ContainerAppSite } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * export const site = ContainerAppSite({
+ *   name: "web",
+ *   app: "frontend",
+ *   subnetId: network.subnet.id,
+ *   image: "nginx:1.27",
+ * });
+ * ```
+ */
+export const ContainerAppSite = Composite((props) => {
+    const { name, app, subnetId, location = "[resourceGroup().location]", image = "mcr.microsoft.com/k8se/quickstart:latest", port = 80, replicas = 1, internal = false, tags = {}, defaults, } = props;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const workspaceName = `${name}-logs`;
+    const identityName = `${name}-${app}`;
+    const workspaceId = `resourceId('Microsoft.OperationalInsights/workspaces', '${workspaceName}')`;
+    const workspace = new LogAnalyticsWorkspace(mergeDefaults({
+        name: workspaceName,
+        location,
+        tags: mergedTags,
+        // A workspace's sku sits inside its properties, not beside them, so it is
+        // passed there rather than hoisted to the resource like other skus.
+        properties: { sku: { name: "PerGB2018" } },
+        retentionInDays: 30,
+    }, defaults?.workspace), { apiVersion: "2023-09-01" });
+    const identity = new ManagedIdentity(mergeDefaults({
+        name: identityName,
+        location,
+        tags: mergedTags,
+    }, defaults?.identity), { apiVersion: "2023-01-31" });
+    const environment = new managedEnvironments(mergeDefaults({
+        name,
+        location,
+        tags: mergedTags,
+        vnetConfiguration: { infrastructureSubnetId: subnetId, internal },
+        appLogsConfiguration: {
+            destination: "log-analytics",
+            logAnalyticsConfiguration: {
+                customerId: `[reference(${workspaceId}, '2023-09-01').customerId]`,
+                sharedKey: `[listKeys(${workspaceId}, '2023-09-01').primarySharedKey]`,
+            },
+        },
+        workloadProfiles: [{ name: "Consumption", workloadProfileType: "Consumption" }],
+    }, defaults?.environment), { apiVersion: "2024-03-01" });
+    const containerApp = new containerApps(mergeDefaults({
+        name: app,
+        location,
+        tags: mergedTags,
+        identity: {
+            type: "UserAssigned",
+            userAssignedIdentities: {
+                [`[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${identityName}')]`]: {},
+            },
+        },
+        managedEnvironmentId: environment.id,
+        workloadProfileName: "Consumption",
+        configuration: { ingress: { external: true, targetPort: port, transport: "auto" } },
+        template: {
+            containers: [{ name: app, image, resources: { cpu: 0.25, memory: "0.5Gi" } }],
+            scale: { minReplicas: replicas, maxReplicas: replicas },
+        },
+    }, defaults?.containerApp), { apiVersion: "2024-03-01" });
+    return { workspace, identity, environment, containerApp };
+}, "ContainerAppSite");

package/dist/composites/index.d.ts

@@ -28,6 +28,8 @@ export { RedisCache } from "./redis-cache.js";
 export type { RedisCacheProps, RedisCacheResult } from "./redis-cache.js";
 export { PrivateEndpoint } from "./private-endpoint.js";
 export type { PrivateEndpointProps, PrivateEndpointResult } from "./private-endpoint.js";
+export { ContainerAppNetwork, ContainerAppSite } from "./container-app.js";
+export type { ContainerAppNetworkProps, ContainerAppNetworkResult, ContainerAppSiteProps, ContainerAppSiteResult, } from "./container-app.js";
 export { GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink } from "./landing-zone.js";
 export type { GovernanceFoundationProps, GovernanceFoundationResult, GovernanceBaselineProps, GovernanceBaselineResult, LocationRestrictionProps, LocationRestrictionResult, ActivityLogSinkProps, ActivityLogSinkResult, } from "./landing-zone.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/composites/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,YAAY,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,YAAY,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACxG,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChH,YAAY,EACV,yBAAyB,EAAE,0BAA0B,EACrD,uBAAuB,EAAE,wBAAwB,EACjD,wBAAwB,EAAE,yBAAyB,EACnD,oBAAoB,EAAE,qBAAqB,GAC5C,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,YAAY,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,YAAY,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACxG,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,YAAY,EACV,wBAAwB,EAAE,yBAAyB,EACnD,qBAAqB,EAAE,sBAAsB,GAC9C,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChH,YAAY,EACV,yBAAyB,EAAE,0BAA0B,EACrD,uBAAuB,EAAE,wBAAwB,EACjD,wBAAwB,EAAE,yBAAyB,EACnD,oBAAoB,EAAE,qBAAqB,GAC5C,MAAM,gBAAgB,CAAC"}

package/dist/composites/index.js

@@ -13,4 +13,5 @@ export { ApplicationGateway } from "./application-gateway.js";
 export { ContainerInstance } from "./container-instance.js";
 export { RedisCache } from "./redis-cache.js";
 export { PrivateEndpoint } from "./private-endpoint.js";
+export { ContainerAppNetwork, ContainerAppSite } from "./container-app.js";
 export { GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink } from "./landing-zone.js";

package/dist/index.d.ts

@@ -16,7 +16,7 @@ export { isChildProject, type ChildProjectInstance } from "@intentius/chant/chil
 export { stackOutput, isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
 export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon-output";
 export * from "./generated/index.js";
-export { StorageAccountSecure, type StorageAccountSecureProps, type StorageAccountSecureResult, VnetDefault, type VnetDefaultProps, type VnetDefaultResult, VmLinux, type VmLinuxProps, type VmLinuxResult, AppService, type AppServiceProps, type AppServiceResult, AksCluster, type AksClusterProps, type AksClusterResult, SqlDatabase, type SqlDatabaseProps, type SqlDatabaseResult, KeyVaultSecure, type KeyVaultSecureProps, type KeyVaultSecureResult, ContainerRegistrySecure, type ContainerRegistrySecureProps, type ContainerRegistrySecureResult, FunctionApp, type FunctionAppProps, type FunctionAppResult, ServiceBusPipeline, type ServiceBusPipelineProps, type ServiceBusPipelineResult, CosmosDatabase, type CosmosDatabaseProps, type CosmosDatabaseResult, ApplicationGateway, type ApplicationGatewayProps, type ApplicationGatewayResult, ContainerInstance, type ContainerInstanceProps, type ContainerInstanceResult, RedisCache, type RedisCacheProps, type RedisCacheResult, PrivateEndpoint, type PrivateEndpointProps, type PrivateEndpointResult, GovernanceFoundation, type GovernanceFoundationProps, type GovernanceFoundationResult, GovernanceBaseline, type GovernanceBaselineProps, type GovernanceBaselineResult, LocationRestriction, type LocationRestrictionProps, type LocationRestrictionResult, ActivityLogSink, type ActivityLogSinkProps, type ActivityLogSinkResult, } from "./composites/index.js";
+export { StorageAccountSecure, type StorageAccountSecureProps, type StorageAccountSecureResult, VnetDefault, type VnetDefaultProps, type VnetDefaultResult, VmLinux, type VmLinuxProps, type VmLinuxResult, AppService, type AppServiceProps, type AppServiceResult, AksCluster, type AksClusterProps, type AksClusterResult, SqlDatabase, type SqlDatabaseProps, type SqlDatabaseResult, KeyVaultSecure, type KeyVaultSecureProps, type KeyVaultSecureResult, ContainerRegistrySecure, type ContainerRegistrySecureProps, type ContainerRegistrySecureResult, FunctionApp, type FunctionAppProps, type FunctionAppResult, ServiceBusPipeline, type ServiceBusPipelineProps, type ServiceBusPipelineResult, CosmosDatabase, type CosmosDatabaseProps, type CosmosDatabaseResult, ApplicationGateway, type ApplicationGatewayProps, type ApplicationGatewayResult, ContainerInstance, type ContainerInstanceProps, type ContainerInstanceResult, RedisCache, type RedisCacheProps, type RedisCacheResult, PrivateEndpoint, type PrivateEndpointProps, type PrivateEndpointResult, ContainerAppNetwork, type ContainerAppNetworkProps, type ContainerAppNetworkResult, ContainerAppSite, type ContainerAppSiteProps, type ContainerAppSiteResult, GovernanceFoundation, type GovernanceFoundationProps, type GovernanceFoundationResult, GovernanceBaseline, type GovernanceBaselineProps, type GovernanceBaselineResult, LocationRestriction, type LocationRestrictionProps, type LocationRestrictionResult, ActivityLogSink, type ActivityLogSinkProps, type ActivityLogSinkResult, } from "./composites/index.js";
 export { landingZoneConfig, locationRestriction, DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS, ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID, FOUNDATION_MANAGEMENT_GROUPS, } from "./governance.js";
 export type { AzureGovernanceConfig, LandingZoneConfigProps, ManagementGroupConfig, PolicyConfig, SubscriptionConfig, } from "./governance.js";
 export { StorageRoles, ComputeRoles, NetworkRoles, KeyVaultRoles, SqlRoles, ContainerRoles, AppServiceRoles, IdentityRoles, } from "./actions/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGxG,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EACtE,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,mBAAmB,EACtC,sBAAsB,EAAE,oBAAoB,EAC5C,2CAA2C,EAAE,4BAA4B,GAC1E,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,qBAAqB,EAAE,sBAAsB,EAC7C,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,GACxD,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGxG,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EACtE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EACzE,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,mBAAmB,EACtC,sBAAsB,EAAE,oBAAoB,EAC5C,2CAA2C,EAAE,4BAA4B,GAC1E,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,qBAAqB,EAAE,sBAAsB,EAC7C,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,GACxD,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -30,7 +30,7 @@ export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon
 // --- Generated resource classes ---
 export * from "./generated/index.js";
 // --- Composites ---
-export { StorageAccountSecure, VnetDefault, VmLinux, AppService, AksCluster, SqlDatabase, KeyVaultSecure, ContainerRegistrySecure, FunctionApp, ServiceBusPipeline, CosmosDatabase, ApplicationGateway, ContainerInstance, RedisCache, PrivateEndpoint, GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink, } from "./composites/index.js";
+export { StorageAccountSecure, VnetDefault, VmLinux, AppService, AksCluster, SqlDatabase, KeyVaultSecure, ContainerRegistrySecure, FunctionApp, ServiceBusPipeline, CosmosDatabase, ApplicationGateway, ContainerInstance, RedisCache, PrivateEndpoint, ContainerAppNetwork, ContainerAppSite, GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink, } from "./composites/index.js";
 // Azure governance authoring: the desired-state config the Azure
 // external governance reconciler applies, and the typed landing-zone authoring layer.
 export { landingZoneConfig, locationRestriction, DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS, ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID, FOUNDATION_MANAGEMENT_GROUPS, } from "./governance.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "6d96e57d05d492a3402cf1747adb5bea4cb892aa0c471a8a762f64965657a8fe",
+    "manifest.json": "6a7ba60e1ad5cc1b94809c91f7dab1293ceec2074f2600f4b8ce4ea81a242421",
     "meta.json": "d2521221ed616d882ded4296f0071685bd74e4b645d55dabc9685733c37dc419",
     "types/index.d.ts": "29631032bda9533849178968290e65d72250eab0b8bab424f2d9ef9b4e8546a4",
     "rules/hardcoded-location.ts": "0b895449c8c94066e81721c46be24249231029fe13b471477456df5c4e45b8bf",
@@ -32,10 +32,10 @@
     "rules/azr031.ts": "7f0654c9dce1e3a1a86818d8b4d0201fb4600021f7a4a757c36b1513fe16e0fd",
     "rules/azr032.ts": "ea94cc7fdece0812c43898c76c4b8a115a306157b741fe3b76fe726335f6c2d2",
     "rules/azr033.ts": "d440ec79a1563160bb7c8cc29c81880da71997c872215f14ec3be18f05a07ed3",
-    "skills/chant-azure.md": "86399e4fafd35cdf56670b32dbff5db42a4bfa1453b25231c4ee15eea9a2a1b9",
-    "skills/chant-azure-security.md": "95ab789202662f60b43cf2fce1ae549cbcf5b689306481dabb656847281879ff",
-    "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
+    "skills/chant-azure.md": "e81c3a12c31196e3eebe399443328caacf65db61380a621d1fb6f1c359f6a077",
+    "skills/chant-azure-security.md": "d9a7a99c861dcab1ff6d0653f1e13e28d907babd045ae67c524b32b6ab80691e",
+    "skills/chant-azure-patterns.md": "2d8cb8bbeda73b695856cec4ddaf5b3a0efce76e4ee6e3cf14b90ca69dee5757",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "170c51b22ffa7e7a75bdfa326ad514cf831357abb659803cd217edf6102f2925"
+  "composite": "2dba446de8873706991b76fe0621dcb83200ee6771fdbe1dd4334ac10ecddfb0"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.124.38",
+  "version": "0.124.39",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/skills/chant-azure-patterns.md

@@ -408,6 +408,22 @@ const { privateEndpoint, privateDnsZone, dnsZoneGroup, vnetLink } = PrivateEndpo
 export { storageAccount, privateEndpoint, privateDnsZone, dnsZoneGroup, vnetLink };
 ```
 
+### ContainerAppNetwork and ContainerAppSite
+A Container Apps site in its own delegated subnet; one network can carry several sites:
+
+```ts
+import { ContainerAppNetwork, ContainerAppSite } from "@intentius/chant-lexicon-azure";
+
+export const network = ContainerAppNetwork({ name: "web" });
+
+export const site = ContainerAppSite({
+  name: "web",
+  app: "frontend",
+  subnetId: network.subnet.id,
+  image: "nginx:1.27",
+});
+```
+
 ## ARM Template Intrinsic Reference
 
 | Function | Description | Example |

package/dist/skills/chant-azure-security.md

@@ -267,6 +267,7 @@ Use the secure composite variants which apply these patterns automatically:
 - `ContainerInstance` — Managed identity, no public IP by default
 - `RedisCache` — Non-SSL port disabled, TLS 1.2
 - `PrivateEndpoint` — Private connectivity pattern with DNS zone
+- `ContainerAppSite`: user-assigned identity, app logs to Log Analytics, optional VNet-only environment
 
 ## Post-Synth Check Reference
 

package/dist/skills/chant-azure.md

@@ -157,6 +157,8 @@ Composites group related Azure resources with secure defaults. Each returns an o
 | `ContainerInstance` | ContainerGroup | No public IP by default, resource limits set |
 | `RedisCache` | RedisCache | TLS 1.2 required, non-SSL port disabled |
 | `PrivateEndpoint` | PrivateEndpoint + PrivateDnsZone + VnetLink | DNS zone auto-registration, manual approval disabled |
+| `ContainerAppNetwork` | VirtualNetwork + Subnet | Subnet delegated to Container Apps, /23 by default |
+| `ContainerAppSite` | LogAnalyticsWorkspace + ManagedIdentity + ManagedEnvironment + ContainerApp | App logs to Log Analytics, user-assigned identity, Consumption profile |
 | `AksCluster` | ManagedCluster + AgentPool | RBAC enabled, network policy (calico), managed identity, Azure CNI |
 | `SqlDatabase` | SQLServer + Database + FirewallRule + AuditingSettings | TDE enabled, auditing enabled, TLS 1.2, no Azure-wide firewall rule |
 | `KeyVaultSecure` | KeyVault + AccessPolicy | Soft delete, purge protection, RBAC authorization, network ACLs |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.124.38",
+  "version": "0.124.39",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,6 +74,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.38"
+    "@intentius/chant": "^0.124.39"
   }
 }

package/src/composites/catalog.ts

@@ -172,6 +172,126 @@ export const compositeCatalog: CompositeEntry[] = [
       }
     ]
   },
+  {
+    "name": "ContainerAppNetwork",
+    "lexicon": "azure",
+    "description": "A VNet with a subnet delegated to `Microsoft.App/environments`, for ContainerAppSite environments to sit in.",
+    "bundles": [
+      "Subnet",
+      "VirtualNetwork"
+    ],
+    "params": [
+      {
+        "name": "name",
+        "type": "string",
+        "required": true,
+        "description": "Network name prefix: the VNet is `<name>-vnet`, its subnet `apps`."
+      },
+      {
+        "name": "location",
+        "type": "string",
+        "required": false,
+        "description": "Azure region (default: resource group location)."
+      },
+      {
+        "name": "addressSpace",
+        "type": "string",
+        "required": false,
+        "description": "VNet address space (default: \"10.0.0.0/16\")."
+      },
+      {
+        "name": "subnetPrefix",
+        "type": "string",
+        "required": false,
+        "description": "The environment subnet's prefix, a /23 or larger (default: \"10.0.0.0/23\")."
+      },
+      {
+        "name": "tags",
+        "type": "Record<string, string>",
+        "required": false,
+        "description": "Resource tags."
+      },
+      {
+        "name": "defaults",
+        "type": "{ virtualNetwork?: Partial<ConstructorParameters<typeof VirtualNetwork>[0]>; subnet?: Partial<ConstructorParameters<t...",
+        "required": false,
+        "description": "Per-member defaults."
+      }
+    ]
+  },
+  {
+    "name": "ContainerAppSite",
+    "lexicon": "azure",
+    "description": "A Container Apps environment in a subnet, shipping logs to its own Log Analytics workspace, with one app running as a user-assigned identity.",
+    "bundles": [
+      "LogAnalyticsWorkspace",
+      "ManagedIdentity",
+      "containerApps",
+      "managedEnvironments"
+    ],
+    "params": [
+      {
+        "name": "name",
+        "type": "string",
+        "required": true,
+        "description": "Environment name; the workspace is `<name>-logs` and the identity `<name>-<app>`."
+      },
+      {
+        "name": "app",
+        "type": "string",
+        "required": true,
+        "description": "Container app name."
+      },
+      {
+        "name": "subnetId",
+        "type": "string",
+        "required": true,
+        "description": "Subnet resource ID for the environment, such as a ContainerAppNetwork's `subnet.id`."
+      },
+      {
+        "name": "location",
+        "type": "string",
+        "required": false,
+        "description": "Azure region (default: resource group location)."
+      },
+      {
+        "name": "image",
+        "type": "string",
+        "required": false,
+        "description": "Container image (default: \"mcr.microsoft.com/k8se/quickstart:latest\")."
+      },
+      {
+        "name": "port",
+        "type": "number",
+        "required": false,
+        "description": "Port the container listens on; ingress forwards to it (default: 80)."
+      },
+      {
+        "name": "replicas",
+        "type": "number",
+        "required": false,
+        "description": "Fixed replica count (default: 1)."
+      },
+      {
+        "name": "internal",
+        "type": "boolean",
+        "required": false,
+        "description": "Make the environment reachable only from its VNet (default: false)."
+      },
+      {
+        "name": "tags",
+        "type": "Record<string, string>",
+        "required": false,
+        "description": "Resource tags."
+      },
+      {
+        "name": "defaults",
+        "type": "{ workspace?: Partial<ConstructorParameters<typeof LogAnalyticsWorkspace>[0]>; identity?: Partial<ConstructorParamete...",
+        "required": false,
+        "description": "Per-member defaults."
+      }
+    ]
+  },
   {
     "name": "ContainerInstance",
     "lexicon": "azure",

package/src/composites/composites.test.ts

@@ -14,6 +14,7 @@ import { ApplicationGateway } from "./application-gateway";
 import { ContainerInstance } from "./container-instance";
 import { RedisCache } from "./redis-cache";
 import { PrivateEndpoint } from "./private-endpoint";
+import { ContainerAppNetwork, ContainerAppSite } from "./container-app";
 import { isCompositeInstance } from "@intentius/chant";
 
 /** Helper to get flat props from a generated resource instance. */
@@ -744,3 +745,91 @@ describe("PrivateEndpoint", () => {
     expect(peTags["managed-by"]).toBe("chant");
   });
 });
+
+// --- ContainerAppNetwork ---
+
+describe("ContainerAppNetwork", () => {
+  test("returns a VNet and its subnet", () => {
+    const result = ContainerAppNetwork({ name: "web" });
+    expect(Object.keys(result.members)).toEqual(["virtualNetwork", "subnet"]);
+    expect(et(result.virtualNetwork)).toBe("Microsoft.Network/virtualNetworks");
+    expect(et(result.subnet)).toBe("Microsoft.Network/virtualNetworks_subnets");
+  });
+
+  test("names the subnet as a child of <name>-vnet and delegates it to Container Apps", () => {
+    const { virtualNetwork, subnet } = ContainerAppNetwork({ name: "web", subnetPrefix: "10.1.0.0/23" });
+    expect(p(virtualNetwork).name).toBe("web-vnet");
+    expect(p(subnet).name).toBe("web-vnet/apps");
+    expect(p(subnet).addressPrefix).toBe("10.1.0.0/23");
+    const delegations = p(subnet).delegations as Array<{ properties: { serviceName: string } }>;
+    expect(delegations[0].properties.serviceName).toBe("Microsoft.App/environments");
+  });
+
+  test("lists the subnet inline on the VNet too", () => {
+    const { virtualNetwork } = ContainerAppNetwork({ name: "web" });
+    const subnets = p(virtualNetwork).subnets as Array<{ name: string; properties: { addressPrefix: string } }>;
+    expect(subnets).toHaveLength(1);
+    expect(subnets[0].name).toBe("apps");
+    expect(subnets[0].properties.addressPrefix).toBe("10.0.0.0/23");
+  });
+
+  test("defaults override a member's props", () => {
+    const { virtualNetwork } = ContainerAppNetwork({ name: "web", defaults: { virtualNetwork: { location: "westeurope" } } });
+    expect(p(virtualNetwork).location).toBe("westeurope");
+  });
+});
+
+// --- ContainerAppSite ---
+
+describe("ContainerAppSite", () => {
+  const subnetId = "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'web-vnet', 'apps')]";
+
+  test("returns a workspace, identity, environment and app", () => {
+    const result = ContainerAppSite({ name: "web", app: "frontend", subnetId });
+    expect(Object.keys(result.members)).toEqual(["workspace", "identity", "environment", "containerApp"]);
+    expect(et(result.workspace)).toBe("Microsoft.OperationalInsights/workspaces");
+    expect(et(result.identity)).toBe("Microsoft.ManagedIdentity/userAssignedIdentities");
+    expect(et(result.environment)).toBe("Microsoft.App/managedEnvironments");
+    expect(et(result.containerApp)).toBe("Microsoft.App/containerApps");
+  });
+
+  test("puts the environment in the subnet on the Consumption profile, logging to the workspace", () => {
+    const { workspace, environment } = ContainerAppSite({ name: "web", app: "frontend", subnetId });
+    expect(p(workspace).name).toBe("web-logs");
+    const env = p(environment);
+    expect(env.vnetConfiguration).toEqual({ infrastructureSubnetId: subnetId, internal: false });
+    expect(env.workloadProfiles).toEqual([{ name: "Consumption", workloadProfileType: "Consumption" }]);
+    const logs = (env.appLogsConfiguration as { logAnalyticsConfiguration: Record<string, string> }).logAnalyticsConfiguration;
+    expect(logs.customerId).toContain("reference(resourceId('Microsoft.OperationalInsights/workspaces', 'web-logs')");
+    expect(logs.sharedKey).toContain("listKeys(resourceId('Microsoft.OperationalInsights/workspaces', 'web-logs')");
+  });
+
+  test("runs the app as the identity behind external ingress", () => {
+    const { identity, containerApp } = ContainerAppSite({ name: "web", app: "frontend", subnetId, image: "nginx:1.27", port: 8080, replicas: 2 });
+    expect(p(identity).name).toBe("web-frontend");
+    const app = p(containerApp);
+    expect(app.name).toBe("frontend");
+    const ids = (app.identity as { userAssignedIdentities: Record<string, unknown> }).userAssignedIdentities;
+    expect(Object.keys(ids)).toEqual(["[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'web-frontend')]"]);
+    expect(app.configuration).toEqual({ ingress: { external: true, targetPort: 8080, transport: "auto" } });
+    const template = app.template as { containers: Array<{ image: string }>; scale: Record<string, number> };
+    expect(template.containers[0].image).toBe("nginx:1.27");
+    expect(template.scale).toEqual({ minReplicas: 2, maxReplicas: 2 });
+  });
+
+  test("internal makes the environment VNet-only", () => {
+    const { environment } = ContainerAppSite({ name: "web", app: "frontend", subnetId, internal: true });
+    expect((p(environment).vnetConfiguration as Record<string, unknown>).internal).toBe(true);
+  });
+
+  test("defaults override a member's props", () => {
+    const { workspace } = ContainerAppSite({ name: "web", app: "frontend", subnetId, defaults: { workspace: { retentionInDays: 90 } } });
+    expect(p(workspace).retentionInDays).toBe(90);
+  });
+
+  test("takes a ContainerAppNetwork's subnet id", () => {
+    const network = ContainerAppNetwork({ name: "web" });
+    const { environment } = ContainerAppSite({ name: "web", app: "frontend", subnetId: network.subnet.id });
+    expect((p(environment).vnetConfiguration as Record<string, unknown>).infrastructureSubnetId).toBe(network.subnet.id);
+  });
+});

package/src/composites/container-app.ts

@@ -0,0 +1,209 @@
+/**
+ * ContainerAppNetwork and ContainerAppSite composites: a website on Azure
+ * Container Apps and the network it sits in.
+ *
+ * Split the way the aws lexicon splits VpcDefault from FargateAlb, so several
+ * sites can share one network. Container Apps brings its own ingress and load
+ * balancing, so there is no load balancer to declare.
+ */
+
+import { Composite, mergeDefaults } from "@intentius/chant";
+import {
+  VirtualNetwork,
+  Subnet,
+  LogAnalyticsWorkspace,
+  ManagedIdentity,
+  managedEnvironments,
+  containerApps,
+} from "../generated";
+
+export interface ContainerAppNetworkProps {
+  /** Network name prefix: the VNet is `<name>-vnet`, its subnet `apps`. */
+  name: string;
+  /** Azure region (default: resource group location). */
+  location?: string;
+  /** VNet address space (default: "10.0.0.0/16"). */
+  addressSpace?: string;
+  /** The environment subnet's prefix, a /23 or larger (default: "10.0.0.0/23"). */
+  subnetPrefix?: string;
+  /** Resource tags. */
+  tags?: Record<string, string>;
+  /** Per-member defaults. */
+  defaults?: {
+    virtualNetwork?: Partial<ConstructorParameters<typeof VirtualNetwork>[0]>;
+    subnet?: Partial<ConstructorParameters<typeof Subnet>[0]>;
+  };
+}
+
+export interface ContainerAppNetworkResult {
+  virtualNetwork: InstanceType<typeof VirtualNetwork>;
+  subnet: InstanceType<typeof Subnet>;
+}
+
+/**
+ * A VNet with a subnet delegated to `Microsoft.App/environments`, for
+ * ContainerAppSite environments to sit in.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * ```
+ */
+export const ContainerAppNetwork = Composite((props: ContainerAppNetworkProps) => {
+  const {
+    name,
+    location = "[resourceGroup().location]",
+    addressSpace = "10.0.0.0/16",
+    subnetPrefix = "10.0.0.0/23",
+    tags = {},
+    defaults,
+  } = props;
+
+  const mergedTags = { "managed-by": "chant", ...tags };
+  const vnetName = `${name}-vnet`;
+  const delegations = [{ name: "apps", properties: { serviceName: "Microsoft.App/environments" } }];
+
+  // The subnet is also listed inline, as VnetDefault does, so a later
+  // deployment of the VNet does not try to remove it.
+  const virtualNetwork = new VirtualNetwork(mergeDefaults({
+    name: vnetName,
+    location,
+    tags: mergedTags,
+    addressSpace: { addressPrefixes: [addressSpace] },
+    subnets: [{ name: "apps", properties: { addressPrefix: subnetPrefix, delegations } }],
+  }, defaults?.virtualNetwork), { apiVersion: "2023-05-01" });
+
+  const subnet = new Subnet(mergeDefaults({
+    name: `${vnetName}/apps`,
+    addressPrefix: subnetPrefix,
+    delegations,
+  }, defaults?.subnet), { apiVersion: "2023-05-01" });
+
+  return { virtualNetwork, subnet };
+}, "ContainerAppNetwork");
+
+export interface ContainerAppSiteProps {
+  /** Environment name; the workspace is `<name>-logs` and the identity `<name>-<app>`. */
+  name: string;
+  /** Container app name. */
+  app: string;
+  /** Subnet resource ID for the environment, such as a ContainerAppNetwork's `subnet.id`. */
+  subnetId: string;
+  /** Azure region (default: resource group location). */
+  location?: string;
+  /** Container image (default: "mcr.microsoft.com/k8se/quickstart:latest"). */
+  image?: string;
+  /** Port the container listens on; ingress forwards to it (default: 80). */
+  port?: number;
+  /** Fixed replica count (default: 1). */
+  replicas?: number;
+  /** Make the environment reachable only from its VNet (default: false). */
+  internal?: boolean;
+  /** Resource tags. */
+  tags?: Record<string, string>;
+  /** Per-member defaults. */
+  defaults?: {
+    workspace?: Partial<ConstructorParameters<typeof LogAnalyticsWorkspace>[0]>;
+    identity?: Partial<ConstructorParameters<typeof ManagedIdentity>[0]>;
+    environment?: Partial<ConstructorParameters<typeof managedEnvironments>[0]>;
+    containerApp?: Partial<ConstructorParameters<typeof containerApps>[0]>;
+  };
+}
+
+export interface ContainerAppSiteResult {
+  workspace: InstanceType<typeof LogAnalyticsWorkspace>;
+  identity: InstanceType<typeof ManagedIdentity>;
+  environment: InstanceType<typeof managedEnvironments>;
+  containerApp: InstanceType<typeof containerApps>;
+}
+
+/**
+ * A Container Apps environment in a subnet, shipping logs to its own Log
+ * Analytics workspace, with one app running as a user-assigned identity.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork, ContainerAppSite } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * export const site = ContainerAppSite({
+ *   name: "web",
+ *   app: "frontend",
+ *   subnetId: network.subnet.id,
+ *   image: "nginx:1.27",
+ * });
+ * ```
+ */
+export const ContainerAppSite = Composite((props: ContainerAppSiteProps) => {
+  const {
+    name,
+    app,
+    subnetId,
+    location = "[resourceGroup().location]",
+    image = "mcr.microsoft.com/k8se/quickstart:latest",
+    port = 80,
+    replicas = 1,
+    internal = false,
+    tags = {},
+    defaults,
+  } = props;
+
+  const mergedTags = { "managed-by": "chant", ...tags };
+  const workspaceName = `${name}-logs`;
+  const identityName = `${name}-${app}`;
+  const workspaceId = `resourceId('Microsoft.OperationalInsights/workspaces', '${workspaceName}')`;
+
+  const workspace = new LogAnalyticsWorkspace(mergeDefaults({
+    name: workspaceName,
+    location,
+    tags: mergedTags,
+    // A workspace's sku sits inside its properties, not beside them, so it is
+    // passed there rather than hoisted to the resource like other skus.
+    properties: { sku: { name: "PerGB2018" } },
+    retentionInDays: 30,
+  }, defaults?.workspace), { apiVersion: "2023-09-01" });
+
+  const identity = new ManagedIdentity(mergeDefaults({
+    name: identityName,
+    location,
+    tags: mergedTags,
+  }, defaults?.identity), { apiVersion: "2023-01-31" });
+
+  const environment = new managedEnvironments(mergeDefaults({
+    name,
+    location,
+    tags: mergedTags,
+    vnetConfiguration: { infrastructureSubnetId: subnetId, internal },
+    appLogsConfiguration: {
+      destination: "log-analytics",
+      logAnalyticsConfiguration: {
+        customerId: `[reference(${workspaceId}, '2023-09-01').customerId]`,
+        sharedKey: `[listKeys(${workspaceId}, '2023-09-01').primarySharedKey]`,
+      },
+    },
+    workloadProfiles: [{ name: "Consumption", workloadProfileType: "Consumption" }],
+  }, defaults?.environment), { apiVersion: "2024-03-01" });
+
+  const containerApp = new containerApps(mergeDefaults({
+    name: app,
+    location,
+    tags: mergedTags,
+    identity: {
+      type: "UserAssigned",
+      userAssignedIdentities: {
+        [`[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${identityName}')]`]: {},
+      },
+    },
+    managedEnvironmentId: environment.id,
+    workloadProfileName: "Consumption",
+    configuration: { ingress: { external: true, targetPort: port, transport: "auto" } },
+    template: {
+      containers: [{ name: app, image, resources: { cpu: 0.25, memory: "0.5Gi" } }],
+      scale: { minReplicas: replicas, maxReplicas: replicas },
+    },
+  }, defaults?.containerApp), { apiVersion: "2024-03-01" });
+
+  return { workspace, identity, environment, containerApp };
+}, "ContainerAppSite");

package/src/composites/index.ts

@@ -28,6 +28,11 @@ export { RedisCache } from "./redis-cache";
 export type { RedisCacheProps, RedisCacheResult } from "./redis-cache";
 export { PrivateEndpoint } from "./private-endpoint";
 export type { PrivateEndpointProps, PrivateEndpointResult } from "./private-endpoint";
+export { ContainerAppNetwork, ContainerAppSite } from "./container-app";
+export type {
+  ContainerAppNetworkProps, ContainerAppNetworkResult,
+  ContainerAppSiteProps, ContainerAppSiteResult,
+} from "./container-app";
 export { GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink } from "./landing-zone";
 export type {
   GovernanceFoundationProps, GovernanceFoundationResult,

package/src/index.ts

@@ -78,6 +78,8 @@ export {
   ContainerInstance, type ContainerInstanceProps, type ContainerInstanceResult,
   RedisCache, type RedisCacheProps, type RedisCacheResult,
   PrivateEndpoint, type PrivateEndpointProps, type PrivateEndpointResult,
+  ContainerAppNetwork, type ContainerAppNetworkProps, type ContainerAppNetworkResult,
+  ContainerAppSite, type ContainerAppSiteProps, type ContainerAppSiteResult,
   GovernanceFoundation, type GovernanceFoundationProps, type GovernanceFoundationResult,
   GovernanceBaseline, type GovernanceBaselineProps, type GovernanceBaselineResult,
   LocationRestriction, type LocationRestrictionProps, type LocationRestrictionResult,

package/src/skills/chant-azure-patterns.md

@@ -408,6 +408,22 @@ const { privateEndpoint, privateDnsZone, dnsZoneGroup, vnetLink } = PrivateEndpo
 export { storageAccount, privateEndpoint, privateDnsZone, dnsZoneGroup, vnetLink };
 ```
 
+### ContainerAppNetwork and ContainerAppSite
+A Container Apps site in its own delegated subnet; one network can carry several sites:
+
+```ts
+import { ContainerAppNetwork, ContainerAppSite } from "@intentius/chant-lexicon-azure";
+
+export const network = ContainerAppNetwork({ name: "web" });
+
+export const site = ContainerAppSite({
+  name: "web",
+  app: "frontend",
+  subnetId: network.subnet.id,
+  image: "nginx:1.27",
+});
+```
+
 ## ARM Template Intrinsic Reference
 
 | Function | Description | Example |

package/src/skills/chant-azure-security.md

@@ -267,6 +267,7 @@ Use the secure composite variants which apply these patterns automatically:
 - `ContainerInstance` — Managed identity, no public IP by default
 - `RedisCache` — Non-SSL port disabled, TLS 1.2
 - `PrivateEndpoint` — Private connectivity pattern with DNS zone
+- `ContainerAppSite`: user-assigned identity, app logs to Log Analytics, optional VNet-only environment
 
 ## Post-Synth Check Reference
 

package/src/skills/chant-azure.md

@@ -157,6 +157,8 @@ Composites group related Azure resources with secure defaults. Each returns an o
 | `ContainerInstance` | ContainerGroup | No public IP by default, resource limits set |
 | `RedisCache` | RedisCache | TLS 1.2 required, non-SSL port disabled |
 | `PrivateEndpoint` | PrivateEndpoint + PrivateDnsZone + VnetLink | DNS zone auto-registration, manual approval disabled |
+| `ContainerAppNetwork` | VirtualNetwork + Subnet | Subnet delegated to Container Apps, /23 by default |
+| `ContainerAppSite` | LogAnalyticsWorkspace + ManagedIdentity + ManagedEnvironment + ContainerApp | App logs to Log Analytics, user-assigned identity, Consumption profile |
 | `AksCluster` | ManagedCluster + AgentPool | RBAC enabled, network policy (calico), managed identity, Azure CNI |
 | `SqlDatabase` | SQLServer + Database + FirewallRule + AuditingSettings | TDE enabled, auditing enabled, TLS 1.2, no Azure-wide firewall rule |
 | `KeyVaultSecure` | KeyVault + AccessPolicy | Soft delete, purge protection, RBAC authorization, network ACLs |