@intentius/chant-lexicon-azure 0.124.38 → 0.124.40

package/dist/composites/container-app.d.ts

@@ -0,0 +1,102 @@
+/**
+ * ContainerAppNetwork and ContainerAppSite composites: a website on Azure
+ * Container Apps and the network it sits in.
+ *
+ * Split the way the aws lexicon splits VpcDefault from FargateAlb, so several
+ * sites can share one network. Container Apps brings its own ingress and load
+ * balancing, so there is no load balancer to declare.
+ */
+import { VirtualNetwork, Subnet, LogAnalyticsWorkspace, ManagedIdentity, managedEnvironments, containerApps } from "../generated/index.js";
+export interface ContainerAppNetworkProps {
+    /** Network name prefix: the VNet is `<name>-vnet`, its subnet `apps`. */
+    name: string;
+    /** Azure region (default: resource group location). */
+    location?: string;
+    /** VNet address space (default: "10.0.0.0/16"). */
+    addressSpace?: string;
+    /** The environment subnet's prefix, a /23 or larger (default: "10.0.0.0/23"). */
+    subnetPrefix?: string;
+    /** Resource tags. */
+    tags?: Record<string, string>;
+    /** Per-member defaults. */
+    defaults?: {
+        virtualNetwork?: Partial<ConstructorParameters<typeof VirtualNetwork>[0]>;
+        subnet?: Partial<ConstructorParameters<typeof Subnet>[0]>;
+    };
+}
+export interface ContainerAppNetworkResult {
+    virtualNetwork: InstanceType<typeof VirtualNetwork>;
+    subnet: InstanceType<typeof Subnet>;
+}
+/**
+ * A VNet with a subnet delegated to `Microsoft.App/environments`, for
+ * ContainerAppSite environments to sit in.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * ```
+ */
+export declare const ContainerAppNetwork: import("@intentius/chant").CompositeDefinition<ContainerAppNetworkProps, {
+    virtualNetwork: import("@intentius/chant").Declarable & Record<string, string>;
+    subnet: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+export interface ContainerAppSiteProps {
+    /** Environment name; the workspace is `<name>-logs` and the identity `<name>-<app>`. */
+    name: string;
+    /** Container app name. */
+    app: string;
+    /** Subnet resource ID for the environment, such as a ContainerAppNetwork's `subnet.id`. */
+    subnetId: string;
+    /** Azure region (default: resource group location). */
+    location?: string;
+    /** Container image (default: "mcr.microsoft.com/k8se/quickstart:latest"). */
+    image?: string;
+    /** Port the container listens on; ingress forwards to it (default: 80). */
+    port?: number;
+    /** Fixed replica count (default: 1). */
+    replicas?: number;
+    /** Make the environment reachable only from its VNet (default: false). */
+    internal?: boolean;
+    /** Resource tags. */
+    tags?: Record<string, string>;
+    /** Per-member defaults. */
+    defaults?: {
+        workspace?: Partial<ConstructorParameters<typeof LogAnalyticsWorkspace>[0]>;
+        identity?: Partial<ConstructorParameters<typeof ManagedIdentity>[0]>;
+        environment?: Partial<ConstructorParameters<typeof managedEnvironments>[0]>;
+        containerApp?: Partial<ConstructorParameters<typeof containerApps>[0]>;
+    };
+}
+export interface ContainerAppSiteResult {
+    workspace: InstanceType<typeof LogAnalyticsWorkspace>;
+    identity: InstanceType<typeof ManagedIdentity>;
+    environment: InstanceType<typeof managedEnvironments>;
+    containerApp: InstanceType<typeof containerApps>;
+}
+/**
+ * A Container Apps environment in a subnet, shipping logs to its own Log
+ * Analytics workspace, with one app running as a user-assigned identity.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork, ContainerAppSite } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * export const site = ContainerAppSite({
+ *   name: "web",
+ *   app: "frontend",
+ *   subnetId: network.subnet.id,
+ *   image: "nginx:1.27",
+ * });
+ * ```
+ */
+export declare const ContainerAppSite: import("@intentius/chant").CompositeDefinition<ContainerAppSiteProps, {
+    workspace: import("@intentius/chant").Declarable & Record<string, string>;
+    identity: import("@intentius/chant").Declarable & Record<string, string>;
+    environment: import("@intentius/chant").Declarable & Record<string, string>;
+    containerApp: import("@intentius/chant").Declarable & Record<string, string>;
+}>;
+//# sourceMappingURL=container-app.d.ts.map

package/dist/composites/container-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-app.d.ts","sourceRoot":"","sources":["../../src/composites/container-app.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,cAAc,EACd,MAAM,EACN,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,aAAa,EACd,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,wBAAwB;IACvC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,MAAM,EAAE,YAAY,CAAC,OAAO,MAAM,CAAC,CAAC;CACrC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB;;;EAyCP,CAAC;AAa1B,MAAM,WAAW,qBAAqB;IACpC,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,WAAW,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,YAAY,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACxE,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,YAAY,CAAC,OAAO,qBAAqB,CAAC,CAAC;IACtD,QAAQ,EAAE,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;IAC/C,WAAW,EAAE,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACtD,YAAY,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB;;;;;EAsEP,CAAC"}

package/dist/composites/container-app.js

@@ -0,0 +1,130 @@
+/**
+ * ContainerAppNetwork and ContainerAppSite composites: a website on Azure
+ * Container Apps and the network it sits in.
+ *
+ * Split the way the aws lexicon splits VpcDefault from FargateAlb, so several
+ * sites can share one network. Container Apps brings its own ingress and load
+ * balancing, so there is no load balancer to declare.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { VirtualNetwork, Subnet, LogAnalyticsWorkspace, ManagedIdentity, managedEnvironments, containerApps, } from "../generated/index.js";
+/**
+ * A VNet with a subnet delegated to `Microsoft.App/environments`, for
+ * ContainerAppSite environments to sit in.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * ```
+ */
+export const ContainerAppNetwork = Composite((props) => {
+    const { name, location = "[resourceGroup().location]", addressSpace = "10.0.0.0/16", subnetPrefix = "10.0.0.0/23", tags = {}, defaults, } = props;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const vnetName = `${name}-vnet`;
+    const delegations = [{ name: "apps", properties: { serviceName: "Microsoft.App/environments" } }];
+    const subnet = new Subnet(mergeDefaults({
+        name: `${vnetName}/apps`,
+        addressPrefix: subnetPrefix,
+        delegations,
+    }, defaults?.subnet), { apiVersion: "2023-05-01" });
+    // The subnet is also listed inline, as VnetDefault does, so a later
+    // deployment of the VNet does not try to remove it. The inline entry is
+    // built from the Subnet resource's merged props, so `defaults.subnet`
+    // reaches both copies. The apps entry always comes first; a caller's
+    // `defaults.virtualNetwork.subnets` adds the other subnets after it, and
+    // an entry of theirs named "apps" is replaced by this one.
+    const { subnets: extraSubnets, ...vnetDefaults } = (defaults?.virtualNetwork ?? {});
+    const virtualNetwork = new VirtualNetwork(mergeDefaults({
+        name: vnetName,
+        location,
+        tags: mergedTags,
+        addressSpace: { addressPrefixes: [addressSpace] },
+        subnets: [
+            inlineSubnet("apps", subnetProps(subnet)),
+            ...(extraSubnets ?? []).filter((s) => s?.name !== "apps"),
+        ],
+    }, vnetDefaults), { apiVersion: "2023-05-01" });
+    return { virtualNetwork, subnet };
+}, "ContainerAppNetwork");
+/** A Subnet resource's props, flat or under `properties`. */
+function subnetProps(subnet) {
+    return subnet.props;
+}
+/** The VNet's inline entry for a subnet, from that Subnet resource's props. */
+function inlineSubnet(name, props) {
+    const { name: _name, id: _id, properties, ...flat } = props;
+    return { name, properties: { ...flat, ...properties } };
+}
+/**
+ * A Container Apps environment in a subnet, shipping logs to its own Log
+ * Analytics workspace, with one app running as a user-assigned identity.
+ *
+ * @example
+ * ```ts
+ * import { ContainerAppNetwork, ContainerAppSite } from "@intentius/chant-lexicon-azure";
+ *
+ * export const network = ContainerAppNetwork({ name: "web" });
+ * export const site = ContainerAppSite({
+ *   name: "web",
+ *   app: "frontend",
+ *   subnetId: network.subnet.id,
+ *   image: "nginx:1.27",
+ * });
+ * ```
+ */
+export const ContainerAppSite = Composite((props) => {
+    const { name, app, subnetId, location = "[resourceGroup().location]", image = "mcr.microsoft.com/k8se/quickstart:latest", port = 80, replicas = 1, internal = false, tags = {}, defaults, } = props;
+    const mergedTags = { "managed-by": "chant", ...tags };
+    const workspaceName = `${name}-logs`;
+    const identityName = `${name}-${app}`;
+    const workspaceId = `resourceId('Microsoft.OperationalInsights/workspaces', '${workspaceName}')`;
+    const workspace = new LogAnalyticsWorkspace(mergeDefaults({
+        name: workspaceName,
+        location,
+        tags: mergedTags,
+        // A workspace's sku sits inside its properties, not beside them, so it is
+        // passed there rather than hoisted to the resource like other skus.
+        properties: { sku: { name: "PerGB2018" } },
+        retentionInDays: 30,
+    }, defaults?.workspace), { apiVersion: "2023-09-01" });
+    const identity = new ManagedIdentity(mergeDefaults({
+        name: identityName,
+        location,
+        tags: mergedTags,
+    }, defaults?.identity), { apiVersion: "2023-01-31" });
+    const environment = new managedEnvironments(mergeDefaults({
+        name,
+        location,
+        tags: mergedTags,
+        vnetConfiguration: { infrastructureSubnetId: subnetId, internal },
+        appLogsConfiguration: {
+            destination: "log-analytics",
+            logAnalyticsConfiguration: {
+                customerId: `[reference(${workspaceId}, '2023-09-01').customerId]`,
+                sharedKey: `[listKeys(${workspaceId}, '2023-09-01').primarySharedKey]`,
+            },
+        },
+        workloadProfiles: [{ name: "Consumption", workloadProfileType: "Consumption" }],
+    }, defaults?.environment), { apiVersion: "2024-03-01" });
+    const containerApp = new containerApps(mergeDefaults({
+        name: app,
+        location,
+        tags: mergedTags,
+        identity: {
+            type: "UserAssigned",
+            userAssignedIdentities: {
+                [`[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${identityName}')]`]: {},
+            },
+        },
+        managedEnvironmentId: environment.id,
+        workloadProfileName: "Consumption",
+        configuration: { ingress: { external: true, targetPort: port, transport: "auto" } },
+        template: {
+            containers: [{ name: app, image, resources: { cpu: 0.25, memory: "0.5Gi" } }],
+            scale: { minReplicas: replicas, maxReplicas: replicas },
+        },
+    }, defaults?.containerApp), { apiVersion: "2024-03-01" });
+    return { workspace, identity, environment, containerApp };
+}, "ContainerAppSite");

package/dist/composites/index.d.ts

@@ -28,6 +28,8 @@ export { RedisCache } from "./redis-cache.js";
 export type { RedisCacheProps, RedisCacheResult } from "./redis-cache.js";
 export { PrivateEndpoint } from "./private-endpoint.js";
 export type { PrivateEndpointProps, PrivateEndpointResult } from "./private-endpoint.js";
+export { ContainerAppNetwork, ContainerAppSite } from "./container-app.js";
+export type { ContainerAppNetworkProps, ContainerAppNetworkResult, ContainerAppSiteProps, ContainerAppSiteResult, } from "./container-app.js";
 export { GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink } from "./landing-zone.js";
 export type { GovernanceFoundationProps, GovernanceFoundationResult, GovernanceBaselineProps, GovernanceBaselineResult, LocationRestrictionProps, LocationRestrictionResult, ActivityLogSinkProps, ActivityLogSinkResult, } from "./landing-zone.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/composites/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,YAAY,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,YAAY,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACxG,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChH,YAAY,EACV,yBAAyB,EAAE,0BAA0B,EACrD,uBAAuB,EAAE,wBAAwB,EACjD,wBAAwB,EAAE,yBAAyB,EACnD,oBAAoB,EAAE,qBAAqB,GAC5C,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,YAAY,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,YAAY,EAAE,4BAA4B,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACxG,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxE,YAAY,EACV,wBAAwB,EAAE,yBAAyB,EACnD,qBAAqB,EAAE,sBAAsB,GAC9C,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAChH,YAAY,EACV,yBAAyB,EAAE,0BAA0B,EACrD,uBAAuB,EAAE,wBAAwB,EACjD,wBAAwB,EAAE,yBAAyB,EACnD,oBAAoB,EAAE,qBAAqB,GAC5C,MAAM,gBAAgB,CAAC"}

package/dist/composites/index.js

@@ -13,4 +13,5 @@ export { ApplicationGateway } from "./application-gateway.js";
 export { ContainerInstance } from "./container-instance.js";
 export { RedisCache } from "./redis-cache.js";
 export { PrivateEndpoint } from "./private-endpoint.js";
+export { ContainerAppNetwork, ContainerAppSite } from "./container-app.js";
 export { GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink } from "./landing-zone.js";

package/dist/deep-observe.d.ts

@@ -49,6 +49,36 @@
  */
 import { type AzHttp } from "./op/activities/az-apply.js";
 import type { DeepNormalizationHooks, DeepObservationResult } from "@intentius/chant/lexicon";
+/** The full `az resource show -o json` shape this reader reads (a superset of the thin path's `AzResourceShowResponse`). */
+export interface ArmResourceShowResponse {
+    id?: string;
+    name?: string;
+    type?: string;
+    location?: string;
+    kind?: string;
+    sku?: unknown;
+    identity?: unknown;
+    tags?: Record<string, string>;
+    zones?: string[];
+    plan?: unknown;
+    etag?: string;
+    systemData?: unknown;
+    properties?: Record<string, unknown>;
+}
+/**
+ * Reshape one `az resource show` response into chant's own flat declared
+ * vocabulary: the resource-level fields ARM returns as siblings of
+ * `properties`, plus every `properties.*` field spread onto that same top
+ * level (see the module doc). `id`/`type`/`etag`/`systemData` are envelope
+ * bookkeeping with no declared counterpart and are never read in at all.
+ *
+ * `queriedName` is the declared name the GET was addressed by. A child
+ * resource is declared as `vnet/subnet` while ARM answers with the leaf
+ * (`name: "subnet"`) — the same identity in two spellings, since the URL that
+ * returned 200 is the declared name. The leaf is folded back to the declared
+ * spelling; a name that is not the leaf of the query is kept as returned.
+ */
+export declare function buildLiveProperties(obj: ArmResourceShowResponse, queriedName?: string): Record<string, unknown>;
 /**
  * Server-populated wherever they appear — matched on the final path segment,
  * the same technique AWS's `AWS_READ_ONLY_NAMES` uses, because ARM repeats

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AA+DlC;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CASpD,CAAC;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI1E,CAAC;AA+DF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM3D;AAyBD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBA2EzC,CAAC;AAIF,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,qBAAqB,CAAC,CAkEhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAQlC,4HAA4H;AAC5H,MAAM,WAAW,uBAAuB;IACtC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,uBAAuB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqB/G;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CASpD,CAAC;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI1E,CAAC;AA+DF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM3D;AAyBD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBA2EzC,CAAC;AAIF,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,qBAAqB,CAAC,CAkEhC"}

package/dist/deep-observe.js

@@ -68,7 +68,7 @@ import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership.js";
  * returned 200 is the declared name. The leaf is folded back to the declared
  * spelling; a name that is not the leaf of the query is kept as returned.
  */
-function buildLiveProperties(obj, queriedName) {
+export function buildLiveProperties(obj, queriedName) {
     const out = {};
     if (obj.name !== undefined) {
         out.name =

package/dist/index.d.ts

@@ -8,6 +8,7 @@ export { defaultTags, type TagEntry, type DefaultTags } from "./default-tags.js"
 export { deploymentScope, isDeploymentScope, type DeploymentScope, type DeployScope } from "./deploy-scopes.js";
 export { azureSerializer } from "./serializer.js";
 export { azurePlugin } from "./plugin.js";
+export { azureCapabilityPlugin } from "./components/capability-plugin.js";
 export { Parameter } from "./parameter.js";
 export { observeResourcesDeepAzure, azureDeepNormalizationHooks, AZURE_READ_ONLY_NAMES, AZURE_SERVER_COMPUTED_NAMES, AZURE_SERVICE_DEFAULTS, } from "./deep-observe.js";
 export { ResourceId, ResourceIdIntrinsic, Reference, ReferenceIntrinsic, Concat, ConcatIntrinsic, ResourceGroup, ResourceGroupIntrinsic, Subscription, SubscriptionIntrinsic, UniqueString, UniqueStringIntrinsic, Format, FormatIntrinsic, If, IfIntrinsic, ListKeys, ListKeysIntrinsic, } from "./intrinsics.js";
@@ -16,7 +17,7 @@ export { isChildProject, type ChildProjectInstance } from "@intentius/chant/chil
 export { stackOutput, isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
 export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon-output";
 export * from "./generated/index.js";
-export { StorageAccountSecure, type StorageAccountSecureProps, type StorageAccountSecureResult, VnetDefault, type VnetDefaultProps, type VnetDefaultResult, VmLinux, type VmLinuxProps, type VmLinuxResult, AppService, type AppServiceProps, type AppServiceResult, AksCluster, type AksClusterProps, type AksClusterResult, SqlDatabase, type SqlDatabaseProps, type SqlDatabaseResult, KeyVaultSecure, type KeyVaultSecureProps, type KeyVaultSecureResult, ContainerRegistrySecure, type ContainerRegistrySecureProps, type ContainerRegistrySecureResult, FunctionApp, type FunctionAppProps, type FunctionAppResult, ServiceBusPipeline, type ServiceBusPipelineProps, type ServiceBusPipelineResult, CosmosDatabase, type CosmosDatabaseProps, type CosmosDatabaseResult, ApplicationGateway, type ApplicationGatewayProps, type ApplicationGatewayResult, ContainerInstance, type ContainerInstanceProps, type ContainerInstanceResult, RedisCache, type RedisCacheProps, type RedisCacheResult, PrivateEndpoint, type PrivateEndpointProps, type PrivateEndpointResult, GovernanceFoundation, type GovernanceFoundationProps, type GovernanceFoundationResult, GovernanceBaseline, type GovernanceBaselineProps, type GovernanceBaselineResult, LocationRestriction, type LocationRestrictionProps, type LocationRestrictionResult, ActivityLogSink, type ActivityLogSinkProps, type ActivityLogSinkResult, } from "./composites/index.js";
+export { StorageAccountSecure, type StorageAccountSecureProps, type StorageAccountSecureResult, VnetDefault, type VnetDefaultProps, type VnetDefaultResult, VmLinux, type VmLinuxProps, type VmLinuxResult, AppService, type AppServiceProps, type AppServiceResult, AksCluster, type AksClusterProps, type AksClusterResult, SqlDatabase, type SqlDatabaseProps, type SqlDatabaseResult, KeyVaultSecure, type KeyVaultSecureProps, type KeyVaultSecureResult, ContainerRegistrySecure, type ContainerRegistrySecureProps, type ContainerRegistrySecureResult, FunctionApp, type FunctionAppProps, type FunctionAppResult, ServiceBusPipeline, type ServiceBusPipelineProps, type ServiceBusPipelineResult, CosmosDatabase, type CosmosDatabaseProps, type CosmosDatabaseResult, ApplicationGateway, type ApplicationGatewayProps, type ApplicationGatewayResult, ContainerInstance, type ContainerInstanceProps, type ContainerInstanceResult, RedisCache, type RedisCacheProps, type RedisCacheResult, PrivateEndpoint, type PrivateEndpointProps, type PrivateEndpointResult, ContainerAppNetwork, type ContainerAppNetworkProps, type ContainerAppNetworkResult, ContainerAppSite, type ContainerAppSiteProps, type ContainerAppSiteResult, GovernanceFoundation, type GovernanceFoundationProps, type GovernanceFoundationResult, GovernanceBaseline, type GovernanceBaselineProps, type GovernanceBaselineResult, LocationRestriction, type LocationRestrictionProps, type LocationRestrictionResult, ActivityLogSink, type ActivityLogSinkProps, type ActivityLogSinkResult, } from "./composites/index.js";
 export { landingZoneConfig, locationRestriction, DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS, ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID, FOUNDATION_MANAGEMENT_GROUPS, } from "./governance.js";
 export type { AzureGovernanceConfig, LandingZoneConfigProps, ManagementGroupConfig, PolicyConfig, SubscriptionConfig, } from "./governance.js";
 export { StorageRoles, ComputeRoles, NetworkRoles, KeyVaultRoles, SqlRoles, ContainerRoles, AppServiceRoles, IdentityRoles, } from "./actions/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGxG,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EACtE,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,mBAAmB,EACtC,sBAAsB,EAAE,oBAAoB,EAC5C,2CAA2C,EAAE,4BAA4B,GAC1E,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,qBAAqB,EAAE,sBAAsB,EAC7C,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,GACxD,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGxG,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EACtE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EACzE,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,mBAAmB,EACtC,sBAAsB,EAAE,oBAAoB,EAC5C,2CAA2C,EAAE,4BAA4B,GAC1E,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,qBAAqB,EAAE,sBAAsB,EAC7C,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,GACxD,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -15,6 +15,9 @@ export { defaultTags } from "./default-tags.js";
 export { deploymentScope, isDeploymentScope } from "./deploy-scopes.js";
 export { azureSerializer } from "./serializer.js";
 export { azurePlugin } from "./plugin.js";
+// Core's capability-plugin loader scans this package's exports and loads
+// `azureCapabilityPlugin` when a project's chant.config lists this lexicon (#4273).
+export { azureCapabilityPlugin } from "./components/capability-plugin.js";
 export { Parameter } from "./parameter.js";
 // Deep observation (#1086): the `az resource show` reader and the noise
 // rules it shares with core's normalization pass.
@@ -30,7 +33,7 @@ export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon
 // --- Generated resource classes ---
 export * from "./generated/index.js";
 // --- Composites ---
-export { StorageAccountSecure, VnetDefault, VmLinux, AppService, AksCluster, SqlDatabase, KeyVaultSecure, ContainerRegistrySecure, FunctionApp, ServiceBusPipeline, CosmosDatabase, ApplicationGateway, ContainerInstance, RedisCache, PrivateEndpoint, GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink, } from "./composites/index.js";
+export { StorageAccountSecure, VnetDefault, VmLinux, AppService, AksCluster, SqlDatabase, KeyVaultSecure, ContainerRegistrySecure, FunctionApp, ServiceBusPipeline, CosmosDatabase, ApplicationGateway, ContainerInstance, RedisCache, PrivateEndpoint, ContainerAppNetwork, ContainerAppSite, GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink, } from "./composites/index.js";
 // Azure governance authoring: the desired-state config the Azure
 // external governance reconciler applies, and the typed landing-zone authoring layer.
 export { landingZoneConfig, locationRestriction, DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS, ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID, FOUNDATION_MANAGEMENT_GROUPS, } from "./governance.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "6d96e57d05d492a3402cf1747adb5bea4cb892aa0c471a8a762f64965657a8fe",
+    "manifest.json": "bc610c4143712ac195d56822a922054f5f94b9251a30403488a71c273bae7278",
     "meta.json": "d2521221ed616d882ded4296f0071685bd74e4b645d55dabc9685733c37dc419",
     "types/index.d.ts": "29631032bda9533849178968290e65d72250eab0b8bab424f2d9ef9b4e8546a4",
     "rules/hardcoded-location.ts": "0b895449c8c94066e81721c46be24249231029fe13b471477456df5c4e45b8bf",
@@ -32,10 +32,10 @@
     "rules/azr031.ts": "7f0654c9dce1e3a1a86818d8b4d0201fb4600021f7a4a757c36b1513fe16e0fd",
     "rules/azr032.ts": "ea94cc7fdece0812c43898c76c4b8a115a306157b741fe3b76fe726335f6c2d2",
     "rules/azr033.ts": "d440ec79a1563160bb7c8cc29c81880da71997c872215f14ec3be18f05a07ed3",
-    "skills/chant-azure.md": "86399e4fafd35cdf56670b32dbff5db42a4bfa1453b25231c4ee15eea9a2a1b9",
-    "skills/chant-azure-security.md": "95ab789202662f60b43cf2fce1ae549cbcf5b689306481dabb656847281879ff",
-    "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
+    "skills/chant-azure.md": "e81c3a12c31196e3eebe399443328caacf65db61380a621d1fb6f1c359f6a077",
+    "skills/chant-azure-security.md": "d9a7a99c861dcab1ff6d0653f1e13e28d907babd045ae67c524b32b6ab80691e",
+    "skills/chant-azure-patterns.md": "2d8cb8bbeda73b695856cec4ddaf5b3a0efce76e4ee6e3cf14b90ca69dee5757",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "170c51b22ffa7e7a75bdfa326ad514cf831357abb659803cd217edf6102f2925"
+  "composite": "f5d39f472b9337b9f6729b1a6adf719e59ad3dada43de344bdf112c2f0b3b409"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.124.38",
+  "version": "0.124.40",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/skills/chant-azure-patterns.md

@@ -408,6 +408,22 @@ const { privateEndpoint, privateDnsZone, dnsZoneGroup, vnetLink } = PrivateEndpo
 export { storageAccount, privateEndpoint, privateDnsZone, dnsZoneGroup, vnetLink };
 ```
 
+### ContainerAppNetwork and ContainerAppSite
+A Container Apps site in its own delegated subnet; one network can carry several sites:
+
+```ts
+import { ContainerAppNetwork, ContainerAppSite } from "@intentius/chant-lexicon-azure";
+
+export const network = ContainerAppNetwork({ name: "web" });
+
+export const site = ContainerAppSite({
+  name: "web",
+  app: "frontend",
+  subnetId: network.subnet.id,
+  image: "nginx:1.27",
+});
+```
+
 ## ARM Template Intrinsic Reference
 
 | Function | Description | Example |

package/dist/skills/chant-azure-security.md

@@ -267,6 +267,7 @@ Use the secure composite variants which apply these patterns automatically:
 - `ContainerInstance` — Managed identity, no public IP by default
 - `RedisCache` — Non-SSL port disabled, TLS 1.2
 - `PrivateEndpoint` — Private connectivity pattern with DNS zone
+- `ContainerAppSite`: user-assigned identity, app logs to Log Analytics, optional VNet-only environment
 
 ## Post-Synth Check Reference
 

package/dist/skills/chant-azure.md

@@ -157,6 +157,8 @@ Composites group related Azure resources with secure defaults. Each returns an o
 | `ContainerInstance` | ContainerGroup | No public IP by default, resource limits set |
 | `RedisCache` | RedisCache | TLS 1.2 required, non-SSL port disabled |
 | `PrivateEndpoint` | PrivateEndpoint + PrivateDnsZone + VnetLink | DNS zone auto-registration, manual approval disabled |
+| `ContainerAppNetwork` | VirtualNetwork + Subnet | Subnet delegated to Container Apps, /23 by default |
+| `ContainerAppSite` | LogAnalyticsWorkspace + ManagedIdentity + ManagedEnvironment + ContainerApp | App logs to Log Analytics, user-assigned identity, Consumption profile |
 | `AksCluster` | ManagedCluster + AgentPool | RBAC enabled, network policy (calico), managed identity, Azure CNI |
 | `SqlDatabase` | SQLServer + Database + FirewallRule + AuditingSettings | TDE enabled, auditing enabled, TLS 1.2, no Azure-wide firewall rule |
 | `KeyVaultSecure` | KeyVault + AccessPolicy | Soft delete, purge protection, RBAC authorization, network ACLs |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.124.38",
+  "version": "0.124.40",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -39,6 +39,11 @@
       "types": "./dist/*.d.ts",
       "default": "./dist/*.js"
     },
+    "./components": {
+      "development": "./src/components/index.ts",
+      "types": "./dist/components/index.d.ts",
+      "default": "./dist/components/index.js"
+    },
     "./detect": {
       "development": "./src/detect.ts",
       "types": "./dist/detect.d.ts",
@@ -74,6 +79,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.38"
+    "@intentius/chant": "^0.124.40"
   }
 }

package/src/components/arm-deploy-floci.e2e.test.ts

@@ -0,0 +1,80 @@
+/**
+ * `arm-deploy`'s plan and apply against floci-az (#4273), over `fetch`. Set
+ * CHANT_FLOCI_AZ_ENDPOINT to a running floci-az, for example
+ * `docker run -d --name chant-floci-az-e2e -p 4577:4577 floci/floci-az:0.10.0`
+ * and `CHANT_FLOCI_AZ_ENDPOINT=http://localhost:4577`. Skipped without it.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { azDelete } from "../op/activities/az-apply";
+import { ArmDeployPlanMovedError, createArmDeployCapability } from "./arm-deploy";
+
+const endpoint = process.env.CHANT_FLOCI_AZ_ENDPOINT;
+
+describe.skipIf(!endpoint)("arm-deploy plan against floci-az (#4273)", () => {
+  const resourceGroup = `chant-arm-plan-${process.pid}`;
+  const ctx = { env: "local", component: resourceGroup };
+  const saved = { ...process.env };
+  let dir: string;
+  let template: string;
+  const account = (accessTier: string) => ({
+    type: "Microsoft.Storage/storageAccounts",
+    apiVersion: "2023-01-01",
+    name: `chantplan${process.pid}`,
+    location: "[resourceGroup().location]",
+    sku: { name: "Standard_LRS" },
+    kind: "StorageV2",
+    properties: { accessTier },
+  });
+  const write = (accessTier: string): void =>
+    writeFileSync(
+      template,
+      JSON.stringify({
+        resources: [account(accessTier)],
+        outputs: { group: { type: "string", value: "[resourceGroup().name]" } },
+      }),
+    );
+
+  beforeAll(() => {
+    process.env.AZURE_ENDPOINT_URL = endpoint;
+    dir = mkdtempSync(join(tmpdir(), "arm-plan-floci-az-"));
+    template = join(dir, "deploymentTemplate.json");
+  });
+
+  afterAll(async () => {
+    try {
+      await azDelete({ templatePath: template, resourceGroup, endpoint });
+    } catch { /* never created */ }
+    process.env = saved;
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("plans a create, applies it, plans no change, plans an update and refuses a plan the template moved past", async () => {
+    const capability = createArmDeployCapability();
+    const input = { template, resourceGroup };
+
+    write("Hot");
+    const created = await capability.plan!(ctx, input);
+    expect(created.changeSet!.entries.map((e) => e.action)).toEqual(["create"]);
+    const first = await capability.run({ ...ctx, plans: { [resourceGroup]: created.artifact } }, input);
+    expect(first.applied).toHaveLength(1);
+    expect(first.outputs).toEqual({ group: resourceGroup });
+
+    const same = await capability.plan!(ctx, input);
+    expect(same.changeSet!.entries.map((e) => e.action)).toEqual(["no-op"]);
+
+    write("Cool");
+    const updated = await capability.plan!(ctx, input);
+    expect(updated.changeSet!.entries.map((e) => [e.action, e.attributes])).toEqual([
+      ["update", [{ path: "accessTier", before: "Hot", after: "Cool" }]],
+    ]);
+
+    // The template moves after the plan: run refuses and changes nothing.
+    write("Hot");
+    await expect(capability.run({ ...ctx, plans: { [resourceGroup]: updated.artifact } }, input)).rejects.toBeInstanceOf(ArmDeployPlanMovedError);
+    expect((await capability.plan!(ctx, input)).changeSet!.entries.map((e) => e.action)).toEqual(["no-op"]);
+  }, 120_000);
+});