@intentius/chant-lexicon-k8s 0.7.0 → 0.8.0

package/dist/composites/azure-monitor-collector.d.ts

@@ -0,0 +1,63 @@
+/**
+ * AzureMonitorCollector composite — DaemonSet + RBAC + ConfigMap for Azure Monitor / OTel collector.
+ *
+ * @aks Azure Monitor agent with OpenTelemetry collector config for
+ * Log Analytics workspace integration on AKS clusters.
+ */
+import { DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, ConfigMap } from "../generated/index.js";
+export interface AzureMonitorCollectorProps {
+    /** Azure Log Analytics workspace ID. */
+    workspaceId: string;
+    /** AKS cluster name. */
+    clusterName: string;
+    /** Agent name (default: "azure-monitor-collector"). */
+    name?: string;
+    /** Collector image (default: "mcr.microsoft.com/azuremonitor/containerinsights/ciprod:3.1.35"). */
+    image?: string;
+    /** Namespace (default: "azure-monitor"). */
+    namespace?: string;
+    /** Additional labels. */
+    labels?: Record<string, string>;
+    /** CPU request (default: "100m"). */
+    cpuRequest?: string;
+    /** Memory request (default: "256Mi"). */
+    memoryRequest?: string;
+    /** CPU limit (default: "500m"). */
+    cpuLimit?: string;
+    /** Memory limit (default: "512Mi"). */
+    memoryLimit?: string;
+    /** Azure AD client ID for Workload Identity (adds azure.workload.identity annotations to ServiceAccount). */
+    clientId?: string;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        daemonSet?: Partial<Record<string, unknown>>;
+        serviceAccount?: Partial<Record<string, unknown>>;
+        clusterRole?: Partial<Record<string, unknown>>;
+        clusterRoleBinding?: Partial<Record<string, unknown>>;
+        configMap?: Partial<Record<string, unknown>>;
+    };
+}
+export interface AzureMonitorCollectorResult {
+    daemonSet: InstanceType<typeof DaemonSet>;
+    serviceAccount: InstanceType<typeof ServiceAccount>;
+    clusterRole: InstanceType<typeof ClusterRole>;
+    clusterRoleBinding: InstanceType<typeof ClusterRoleBinding>;
+    configMap: InstanceType<typeof ConfigMap>;
+}
+/**
+ * Create an AzureMonitorCollector composite — returns prop objects for
+ * a DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, and ConfigMap.
+ *
+ * @aks
+ * @example
+ * ```ts
+ * import { AzureMonitorCollector } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { daemonSet, serviceAccount, clusterRole, clusterRoleBinding, configMap } = AzureMonitorCollector({
+ *   workspaceId: "00000000-0000-0000-0000-000000000000",
+ *   clusterName: "my-aks-cluster",
+ * });
+ * ```
+ */
+export declare const AzureMonitorCollector: import("@intentius/chant").CompositeDefinition<AzureMonitorCollectorProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=azure-monitor-collector.d.ts.map

package/dist/composites/azure-monitor-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor-collector.d.ts","sourceRoot":"","sources":["../../src/composites/azure-monitor-collector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAErG,MAAM,WAAW,0BAA0B;IACzC,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6GAA6G;IAC7G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC9C,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;IAC1C,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,kBAAkB,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC5D,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,yHAiLP,CAAC"}

package/dist/composites/batch-job.d.ts

@@ -0,0 +1,85 @@
+/**
+ * BatchJob composite — Job + optional RBAC (ServiceAccount + Role + RoleBinding).
+ *
+ * A higher-level construct for one-shot batch jobs (data migrations,
+ * seed tasks, backups). For scheduled workloads, use CronWorkload instead.
+ */
+import { Job, ServiceAccount, Role, RoleBinding } from "../generated/index.js";
+import type { ContainerSecurityContext } from "./security-context.js";
+export interface BatchJobProps {
+    /** Job name — used in metadata and labels. */
+    name: string;
+    /** Container image. */
+    image: string;
+    /** Command to run in the container. */
+    command?: string[];
+    /** Arguments to the command. */
+    args?: string[];
+    /** Number of retries before marking the job as failed (default: 6). */
+    backoffLimit?: number;
+    /** Seconds after completion before the job is eligible for GC. */
+    ttlSecondsAfterFinished?: number;
+    /** Number of completions required (default: 1). */
+    completions?: number;
+    /** Number of pods running in parallel (default: 1). */
+    parallelism?: number;
+    /** Restart policy (default: "OnFailure"). */
+    restartPolicy?: string;
+    /** RBAC rules for the service account. Omit for defaults; pass [] to skip RBAC entirely. */
+    rbacRules?: Array<{
+        apiGroups: string[];
+        resources: string[];
+        verbs: string[];
+    }>;
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** CPU request (default: "100m"). */
+    cpuRequest?: string;
+    /** Memory request (default: "128Mi"). */
+    memoryRequest?: string;
+    /** CPU limit (default: "500m"). */
+    cpuLimit?: string;
+    /** Memory limit (default: "256Mi"). */
+    memoryLimit?: string;
+    /** Environment variables for the container. */
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** Container security context (supports PSS restricted fields). */
+    securityContext?: ContainerSecurityContext;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        job?: Partial<Record<string, unknown>>;
+        serviceAccount?: Partial<Record<string, unknown>>;
+        role?: Partial<Record<string, unknown>>;
+        roleBinding?: Partial<Record<string, unknown>>;
+    };
+}
+export interface BatchJobResult {
+    job: InstanceType<typeof Job>;
+    serviceAccount?: InstanceType<typeof ServiceAccount>;
+    role?: InstanceType<typeof Role>;
+    roleBinding?: InstanceType<typeof RoleBinding>;
+}
+/**
+ * Create a BatchJob composite — returns prop objects for
+ * a Job, and optional ServiceAccount, Role, and RoleBinding.
+ *
+ * @example
+ * ```ts
+ * import { BatchJob } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { job, serviceAccount, role, roleBinding } = BatchJob({
+ *   name: "db-migrate",
+ *   image: "migrate:1.0",
+ *   command: ["python", "manage.py", "migrate"],
+ *   backoffLimit: 3,
+ *   ttlSecondsAfterFinished: 3600,
+ * });
+ * ```
+ */
+export declare const BatchJob: import("@intentius/chant").CompositeDefinition<BatchJobProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=batch-job.d.ts.map

package/dist/composites/batch-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-job.d.ts","sourceRoot":"","sources":["../../src/composites/batch-job.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAsBnE,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gCAAgC;IAChC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,mEAAmE;IACnE,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC;IAC9B,cAAc,CAAC,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,QAAQ,4GA2HP,CAAC"}

package/dist/composites/cockroachdb-cluster.d.ts

@@ -0,0 +1,132 @@
+/**
+ * CockroachDbCluster composite — StatefulSet + Services + RBAC + PDB + Jobs.
+ *
+ * Deploys a CockroachDB cluster on Kubernetes with TLS support via self-signed
+ * certificates. Produces all K8s resources needed for a single cloud's slice of
+ * a CockroachDB cluster (typically 3 nodes). Multi-cloud deployments use one
+ * CockroachDbCluster per cloud, sharing joinAddresses across clouds.
+ */
+import { StatefulSet, Service, ServiceAccount, Role, RoleBinding, ClusterRole, ClusterRoleBinding, PodDisruptionBudget, Job } from "../generated/index.js";
+export interface CockroachDbClusterProps {
+    /** Cluster name — used in metadata, labels, and service names. */
+    name: string;
+    /** Namespace for all namespaced resources. */
+    namespace?: string;
+    /** Number of StatefulSet replicas (default: 3). */
+    replicas?: number;
+    /** CockroachDB container image (default: "cockroachdb/cockroach:v24.3.0"). */
+    image?: string;
+    /** PVC storage size per node (default: "100Gi"). */
+    storageSize?: string;
+    /** StorageClass name for PVCs. */
+    storageClassName?: string;
+    /** CPU limit per pod (default: "2"). */
+    cpuLimit?: string;
+    /** Memory limit per pod (default: "8Gi"). */
+    memoryLimit?: string;
+    /** Fraction of container memory for CockroachDB cache (default: ".25"). */
+    cachePercent?: string;
+    /** Fraction of container memory for SQL temp storage (default: ".25"). */
+    sqlMemoryPercent?: string;
+    /** CockroachDB locality flag (e.g., "cloud=aws,region=us-east-1"). */
+    locality?: string;
+    /** All node DNS names for --join (cross-cloud cluster membership). */
+    joinAddresses?: string[];
+    /** Enable TLS via self-signed CA certs (default: true). */
+    secure?: boolean;
+    /**
+     * Skip the cockroach init Job (default: false).
+     * Set true for secondary regions in a multi-region cluster — only ONE region
+     * should run `cockroach init` to bootstrap the unified cluster. Secondary
+     * nodes start fresh and auto-join the cluster via the joinAddresses.
+     */
+    skipInit?: boolean;
+    /**
+     * Skip the cert-gen Job (default: false).
+     * Set true for multi-region deployments where a shared CA and node certs are
+     * pre-generated externally (e.g. via generate-certs.sh) and distributed via
+     * External Secrets Operator or direct kubectl. Each region's cert-gen creates
+     * a separate CA, breaking cross-region TLS — so all regions must use the same CA.
+     */
+    skipCertGen?: boolean;
+    /**
+     * Extra DNS names / IPs to include in node cert SANs beyond the auto-generated
+     * cluster-local names. Use for cross-region or external hostnames.
+     * E.g. ["cockroachdb-0.east.crdb.internal", "cockroachdb-1.east.crdb.internal"].
+     */
+    extraCertNodeAddresses?: string[];
+    /**
+     * Domain suffix for cross-cluster advertise address (e.g. "east.crdb.internal").
+     * When set, nodes advertise "${HOSTNAME}.${advertiseHostDomain}" instead of the
+     * cluster-local FQDN from $(hostname -f). Required for multi-region clusters so
+     * that gossip addresses are resolvable from other Kubernetes clusters.
+     * E.g. pod "cockroachdb-0" in east advertises "cockroachdb-0.east.crdb.internal".
+     */
+    advertiseHostDomain?: string;
+    /**
+     * Mount the client certs secret (`${name}-client-certs`) into pods at
+     * `/cockroach/cockroach-client-certs` (default: false).
+     *
+     * Enable for multi-region deployments where `cockroach init`, `cockroach sql`,
+     * and backup schedule setup run inside a pod via `kubectl exec`. The client cert
+     * is separate from the node cert and is NOT included in the node certs secret.
+     * Without this flag you must inject client certs manually (e.g. via /tmp).
+     */
+    mountClientCerts?: boolean;
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        serviceAccount?: Partial<Record<string, unknown>>;
+        role?: Partial<Record<string, unknown>>;
+        roleBinding?: Partial<Record<string, unknown>>;
+        clusterRole?: Partial<Record<string, unknown>>;
+        clusterRoleBinding?: Partial<Record<string, unknown>>;
+        publicService?: Partial<Record<string, unknown>>;
+        headlessService?: Partial<Record<string, unknown>>;
+        pdb?: Partial<Record<string, unknown>>;
+        statefulSet?: Partial<Record<string, unknown>>;
+        initJob?: Partial<Record<string, unknown>>;
+        certGenJob?: Partial<Record<string, unknown>>;
+    };
+}
+export interface CockroachDbClusterResult {
+    serviceAccount: InstanceType<typeof ServiceAccount>;
+    role: InstanceType<typeof Role>;
+    roleBinding: InstanceType<typeof RoleBinding>;
+    clusterRole: InstanceType<typeof ClusterRole>;
+    clusterRoleBinding: InstanceType<typeof ClusterRoleBinding>;
+    /** Client-facing service (ClusterIP, ports 26257+8080). */
+    publicService: InstanceType<typeof Service>;
+    /** Pod discovery service (headless, publishNotReadyAddresses). */
+    headlessService: InstanceType<typeof Service>;
+    pdb: InstanceType<typeof PodDisruptionBudget>;
+    statefulSet: InstanceType<typeof StatefulSet>;
+    /** One-shot cockroach init job. Absent when skipInit is true. */
+    initJob?: InstanceType<typeof Job>;
+    /** Generates self-signed CA + node certs, stores in Secrets. Absent when skipCertGen is true. */
+    certGenJob?: InstanceType<typeof Job>;
+}
+/**
+ * Create a CockroachDbCluster composite — returns prop objects for a full
+ * CockroachDB StatefulSet deployment including RBAC, Services, PDB, and Jobs.
+ *
+ * @example
+ * ```ts
+ * import { CockroachDbCluster } from "@intentius/chant-lexicon-k8s";
+ *
+ * const crdb = CockroachDbCluster({
+ *   name: "cockroachdb",
+ *   namespace: "crdb",
+ *   replicas: 3,
+ *   locality: "cloud=aws,region=us-east-1",
+ *   joinAddresses: [
+ *     "cockroachdb-0.cockroachdb.crdb.svc.cluster.local",
+ *     "cockroachdb-1.cockroachdb.crdb.svc.cluster.local",
+ *     "cockroachdb-2.cockroachdb.crdb.svc.cluster.local",
+ *   ],
+ * });
+ * ```
+ */
+export declare const CockroachDbCluster: import("@intentius/chant").CompositeDefinition<CockroachDbClusterProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=cockroachdb-cluster.d.ts.map

package/dist/composites/cockroachdb-cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cockroachdb-cluster.d.ts","sourceRoot":"","sources":["../../src/composites/cockroachdb-cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAElJ,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACnD,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IAChC,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,kBAAkB,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC5D,2DAA2D;IAC3D,aAAa,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IAC5C,kEAAkE;IAClE,eAAe,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IAC9C,GAAG,EAAE,YAAY,CAAC,OAAO,mBAAmB,CAAC,CAAC;IAC9C,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,iEAAiE;IACjE,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC;IACnC,iGAAiG;IACjG,UAAU,CAAC,EAAE,YAAY,CAAC,OAAO,GAAG,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kBAAkB,sHAuYP,CAAC"}

package/dist/composites/cockroachdb-region-stack.d.ts

@@ -0,0 +1,164 @@
+/**
+ * CockroachDbRegionStack composite — all K8s resources for one CockroachDB region.
+ *
+ * Collapses the 8-file per-region K8s pattern into a single composite call:
+ * namespace, storage, CockroachDB StatefulSet, External Secrets, GCE Ingress,
+ * ExternalDNS, Cloud Armor BackendConfig, TLS cert, and optional Prometheus monitoring.
+ *
+ * @gke Requires: External Secrets Operator (ESO), ExternalDNS (via GkeExternalDnsAgent).
+ */
+export interface CockroachDbRegionCockroachConfig {
+    /** Cluster name (default: "cockroachdb"). */
+    name?: string;
+    /** StatefulSet replicas (default: 3). */
+    replicas?: number;
+    /** CockroachDB image (default: "cockroachdb/cockroach:v24.3.0"). */
+    image?: string;
+    /** PVC storage size per node (default: "100Gi"). */
+    storageSize?: string;
+    /** CPU limit per pod (default: "2"). */
+    cpuLimit?: string;
+    /** Memory limit per pod (default: "8Gi"). */
+    memoryLimit?: string;
+    /** Locality flag (e.g. "cloud=gcp,region=us-east4"). */
+    locality?: string;
+    /** Join addresses for multi-region cluster. */
+    joinAddresses?: string[];
+    /**
+     * Skip the cockroach init Job (set true for secondary regions).
+     * Only the first region should run cockroach init.
+     */
+    skipInit?: boolean;
+    /**
+     * Mount the client certs secret into pods (needed for multi-region init via kubectl exec).
+     */
+    mountClientCerts?: boolean;
+    /**
+     * Extra DNS names to include in node cert SANs (e.g. cross-region ExternalDNS names).
+     */
+    extraCertNodeAddresses?: string[];
+    /**
+     * Domain for cross-cluster advertise address (e.g. "east.crdb.internal").
+     * When set, pods advertise "${HOSTNAME}.${advertiseHostDomain}" for cross-cluster gossip.
+     */
+    advertiseHostDomain?: string;
+}
+export interface CockroachDbRegionTlsConfig {
+    /**
+     * GCP Secret Manager secret names to sync into K8s Secrets via External Secrets Operator.
+     */
+    gcpSecretNames: {
+        /** CA cert secret name in GCP Secret Manager. */
+        ca: string;
+        /** Node cert secret name. */
+        nodeCrt: string;
+        /** Node cert key secret name. */
+        nodeKey: string;
+        /** Client root cert secret name. */
+        clientRootCrt: string;
+        /** Client root key secret name. */
+        clientRootKey: string;
+    };
+}
+export interface CockroachDbRegionStackConfig {
+    /**
+     * Short region identifier used in resource names and labels (e.g. "east").
+     * Used to distinguish resources across regions.
+     */
+    region: string;
+    /** K8s namespace for all namespaced resources (e.g. "crdb-east"). */
+    namespace: string;
+    /** Public UI domain for this region (e.g. "east.crdb.example.com"). */
+    domain: string;
+    /** Cross-cluster ExternalDNS domain (e.g. "east.crdb.internal"). */
+    internalDomain: string;
+    /** Root public domain for ExternalDNS domain filter (e.g. "crdb.example.com"). */
+    publicRootDomain: string;
+    /** GCP project ID — used in ClusterSecretStore Workload Identity config. */
+    projectId: string;
+    /** GKE cluster name — used in ClusterSecretStore Workload Identity config. */
+    clusterName: string;
+    /** GKE cluster region (e.g. "us-east4") — used in ClusterSecretStore config. */
+    clusterRegion: string;
+    /** GCP service account email for CRDB Workload Identity annotation on the K8s SA. */
+    crdbGsaEmail: string;
+    /** GCP service account email for ExternalDNS Workload Identity. */
+    externalDnsGsaEmail: string;
+    /** CockroachDB cluster configuration. */
+    cockroachdb: CockroachDbRegionCockroachConfig;
+    /** TLS certificate sync config (External Secrets Operator). */
+    tls: CockroachDbRegionTlsConfig;
+    /** Namespace resource quotas. */
+    quota?: {
+        /** Total CPU limit quota (e.g. "8"). */
+        cpu?: string;
+        /** Total memory limit quota (e.g. "20Gi"). */
+        memory?: string;
+        /** Maximum pods. */
+        maxPods?: number;
+    };
+    /**
+     * CIDRs that may send traffic to CockroachDB ports (26257 + 8080).
+     * Used in the allow-cockroachdb NetworkPolicy.
+     */
+    allowCidrs?: string[];
+    /**
+     * Cloud Armor WAF configuration.
+     * When set, a BackendConfig is created attaching the policy to the public service.
+     */
+    cloudArmor?: {
+        /** Cloud Armor security policy name. */
+        policyName: string;
+    };
+    /**
+     * Emit Prometheus ConfigMap + Deployment + Service for CockroachDB metrics.
+     * Uses a lightweight Prometheus scraping `/_status/vars` (default: false).
+     */
+    monitoring?: boolean;
+    /** Additional labels for all resources. */
+    labels?: Record<string, string>;
+}
+/**
+ * Create a CockroachDbRegionStack composite — returns all K8s resources for one
+ * CockroachDB region in a single call.
+ *
+ * Replaces: namespace.ts, storage.ts, cockroachdb.ts, external-secrets.ts,
+ * ingress.ts, tls.ts, backend-config.ts, monitoring.ts (8 files → 1 call).
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { CockroachDbRegionStack } from "@intentius/chant-lexicon-k8s";
+ *
+ * export const east = CockroachDbRegionStack({
+ *   region: "east",
+ *   namespace: "crdb-east",
+ *   domain: `east.${CRDB_DOMAIN}`,
+ *   internalDomain: `east.${INTERNAL_DOMAIN}`,
+ *   publicRootDomain: CRDB_DOMAIN,
+ *   projectId: GCP_PROJECT_ID,
+ *   clusterName: "gke-crdb-east",
+ *   clusterRegion: "us-east4",
+ *   crdbGsaEmail: `gke-crdb-east-crdb@${GCP_PROJECT_ID}.iam.gserviceaccount.com`,
+ *   externalDnsGsaEmail: `gke-crdb-east-dns@${GCP_PROJECT_ID}.iam.gserviceaccount.com`,
+ *   cockroachdb: {
+ *     locality: "cloud=gcp,region=us-east4",
+ *     joinAddresses: [...],
+ *     advertiseHostDomain: `east.${INTERNAL_DOMAIN}`,
+ *     skipInit: false,
+ *     mountClientCerts: true,
+ *   },
+ *   tls: {
+ *     gcpSecretNames: {
+ *       ca: "crdb-ca-crt", nodeCrt: "crdb-node-crt", nodeKey: "crdb-node-key",
+ *       clientRootCrt: "crdb-client-root-crt", clientRootKey: "crdb-client-root-key",
+ *     },
+ *   },
+ *   allowCidrs: ALL_CIDRS,
+ *   cloudArmor: { policyName: "crdb-ui-waf" },
+ *   monitoring: true,
+ * });
+ * ```
+ */
+export declare const CockroachDbRegionStack: import("@intentius/chant").CompositeDefinition<CockroachDbRegionStackConfig, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=cockroachdb-region-stack.d.ts.map

package/dist/composites/cockroachdb-region-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cockroachdb-region-stack.d.ts","sourceRoot":"","sources":["../../src/composites/cockroachdb-region-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0BH,MAAM,WAAW,gCAAgC;IAC/C,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;OAEG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;OAEG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC;;OAEG;IACH,cAAc,EAAE;QACd,iDAAiD;QACjD,EAAE,EAAE,MAAM,CAAC;QACX,6BAA6B;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,iCAAiC;QACjC,OAAO,EAAE,MAAM,CAAC;QAChB,oCAAoC;QACpC,aAAa,EAAE,MAAM,CAAC;QACtB,mCAAmC;QACnC,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAC;IAEzB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;IAE5B,yCAAyC;IACzC,WAAW,EAAE,gCAAgC,CAAC;IAC9C,+DAA+D;IAC/D,GAAG,EAAE,0BAA0B,CAAC;IAEhC,iCAAiC;IACjC,KAAK,CAAC,EAAE;QACN,wCAAwC;QACxC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,8CAA8C;QAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,oBAAoB;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB;;;OAGG;IACH,UAAU,CAAC,EAAE;QACX,wCAAwC;QACxC,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,sBAAsB,2HAmWP,CAAC"}

package/dist/composites/config-connector-context.d.ts

@@ -0,0 +1,41 @@
+/**
+ * ConfigConnectorContext composite — bootstrap Config Connector per-namespace context.
+ *
+ * @gke Creates a ConfigConnectorContext resource that configures
+ * Config Connector to manage GCP resources in a specific namespace.
+ */
+import { Deployment } from "../generated/index.js";
+export interface ConfigConnectorContextProps {
+    /** Context name (default: "configconnectorcontext.core.cnrm.cloud.google.com"). */
+    name?: string;
+    /** Google service account email for Config Connector to use. */
+    googleServiceAccountEmail: string;
+    /** Namespace for the context (default: "default"). */
+    namespace?: string;
+    /** Whether to sync status into spec (default: "Absent"). */
+    stateIntoSpec?: "Absent" | "Merge";
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        context?: Partial<Record<string, unknown>>;
+    };
+}
+export interface ConfigConnectorContextResult {
+    context: InstanceType<typeof Deployment>;
+}
+/**
+ * Create a ConfigConnectorContext composite — returns prop objects for
+ * a ConfigConnectorContext resource.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { ConfigConnectorContext } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { context } = ConfigConnectorContext({
+ *   googleServiceAccountEmail: "cnrm@my-project.iam.gserviceaccount.com",
+ *   namespace: "config-connector",
+ * });
+ * ```
+ */
+export declare const ConfigConnectorContext: import("@intentius/chant").CompositeDefinition<ConfigConnectorContextProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=config-connector-context.d.ts.map

package/dist/composites/config-connector-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-connector-context.d.ts","sourceRoot":"","sources":["../../src/composites/config-connector-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,WAAW,2BAA2B;IAC1C,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,yBAAyB,EAAE,MAAM,CAAC;IAClC,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACnC,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC5C,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,sBAAsB,0HAwBP,CAAC"}

package/dist/composites/configured-app.d.ts

@@ -0,0 +1,91 @@
+/**
+ * ConfiguredApp composite — Deployment + Service + optional ConfigMap.
+ *
+ * Wires ConfigMap→Volume→VolumeMount and Secret→Volume→VolumeMount
+ * triangles, plus envFrom injection. Covers cdk8s-plus Volume.fromConfigMap(),
+ * Volume.fromSecret(), and container.mount() patterns.
+ */
+import { Deployment, Service, ConfigMap } from "../generated/index.js";
+import type { ContainerSecurityContext } from "./security-context.js";
+export interface ConfiguredAppProps {
+    /** Application name — used in metadata and labels. */
+    name: string;
+    /** Container image. */
+    image: string;
+    /** Container port (default: 80). */
+    port?: number;
+    /** Number of replicas (default: 2). */
+    replicas?: number;
+    /** Config data — creates a ConfigMap. */
+    configData?: Record<string, string>;
+    /** Mount path for the ConfigMap volume. */
+    configMountPath?: string;
+    /** Existing Secret name to mount as a volume. */
+    secretName?: string;
+    /** Mount path for the Secret volume. */
+    secretMountPath?: string;
+    /** Inject config/secrets as environment variables. */
+    envFrom?: {
+        configMapRef?: string;
+        secretRef?: string;
+    };
+    /** Init containers (e.g., migrations, cert setup). */
+    initContainers?: Array<{
+        name: string;
+        image: string;
+        command?: string[];
+        args?: string[];
+    }>;
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** CPU limit (default: "500m"). */
+    cpuLimit?: string;
+    /** Memory limit (default: "256Mi"). */
+    memoryLimit?: string;
+    /** CPU request (default: "100m"). */
+    cpuRequest?: string;
+    /** Memory request (default: "128Mi"). */
+    memoryRequest?: string;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Environment variables for the container. */
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** Container security context (supports PSS restricted fields). */
+    securityContext?: ContainerSecurityContext;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        deployment?: Partial<Record<string, unknown>>;
+        service?: Partial<Record<string, unknown>>;
+        configMap?: Partial<Record<string, unknown>>;
+    };
+}
+export interface ConfiguredAppResult {
+    deployment: InstanceType<typeof Deployment>;
+    service: InstanceType<typeof Service>;
+    configMap?: InstanceType<typeof ConfigMap>;
+}
+/**
+ * Create a ConfiguredApp composite — returns prop objects for
+ * a Deployment, Service, and optional ConfigMap.
+ *
+ * @example
+ * ```ts
+ * import { ConfiguredApp } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { deployment, service, configMap } = ConfiguredApp({
+ *   name: "api",
+ *   image: "api:1.0",
+ *   port: 8080,
+ *   configData: { "app.conf": "key=value" },
+ *   configMountPath: "/etc/api",
+ *   secretName: "api-creds",
+ *   secretMountPath: "/secrets",
+ *   envFrom: { secretRef: "api-env-secret" },
+ * });
+ * ```
+ */
+export declare const ConfiguredApp: import("@intentius/chant").CompositeDefinition<ConfiguredAppProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=configured-app.d.ts.map

package/dist/composites/configured-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configured-app.d.ts","sourceRoot":"","sources":["../../src/composites/configured-app.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,sDAAsD;IACtD,cAAc,CAAC,EAAE,KAAK,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,mEAAmE;IACnE,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC9C,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;IAC5C,OAAO,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,SAAS,CAAC,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa,iHA0IP,CAAC"}