@intentius/chant-lexicon-k8s 0.7.0 → 0.8.1

package/dist/composites/gke-gateway.d.ts

@@ -0,0 +1,63 @@
+/**
+ * GkeGateway composite — Gateway + HTTPRoute for GKE Gateway API.
+ *
+ * @gke Creates a Gateway with a GKE-specific `gatewayClassName` and
+ * HTTPRoute resources for traffic routing.
+ */
+import { Deployment } from "../generated/index.js";
+export interface GkeGatewayHost {
+    /** Hostname (e.g., "api.example.com"). */
+    hostname: string;
+    /** Path rules for this host. */
+    paths: Array<{
+        path: string;
+        serviceName: string;
+        servicePort: number;
+    }>;
+}
+export interface GkeGatewayProps {
+    /** Gateway name — used in metadata and labels. */
+    name: string;
+    /** GKE gateway class (default: "gke-l7-global-external-managed"). */
+    gatewayClassName?: "gke-l7-global-external-managed" | "gke-l7-regional-external-managed" | "gke-l7-rilb";
+    /** Host definitions with paths. */
+    hosts: GkeGatewayHost[];
+    /** Google-managed certificate name for TLS. */
+    certificateName?: string;
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        gateway?: Partial<Record<string, unknown>>;
+        httpRoute?: Partial<Record<string, unknown>>;
+    };
+}
+export interface GkeGatewayResult {
+    gateway: InstanceType<typeof Deployment>;
+    httpRoute: InstanceType<typeof Deployment>;
+}
+/**
+ * Create a GkeGateway composite — returns prop objects for
+ * a Gateway and HTTPRoute with GKE-specific gateway class.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { GkeGateway } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { gateway, httpRoute } = GkeGateway({
+ *   name: "api-gateway",
+ *   hosts: [
+ *     {
+ *       hostname: "api.example.com",
+ *       paths: [{ path: "/", serviceName: "api", servicePort: 80 }],
+ *     },
+ *   ],
+ *   certificateName: "api-cert",
+ * });
+ * ```
+ */
+export declare const GkeGateway: import("@intentius/chant").CompositeDefinition<GkeGatewayProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=gke-gateway.d.ts.map

package/dist/composites/gke-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gke-gateway.d.ts","sourceRoot":"","sources":["../../src/composites/gke-gateway.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,eAAe;IAC9B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,gBAAgB,CAAC,EACb,gCAAgC,GAChC,kCAAkC,GAClC,aAAa,CAAC;IAClB,mCAAmC;IACnC,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC9C,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;IACzC,SAAS,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,UAAU,8GA+EP,CAAC"}

package/dist/composites/gke-otel-collector.d.ts

@@ -0,0 +1,64 @@
+/**
+ * GkeOtelCollector composite — DaemonSet + RBAC + ConfigMap for OpenTelemetry on GKE.
+ *
+ * @gke Like AdotCollector but targets Cloud Trace + Cloud Monitoring via the
+ * googlecloud exporter and uses GKE Workload Identity instead of IRSA.
+ */
+import { DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, ConfigMap } from "../generated/index.js";
+export interface GkeOtelCollectorProps {
+    /** GKE cluster name. */
+    clusterName: string;
+    /** GCP project ID. */
+    projectId: string;
+    /** GCP service account email for Workload Identity. */
+    gcpServiceAccountEmail?: string;
+    /** Agent name (default: "gke-otel-collector"). */
+    name?: string;
+    /** OTel Collector image (default: "otel/opentelemetry-collector-contrib:latest"). */
+    image?: string;
+    /** Namespace (default: "gke-monitoring"). */
+    namespace?: string;
+    /** Additional labels. */
+    labels?: Record<string, string>;
+    /** CPU request (default: "100m"). */
+    cpuRequest?: string;
+    /** Memory request (default: "256Mi"). */
+    memoryRequest?: string;
+    /** CPU limit (default: "500m"). */
+    cpuLimit?: string;
+    /** Memory limit (default: "512Mi"). */
+    memoryLimit?: string;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        daemonSet?: Partial<Record<string, unknown>>;
+        serviceAccount?: Partial<Record<string, unknown>>;
+        clusterRole?: Partial<Record<string, unknown>>;
+        clusterRoleBinding?: Partial<Record<string, unknown>>;
+        configMap?: Partial<Record<string, unknown>>;
+    };
+}
+export interface GkeOtelCollectorResult {
+    daemonSet: InstanceType<typeof DaemonSet>;
+    serviceAccount: InstanceType<typeof ServiceAccount>;
+    clusterRole: InstanceType<typeof ClusterRole>;
+    clusterRoleBinding: InstanceType<typeof ClusterRoleBinding>;
+    configMap: InstanceType<typeof ConfigMap>;
+}
+/**
+ * Create a GkeOtelCollector composite — returns prop objects for
+ * a DaemonSet, ServiceAccount, ClusterRole, ClusterRoleBinding, and ConfigMap.
+ *
+ * @gke
+ * @example
+ * ```ts
+ * import { GkeOtelCollector } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { daemonSet, serviceAccount, clusterRole, clusterRoleBinding, configMap } = GkeOtelCollector({
+ *   clusterName: "my-cluster",
+ *   projectId: "my-project",
+ *   gcpServiceAccountEmail: "otel@my-project.iam.gserviceaccount.com",
+ * });
+ * ```
+ */
+export declare const GkeOtelCollector: import("@intentius/chant").CompositeDefinition<GkeOtelCollectorProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=gke-otel-collector.d.ts.map

package/dist/composites/gke-otel-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gke-otel-collector.d.ts","sourceRoot":"","sources":["../../src/composites/gke-otel-collector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAErG,MAAM,WAAW,qBAAqB;IACpC,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC9C,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;IAC1C,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,kBAAkB,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC5D,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gBAAgB,oHA6KP,CAAC"}

package/dist/composites/index.d.ts

@@ -0,0 +1,86 @@
+export type { ContainerSecurityContext } from "./security-context.js";
+export { WebApp } from "./web-app.js";
+export type { WebAppProps, WebAppResult } from "./web-app.js";
+export { StatefulApp } from "./stateful-app.js";
+export type { StatefulAppProps, StatefulAppResult } from "./stateful-app.js";
+export { CronWorkload } from "./cron-workload.js";
+export type { CronWorkloadProps, CronWorkloadResult } from "./cron-workload.js";
+export { AutoscaledService } from "./autoscaled-service.js";
+export type { AutoscaledServiceProps, AutoscaledServiceResult } from "./autoscaled-service.js";
+export { WorkerPool } from "./worker-pool.js";
+export type { WorkerPoolProps, WorkerPoolResult } from "./worker-pool.js";
+export { NamespaceEnv } from "./namespace-env.js";
+export type { NamespaceEnvProps, NamespaceEnvResult } from "./namespace-env.js";
+export { NodeAgent } from "./node-agent.js";
+export type { NodeAgentProps, NodeAgentResult } from "./node-agent.js";
+export { BatchJob } from "./batch-job.js";
+export type { BatchJobProps, BatchJobResult } from "./batch-job.js";
+export { SecureIngress } from "./secure-ingress.js";
+export type { SecureIngressProps, SecureIngressResult } from "./secure-ingress.js";
+export { ConfiguredApp } from "./configured-app.js";
+export type { ConfiguredAppProps, ConfiguredAppResult } from "./configured-app.js";
+export { SidecarApp } from "./sidecar-app.js";
+export type { SidecarAppProps, SidecarAppResult } from "./sidecar-app.js";
+export { MonitoredService } from "./monitored-service.js";
+export type { MonitoredServiceProps, MonitoredServiceResult } from "./monitored-service.js";
+export { NetworkIsolatedApp } from "./network-isolated-app.js";
+export type { NetworkIsolatedAppProps, NetworkIsolatedAppResult } from "./network-isolated-app.js";
+export { IrsaServiceAccount } from "./irsa-service-account.js";
+export type { IrsaServiceAccountProps, IrsaServiceAccountResult } from "./irsa-service-account.js";
+export { AlbIngress } from "./alb-ingress.js";
+export type { AlbIngressProps, AlbIngressResult } from "./alb-ingress.js";
+export { EbsStorageClass } from "./ebs-storage-class.js";
+export type { EbsStorageClassProps, EbsStorageClassResult } from "./ebs-storage-class.js";
+export { EfsStorageClass } from "./efs-storage-class.js";
+export type { EfsStorageClassProps, EfsStorageClassResult } from "./efs-storage-class.js";
+export { FluentBitAgent } from "./fluent-bit-agent.js";
+export type { FluentBitAgentProps, FluentBitAgentResult } from "./fluent-bit-agent.js";
+export { ExternalDnsAgent } from "./external-dns-agent.js";
+export type { ExternalDnsAgentProps, ExternalDnsAgentResult } from "./external-dns-agent.js";
+export { AdotCollector } from "./adot-collector.js";
+export type { AdotCollectorProps, AdotCollectorResult } from "./adot-collector.js";
+export { MetricsServer } from "./metrics-server.js";
+export type { MetricsServerProps, MetricsServerResult } from "./metrics-server.js";
+export { WorkloadIdentityServiceAccount } from "./workload-identity-service-account.js";
+export type { WorkloadIdentityServiceAccountProps, WorkloadIdentityServiceAccountResult } from "./workload-identity-service-account.js";
+export { GcePdStorageClass } from "./gce-pd-storage-class.js";
+export type { GcePdStorageClassProps, GcePdStorageClassResult } from "./gce-pd-storage-class.js";
+export { FilestoreStorageClass } from "./filestore-storage-class.js";
+export type { FilestoreStorageClassProps, FilestoreStorageClassResult } from "./filestore-storage-class.js";
+export { GkeGateway } from "./gke-gateway.js";
+export type { GkeGatewayProps, GkeGatewayResult } from "./gke-gateway.js";
+export { ConfigConnectorContext } from "./config-connector-context.js";
+export type { ConfigConnectorContextProps, ConfigConnectorContextResult } from "./config-connector-context.js";
+export { GceIngress } from "./gce-ingress.js";
+export type { GceIngressProps, GceIngressResult } from "./gce-ingress.js";
+export { AgicIngress } from "./agic-ingress.js";
+export type { AgicIngressProps, AgicIngressResult } from "./agic-ingress.js";
+export { AzureDiskStorageClass } from "./azure-disk-storage-class.js";
+export type { AzureDiskStorageClassProps, AzureDiskStorageClassResult } from "./azure-disk-storage-class.js";
+export { AzureFileStorageClass } from "./azure-file-storage-class.js";
+export type { AzureFileStorageClassProps, AzureFileStorageClassResult } from "./azure-file-storage-class.js";
+export { AzureMonitorCollector } from "./azure-monitor-collector.js";
+export type { AzureMonitorCollectorProps, AzureMonitorCollectorResult } from "./azure-monitor-collector.js";
+export { WorkloadIdentityServiceAccount as AksWorkloadIdentityServiceAccount } from "./workload-identity-sa.js";
+export type { WorkloadIdentityServiceAccountProps as AksWorkloadIdentityServiceAccountProps, WorkloadIdentityServiceAccountResult as AksWorkloadIdentityServiceAccountResult } from "./workload-identity-sa.js";
+export { GkeFluentBitAgent } from "./gke-fluent-bit-agent.js";
+export type { GkeFluentBitAgentProps, GkeFluentBitAgentResult } from "./gke-fluent-bit-agent.js";
+export { GkeOtelCollector } from "./gke-otel-collector.js";
+export type { GkeOtelCollectorProps, GkeOtelCollectorResult } from "./gke-otel-collector.js";
+export { GkeExternalDnsAgent } from "./gke-external-dns-agent.js";
+export type { GkeExternalDnsAgentProps, GkeExternalDnsAgentResult } from "./gke-external-dns-agent.js";
+export { AksExternalDnsAgent } from "./aks-external-dns-agent.js";
+export type { AksExternalDnsAgentProps, AksExternalDnsAgentResult } from "./aks-external-dns-agent.js";
+export { CockroachDbCluster } from "./cockroachdb-cluster.js";
+export type { CockroachDbClusterProps, CockroachDbClusterResult } from "./cockroachdb-cluster.js";
+export { CockroachDbRegionStack } from "./cockroachdb-region-stack.js";
+export type { CockroachDbRegionStackConfig, CockroachDbRegionCockroachConfig, CockroachDbRegionTlsConfig } from "./cockroachdb-region-stack.js";
+export { RayCluster } from "./ray-cluster.js";
+export type { RayClusterProps, RayClusterResult, RayClusterSpec, ResourceSpec, HeadGroupSpec, WorkerGroupSpec } from "./ray-cluster.js";
+export { RayJob } from "./ray-job.js";
+export type { RayJobProps, RayJobResult } from "./ray-job.js";
+export { RayService } from "./ray-service.js";
+export type { RayServiceProps, RayServiceResult } from "./ray-service.js";
+export { ArgoAppFor, ArgoAppSetForRegions, registerArgoCluster } from "./argo-app.js";
+export type { ArgoDestination, ArgoSyncPolicy, ArgoAppForOptions, ArgoAppForResult, ArgoRegionTarget, ArgoAppSetForRegionsOptions, ArgoAppSetForRegionsResult, RegisterArgoClusterOptions, RegisterArgoClusterResult, } from "./argo-app.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/composites/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composites/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,YAAY,EAAE,mCAAmC,EAAE,oCAAoC,EAAE,MAAM,qCAAqC,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACzG,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACzG,OAAO,EAAE,8BAA8B,IAAI,iCAAiC,EAAE,MAAM,wBAAwB,CAAC;AAC7G,YAAY,EAAE,mCAAmC,IAAI,sCAAsC,EAAE,oCAAoC,IAAI,uCAAuC,EAAE,MAAM,wBAAwB,CAAC;AAC7M,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACpG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,4BAA4B,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAC7I,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACnF,YAAY,EACV,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,GAC1B,MAAM,YAAY,CAAC"}

package/dist/composites/irsa-service-account.d.ts

@@ -0,0 +1,54 @@
+/**
+ * IrsaServiceAccount composite — ServiceAccount + IAM annotation + optional RBAC.
+ *
+ * @eks Creates a ServiceAccount with the `eks.amazonaws.com/role-arn`
+ * annotation for IAM Roles for Service Accounts (IRSA).
+ */
+import { ServiceAccount, Role, RoleBinding } from "../generated/index.js";
+export interface IrsaServiceAccountProps {
+    /** ServiceAccount name — used in metadata and labels. */
+    name: string;
+    /** IAM Role ARN for IRSA annotation. */
+    iamRoleArn: string;
+    /** Optional RBAC rules — if provided, creates Role + RoleBinding. */
+    rbacRules?: Array<{
+        apiGroups: string[];
+        resources: string[];
+        verbs: string[];
+    }>;
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        serviceAccount?: Partial<Record<string, unknown>>;
+        role?: Partial<Record<string, unknown>>;
+        roleBinding?: Partial<Record<string, unknown>>;
+    };
+}
+export interface IrsaServiceAccountResult {
+    serviceAccount: InstanceType<typeof ServiceAccount>;
+    role?: InstanceType<typeof Role>;
+    roleBinding?: InstanceType<typeof RoleBinding>;
+}
+/**
+ * Create an IrsaServiceAccount composite — returns prop objects for
+ * a ServiceAccount with IRSA annotation, and optional Role + RoleBinding.
+ *
+ * @eks
+ * @example
+ * ```ts
+ * import { IrsaServiceAccount } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { serviceAccount, role, roleBinding } = IrsaServiceAccount({
+ *   name: "app-sa",
+ *   iamRoleArn: "arn:aws:iam::123456789012:role/my-app-role",
+ *   rbacRules: [
+ *     { apiGroups: [""], resources: ["secrets"], verbs: ["get"] },
+ *   ],
+ * });
+ * ```
+ */
+export declare const IrsaServiceAccount: import("@intentius/chant").CompositeDefinition<IrsaServiceAccountProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=irsa-service-account.d.ts.map

package/dist/composites/irsa-service-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"irsa-service-account.d.ts","sourceRoot":"","sources":["../../src/composites/irsa-service-account.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAChD,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,sHAgEP,CAAC"}

package/dist/composites/metrics-server.d.ts

@@ -0,0 +1,56 @@
+/**
+ * MetricsServer composite — Deployment + Service + ServiceAccount + RBAC + APIService.
+ *
+ * Deploys metrics-server for HPA pod CPU/memory metrics. metrics-server is not an
+ * EKS managed addon — it needs K8s workloads. Uses in-cluster RBAC only (no IRSA).
+ */
+import { Deployment, Service, ServiceAccount, ClusterRole, ClusterRoleBinding, APIService } from "../generated/index.js";
+export interface MetricsServerProps {
+    /** Agent name (default: "metrics-server"). */
+    name?: string;
+    /** Container image (default: "registry.k8s.io/metrics-server/metrics-server:v0.7.2"). */
+    image?: string;
+    /** Replicas (default: 1). */
+    replicas?: number;
+    /** Namespace (default: "kube-system"). */
+    namespace?: string;
+    /** Additional labels. */
+    labels?: Record<string, string>;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        deployment?: Partial<Record<string, unknown>>;
+        service?: Partial<Record<string, unknown>>;
+        serviceAccount?: Partial<Record<string, unknown>>;
+        clusterRole?: Partial<Record<string, unknown>>;
+        clusterRoleBinding?: Partial<Record<string, unknown>>;
+        aggregatedClusterRole?: Partial<Record<string, unknown>>;
+        authDelegatorBinding?: Partial<Record<string, unknown>>;
+        apiService?: Partial<Record<string, unknown>>;
+    };
+}
+export interface MetricsServerResult {
+    deployment: InstanceType<typeof Deployment>;
+    service: InstanceType<typeof Service>;
+    serviceAccount: InstanceType<typeof ServiceAccount>;
+    clusterRole: InstanceType<typeof ClusterRole>;
+    clusterRoleBinding: InstanceType<typeof ClusterRoleBinding>;
+    /** ClusterRole for aggregated API access. */
+    aggregatedClusterRole: InstanceType<typeof ClusterRole>;
+    /** Binding for aggregated API auth-delegator. */
+    authDelegatorBinding: InstanceType<typeof ClusterRoleBinding>;
+    /** APIService registration for v1beta1.metrics.k8s.io. */
+    apiService: InstanceType<typeof APIService>;
+}
+/**
+ * Create a MetricsServer composite — returns prop objects for a Deployment,
+ * Service, ServiceAccount, ClusterRoles, ClusterRoleBindings, and APIService.
+ *
+ * @example
+ * ```ts
+ * import { MetricsServer } from "@intentius/chant-lexicon-k8s";
+ *
+ * const ms = MetricsServer({});
+ * ```
+ */
+export declare const MetricsServer: import("@intentius/chant").CompositeDefinition<MetricsServerProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=metrics-server.d.ts.map

package/dist/composites/metrics-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics-server.d.ts","sourceRoot":"","sources":["../../src/composites/metrics-server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEhH,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,kBAAkB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACtD,qBAAqB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,oBAAoB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxD,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC/C,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;IAC5C,OAAO,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,kBAAkB,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC5D,6CAA6C;IAC7C,qBAAqB,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IACxD,iDAAiD;IACjD,oBAAoB,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC9D,0DAA0D;IAC1D,UAAU,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,iHAmLP,CAAC"}

package/dist/composites/monitored-service.d.ts

@@ -0,0 +1,92 @@
+/**
+ * MonitoredService composite — Deployment + Service + ServiceMonitor + optional PrometheusRule.
+ *
+ * Observability pattern. ServiceMonitor and PrometheusRule are CRDs
+ * from the Prometheus Operator (monitoring.coreos.com/v1), returned
+ * as raw objects that can be serialized alongside native K8s resources.
+ */
+import { Deployment, Service, ServiceMonitor, PrometheusRule } from "../generated/index.js";
+import type { ContainerSecurityContext } from "./security-context.js";
+export interface AlertRule {
+    /** Alert name. */
+    name: string;
+    /** PromQL expression. */
+    expr: string;
+    /** Duration before firing (e.g., "5m"). */
+    for?: string;
+    /** Severity label (e.g., "warning", "critical"). */
+    severity?: string;
+    /** Additional annotations (summary, description). */
+    annotations?: Record<string, string>;
+}
+export interface MonitoredServiceProps {
+    /** Application name — used in metadata and labels. */
+    name: string;
+    /** Container image. */
+    image: string;
+    /** Application container port (default: 80). */
+    port?: number;
+    /** Metrics port (default: 9090). */
+    metricsPort?: number;
+    /** Metrics path (default: "/metrics"). */
+    metricsPath?: string;
+    /** Scrape interval (default: "30s"). */
+    scrapeInterval?: string;
+    /** Alert rules — if provided, creates a PrometheusRule. */
+    alertRules?: AlertRule[];
+    /** Number of replicas (default: 2). */
+    replicas?: number;
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** CPU limit (default: "500m"). */
+    cpuLimit?: string;
+    /** Memory limit (default: "256Mi"). */
+    memoryLimit?: string;
+    /** CPU request (default: "100m"). */
+    cpuRequest?: string;
+    /** Memory request (default: "128Mi"). */
+    memoryRequest?: string;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Environment variables for the container. */
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** Container security context (supports PSS restricted fields). */
+    securityContext?: ContainerSecurityContext;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        deployment?: Partial<Record<string, unknown>>;
+        service?: Partial<Record<string, unknown>>;
+        serviceMonitor?: Partial<Record<string, unknown>>;
+        prometheusRule?: Partial<Record<string, unknown>>;
+    };
+}
+export interface MonitoredServiceResult {
+    deployment: InstanceType<typeof Deployment>;
+    service: InstanceType<typeof Service>;
+    serviceMonitor: InstanceType<typeof ServiceMonitor>;
+    prometheusRule?: InstanceType<typeof PrometheusRule>;
+}
+/**
+ * Create a MonitoredService composite — returns prop objects for
+ * a Deployment, Service, ServiceMonitor, and optional PrometheusRule.
+ *
+ * @example
+ * ```ts
+ * import { MonitoredService } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { deployment, service, serviceMonitor, prometheusRule } = MonitoredService({
+ *   name: "api",
+ *   image: "api:1.0",
+ *   port: 8080,
+ *   metricsPort: 9090,
+ *   alertRules: [
+ *     { name: "HighErrorRate", expr: 'rate(http_errors_total[5m]) > 0.1', for: "5m", severity: "critical" },
+ *   ],
+ * });
+ * ```
+ */
+export declare const MonitoredService: import("@intentius/chant").CompositeDefinition<MonitoredServiceProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=monitored-service.d.ts.map

package/dist/composites/monitored-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitored-service.d.ts","sourceRoot":"","sources":["../../src/composites/monitored-service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,WAAW,SAAS;IACxB,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,qBAAqB;IACpC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,mEAAmE;IACnE,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACnD,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;IAC5C,OAAO,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,cAAc,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,YAAY,CAAC,OAAO,cAAc,CAAC,CAAC;CACtD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,oHAqIP,CAAC"}

package/dist/composites/namespace-env.d.ts

@@ -0,0 +1,64 @@
+/**
+ * NamespaceEnv composite — Namespace + optional ResourceQuota + LimitRange + NetworkPolicy.
+ *
+ * A higher-level construct for multi-tenant namespace provisioning with
+ * resource guardrails and network isolation.
+ */
+import { Namespace, ResourceQuota, LimitRange, NetworkPolicy } from "../generated/index.js";
+export interface NamespaceEnvProps {
+    /** Namespace name. */
+    name: string;
+    /** Total namespace CPU quota (e.g., "8"). */
+    cpuQuota?: string;
+    /** Total namespace memory quota (e.g., "16Gi"). */
+    memoryQuota?: string;
+    /** Maximum pods in namespace. */
+    maxPods?: number;
+    /** LimitRange default CPU request (e.g., "100m"). */
+    defaultCpuRequest?: string;
+    /** LimitRange default memory request (e.g., "128Mi"). */
+    defaultMemoryRequest?: string;
+    /** LimitRange default CPU limit (e.g., "500m"). */
+    defaultCpuLimit?: string;
+    /** LimitRange default memory limit (e.g., "512Mi"). */
+    defaultMemoryLimit?: string;
+    /** Create default-deny ingress NetworkPolicy (default: true). */
+    defaultDenyIngress?: boolean;
+    /** Create default-deny egress NetworkPolicy (default: false). */
+    defaultDenyEgress?: boolean;
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        namespace?: Partial<Record<string, unknown>>;
+        resourceQuota?: Partial<Record<string, unknown>>;
+        limitRange?: Partial<Record<string, unknown>>;
+        networkPolicy?: Partial<Record<string, unknown>>;
+    };
+}
+export interface NamespaceEnvResult {
+    namespace: InstanceType<typeof Namespace>;
+    resourceQuota?: InstanceType<typeof ResourceQuota>;
+    limitRange?: InstanceType<typeof LimitRange>;
+    networkPolicy?: InstanceType<typeof NetworkPolicy>;
+}
+/**
+ * Create a NamespaceEnv composite — returns prop objects for
+ * a Namespace, optional ResourceQuota, LimitRange, and NetworkPolicy.
+ *
+ * @example
+ * ```ts
+ * import { NamespaceEnv } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { namespace, resourceQuota, limitRange, networkPolicy } = NamespaceEnv({
+ *   name: "team-alpha",
+ *   cpuQuota: "8",
+ *   memoryQuota: "16Gi",
+ *   defaultCpuRequest: "100m",
+ *   defaultMemoryRequest: "128Mi",
+ *   defaultDenyIngress: true,
+ * });
+ * ```
+ */
+export declare const NamespaceEnv: import("@intentius/chant").CompositeDefinition<NamespaceEnvProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=namespace-env.d.ts.map

package/dist/composites/namespace-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace-env.d.ts","sourceRoot":"","sources":["../../src/composites/namespace-env.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEnF,MAAM,WAAW,iBAAiB;IAChC,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAClD,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;IAC1C,aAAa,CAAC,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,YAAY,gHAwGP,CAAC"}

package/dist/composites/network-isolated-app.d.ts

@@ -0,0 +1,88 @@
+/**
+ * NetworkIsolatedApp composite — Deployment + Service + NetworkPolicy.
+ *
+ * Per-app allow rules beyond NamespaceEnv's default-deny.
+ * Creates fine-grained ingress/egress policies for a single application.
+ */
+import { Deployment, Service, NetworkPolicy } from "../generated/index.js";
+import type { ContainerSecurityContext } from "./security-context.js";
+export interface NetworkPolicyPeer {
+    /** Pod selector for the peer. */
+    podSelector?: Record<string, string>;
+    /** Namespace selector for the peer. */
+    namespaceSelector?: Record<string, string>;
+}
+export interface NetworkPolicyEgressPeer extends NetworkPolicyPeer {
+    /** Allowed ports for egress. */
+    ports?: Array<{
+        port: number;
+        protocol?: string;
+    }>;
+}
+export interface NetworkIsolatedAppProps {
+    /** Application name — used in metadata and labels. */
+    name: string;
+    /** Container image. */
+    image: string;
+    /** Container port (default: 80). */
+    port?: number;
+    /** Number of replicas (default: 2). */
+    replicas?: number;
+    /** Allowed ingress sources. */
+    allowIngressFrom?: NetworkPolicyPeer[];
+    /** Allowed egress destinations. */
+    allowEgressTo?: NetworkPolicyEgressPeer[];
+    /** Additional labels to apply to all resources. */
+    labels?: Record<string, string>;
+    /** CPU limit (default: "500m"). */
+    cpuLimit?: string;
+    /** Memory limit (default: "256Mi"). */
+    memoryLimit?: string;
+    /** CPU request (default: "100m"). */
+    cpuRequest?: string;
+    /** Memory request (default: "128Mi"). */
+    memoryRequest?: string;
+    /** Namespace for all resources. */
+    namespace?: string;
+    /** Environment variables for the container. */
+    env?: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** Container security context (supports PSS restricted fields). */
+    securityContext?: ContainerSecurityContext;
+    /** Per-member defaults for fine-grained overrides. */
+    defaults?: {
+        deployment?: Partial<Record<string, unknown>>;
+        service?: Partial<Record<string, unknown>>;
+        networkPolicy?: Partial<Record<string, unknown>>;
+    };
+}
+export interface NetworkIsolatedAppResult {
+    deployment: InstanceType<typeof Deployment>;
+    service: InstanceType<typeof Service>;
+    networkPolicy: InstanceType<typeof NetworkPolicy>;
+}
+/**
+ * Create a NetworkIsolatedApp composite — returns prop objects for
+ * a Deployment, Service, and NetworkPolicy.
+ *
+ * @example
+ * ```ts
+ * import { NetworkIsolatedApp } from "@intentius/chant-lexicon-k8s";
+ *
+ * const { deployment, service, networkPolicy } = NetworkIsolatedApp({
+ *   name: "api",
+ *   image: "api:1.0",
+ *   port: 8080,
+ *   allowIngressFrom: [
+ *     { podSelector: { "app.kubernetes.io/name": "frontend" } },
+ *   ],
+ *   allowEgressTo: [
+ *     { podSelector: { "app.kubernetes.io/name": "postgres" }, ports: [{ port: 5432 }] },
+ *   ],
+ * });
+ * ```
+ */
+export declare const NetworkIsolatedApp: import("@intentius/chant").CompositeDefinition<NetworkIsolatedAppProps, import("@intentius/chant").CompositeMembers>;
+//# sourceMappingURL=network-isolated-app.d.ts.map

package/dist/composites/network-isolated-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-isolated-app.d.ts","sourceRoot":"","sources":["../../src/composites/network-isolated-app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,gCAAgC;IAChC,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACvC,mCAAmC;IACnC,aAAa,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAC1C,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,mEAAmE;IACnE,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,sDAAsD;IACtD,QAAQ,CAAC,EAAE;QACT,UAAU,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAClD,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;IAC5C,OAAO,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;IACtC,aAAa,EAAE,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kBAAkB,sHAuHP,CAAC"}