@intentius/chant-lexicon-azure 0.124.30 → 0.124.32

package/dist/spec/fetch.js

@@ -0,0 +1,196 @@
+/**
+ * Azure Resource Manager schema fetching.
+ *
+ * Downloads the azure-resource-manager-schemas repo tarball,
+ * extracts provider JSON schemas, deduplicates by latest API version,
+ * and "explodes" multi-resource files into one entry per resource.
+ */
+import { homedir } from "os";
+import { join } from "path";
+import { fetchWithCache, extractFromTar, clearCacheFile } from "@intentius/chant/codegen/fetch";
+import { latestVersionPerProvider } from "./api-versions.js";
+/** Per-attempt download timeout for a multi-megabyte archive. */
+const ARCHIVE_ATTEMPT_TIMEOUT_MS = 120000;
+/**
+ * Pinned commit of Azure/azure-resource-manager-schemas (#1144).
+ *
+ * The repo has no tagged releases, so unlike gcp (`KCC_VERSION`) or k8s
+ * (`K8S_SCHEMA_VERSION`) there is no version tag to pin against — codegen
+ * used to fetch `refs/heads/main` directly. That meant a cold cache picked
+ * up whatever upstream state had landed since the cache last expired, while
+ * a warm cache kept serving whatever was current when it was last filled.
+ * Azure republishes per-provider schema files under new dates constantly,
+ * and a later date can drop resources an earlier one defined (see
+ * PROVIDER_VERSION_OVERRIDES in ./api-versions.ts) — so which resources
+ * even exist to generate depends on exactly when you fetch, not just what
+ * the fetch URL happens to be. That broke composites/vm-linux.ts at tsc
+ * nondeterministically, depending on which runner's cache was warm.
+ *
+ * Pinning to a commit SHA makes generation reproducible regardless of cache
+ * state. Bump policy: #523's scheduled lexicon-upgrade cron (rolling-spec
+ * bucket, sub-issue #526) is meant to propose bumps to this constant as a
+ * reviewable PR once built. Until then, bump by hand: take the current
+ * `main` HEAD sha from
+ * https://github.com/Azure/azure-resource-manager-schemas/commits/main,
+ * regenerate, fix up any composite left referencing a renamed or vanished
+ * export (adding a PROVIDER_VERSION_OVERRIDES entry if a resource dropped
+ * out of the naive "latest by date" pick), and update this constant +
+ * comment.
+ */
+export const AZURE_SCHEMA_COMMIT = "0085cb6f3a98e735359807143bcb1667aeec930f";
+const TARBALL_URL = `https://github.com/Azure/azure-resource-manager-schemas/archive/${AZURE_SCHEMA_COMMIT}.tar.gz`;
+const CACHE_DIR = join(homedir(), ".chant");
+// The cache filename embeds the pin so a stale tarball from before a bump
+// can never mask the bump: restoring an old ~/.chant (e.g. a CI cache
+// partial-key fallback, or a developer's pre-existing cache) simply misses
+// this filename and re-downloads, instead of silently serving pre-bump
+// schemas under a name that still matches (#1144).
+const CACHE_FILE = join(CACHE_DIR, `azure-resource-manager-schemas-${AZURE_SCHEMA_COMMIT}.tar.gz`);
+/** Paths to skip (common-types, non-provider files). */
+function isProviderSchema(path) {
+    if (path.includes("common-types/"))
+        return false;
+    if (path.includes("test/"))
+        return false;
+    if (!path.includes("/schemas/"))
+        return false;
+    // Must match schemas/{date}/Microsoft.*.json
+    return /schemas\/\d{4}-\d{2}-\d{2}(?:-preview)?\/Microsoft\.[^/]+\.json$/.test(path);
+}
+/**
+ * Normalize schema-file provider name to canonical ARM provider.
+ * "Microsoft.Network.NRP" → "Microsoft.Network"
+ * "Microsoft.Sql.Legacy"  → "Microsoft.Sql"
+ * "Microsoft.Compute"     → "Microsoft.Compute" (unchanged)
+ */
+function normalizeProvider(fileProvider) {
+    const parts = fileProvider.split(".");
+    // Microsoft.X.Y... → Microsoft.X
+    return parts.length > 2 ? `${parts[0]}.${parts[1]}` : fileProvider;
+}
+/**
+ * Providers whose scope-specific resource definition sections are read in
+ * addition to `resourceDefinitions` (#1545).
+ *
+ * Deliberately an allowlist: reading the scoped sections for every provider
+ * would pull hundreds of subscription/tenant-scope resources into the
+ * generated surface at once (and back into tsc time — see the #438 bounding
+ * story). Only the org-hierarchy and policy providers need them today; grow
+ * this set intentionally, checking generated size and azure tsc time after.
+ */
+const SCOPED_SECTION_PROVIDERS = new Set([
+    "Microsoft.Management",
+    "Microsoft.Subscription",
+    "Microsoft.Authorization",
+]);
+/** Scope sections of a provider file, in definition-priority order. */
+const SCOPE_SECTIONS = [
+    { key: "resourceDefinitions", scope: "resourceGroup" },
+    { key: "subscription_resourceDefinitions", scope: "subscription" },
+    { key: "managementGroup_resourceDefinitions", scope: "managementGroup" },
+    { key: "tenant_resourceDefinitions", scope: "tenant" },
+];
+/**
+ * Explode one provider schema file into per-resource schema entries,
+ * writing into `out` keyed by resource type. Resource types already present
+ * in `out` are left untouched (first file wins across a multi-version pin).
+ *
+ * For providers in {@link SCOPED_SECTION_PROVIDERS} all deployment-scope
+ * sections are read; the definition comes from the highest-priority section
+ * that has it, and `deployScopes` unions every section that defines it.
+ */
+export function explodeProviderSchema(provider, apiVersion, providerSchema, out) {
+    const definitions = providerSchema.definitions ?? {};
+    const sections = SCOPED_SECTION_PROVIDERS.has(normalizeProvider(provider))
+        ? SCOPE_SECTIONS
+        : SCOPE_SECTIONS.slice(0, 1);
+    // Gather each resource name's definition (highest-priority section wins)
+    // and the union of scopes that define it.
+    const byName = new Map();
+    for (const { key, scope } of sections) {
+        const defs = providerSchema[key];
+        if (!defs)
+            continue;
+        for (const [resourceName, resourceDef] of Object.entries(defs)) {
+            const existing = byName.get(resourceName);
+            if (existing) {
+                existing.scopes.push(scope);
+            }
+            else {
+                byName.set(resourceName, { def: resourceDef, scopes: [scope] });
+            }
+        }
+    }
+    for (const [resourceName, { def, scopes }] of byName) {
+        const resourceType = `${normalizeProvider(provider)}/${resourceName}`;
+        if (out.has(resourceType))
+            continue;
+        // Build a per-resource schema that includes the resource def + shared definitions + apiVersion
+        const perResourceSchema = {
+            resourceType,
+            apiVersion,
+            provider,
+            resourceName,
+            deployScopes: scopes,
+            resourceDefinition: def,
+            definitions,
+        };
+        out.set(resourceType, Buffer.from(JSON.stringify(perResourceSchema)));
+    }
+}
+/**
+ * Fetch ARM schemas and return a Map keyed by resource type
+ * (e.g. "Microsoft.Storage/storageAccounts") to raw JSON bytes.
+ *
+ * Each provider file is "exploded" so that every resourceDefinition
+ * becomes its own entry with the shared definitions included.
+ */
+export async function fetchArmSchemas(force = false) {
+    const tarGz = await fetchWithCache({ url: TARBALL_URL, cacheFile: CACHE_FILE, attemptTimeoutMs: ARCHIVE_ATTEMPT_TIMEOUT_MS }, force);
+    // Gunzip
+    const { gunzipSync } = await import("fflate");
+    const tarData = gunzipSync(new Uint8Array(tarGz));
+    // Extract all provider schema files
+    const allFiles = extractFromTar(tarData, isProviderSchema);
+    // Deduplicate: keep only the latest API version per provider, or the pinned
+    // versions (in pin order) for providers in PROVIDER_VERSION_OVERRIDES.
+    const paths = [...allFiles.keys()];
+    const selected = latestVersionPerProvider(paths);
+    // Explode: one provider file has N resourceDefinitions → emit N entries.
+    // With a multi-version pin the first file that defines a resource wins.
+    const schemas = new Map();
+    for (const [provider, files] of selected) {
+        // First-wins applies within one provider's pin list; across providers the
+        // pre-#1545 behavior is kept (a later provider file may overwrite a
+        // normalized-name collision, e.g. Microsoft.Sql.Legacy vs Microsoft.Sql).
+        const providerSchemas = new Map();
+        for (const { path, apiVersion } of files) {
+            const data = allFiles.get(path);
+            if (!data)
+                continue;
+            try {
+                const providerSchema = JSON.parse(data.toString("utf-8"));
+                explodeProviderSchema(provider, apiVersion, providerSchema, providerSchemas);
+            }
+            catch {
+                // Skip files that can't be parsed
+            }
+        }
+        for (const [resourceType, buf] of providerSchemas) {
+            schemas.set(resourceType, buf);
+        }
+    }
+    return schemas;
+}
+/**
+ * Get the cache file path (for testing).
+ */
+export function getCachePath() {
+    return CACHE_FILE;
+}
+/**
+ * Clear the cache (for testing).
+ */
+export function clearCache() {
+    clearCacheFile(CACHE_FILE);
+}

package/dist/spec/parse.js

@@ -0,0 +1,308 @@
+/**
+ * Azure Resource Manager JSON Schema parser.
+ *
+ * Parses each exploded ARM schema into typed structures suitable for code generation:
+ * resources with properties and attributes, property types from definitions,
+ * and enum types from string enum definitions.
+ *
+ * Key differences from CloudFormation parsing:
+ * - ARM has resource-level fields (name, type, apiVersion, location, sku, kind,
+ *   identity, tags, zones, plan) separate from properties.properties
+ * - ARM schemas use oneOf wrappers with expression refs that must be unwrapped
+ * - ARM schemas lack readOnlyProperties — attributes are curated
+ */
+import { resolvePropertyType as coreResolvePropertyType, extractConstraints as coreExtractConstraints, constraintsIsEmpty as coreConstraintsIsEmpty, isEnumDefinition as coreIsEnumDefinition, } from "@intentius/chant/codegen/json-schema";
+import { boundPropertyTypes } from "@intentius/chant/codegen/bound-property-types";
+/** ARM resource-level fields that live outside properties.properties. */
+const RESOURCE_LEVEL_FIELDS = new Set([
+    "name",
+    "type",
+    "apiVersion",
+    "location",
+    "sku",
+    "kind",
+    "identity",
+    "tags",
+    "zones",
+    "plan",
+]);
+/** Expression reference pattern in ARM oneOf wrappers. */
+const EXPRESSION_REF_PATTERN = /definitions\.json#\/definitions\/expression|common\/definitions\.json/;
+/**
+ * Curated attributes for common ARM resources.
+ * ARM schemas lack readOnlyProperties, so we maintain this list.
+ */
+const CURATED_ATTRIBUTES = {
+    "Microsoft.Storage/storageAccounts": [
+        { name: "id", tsType: "string" },
+        { name: "primaryEndpoints", tsType: "string" },
+        { name: "primaryLocation", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Compute/virtualMachines": [
+        { name: "id", tsType: "string" },
+        { name: "vmId", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/virtualNetworks": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/networkSecurityGroups": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/publicIPAddresses": [
+        { name: "id", tsType: "string" },
+        { name: "ipAddress", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/networkInterfaces": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Web/serverfarms": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Web/sites": [
+        { name: "id", tsType: "string" },
+        { name: "defaultHostName", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.ContainerService/managedClusters": [
+        { name: "id", tsType: "string" },
+        { name: "fqdn", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+        { name: "nodeResourceGroup", tsType: "string" },
+    ],
+    "Microsoft.Sql/servers": [
+        { name: "id", tsType: "string" },
+        { name: "fullyQualifiedDomainName", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Sql/servers_databases": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.KeyVault/vaults": [
+        { name: "id", tsType: "string" },
+        { name: "vaultUri", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.ContainerRegistry/registries": [
+        { name: "id", tsType: "string" },
+        { name: "loginServer", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.DocumentDB/databaseAccounts": [
+        { name: "id", tsType: "string" },
+        { name: "documentEndpoint", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/loadBalancers": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+};
+/**
+ * Maximum nesting depth of generated property-type interfaces.
+ *
+ * ARM schemas embed a named definition for every nested object, and fully
+ * expanding all of them per-resource produces a ~273MB declaration that is not
+ * shippable as `.d.ts`. We instead emit only the property types reachable from
+ * a resource's top-level properties within this depth; references that are
+ * deeper, or to definitions no resource property reaches, are loosened to
+ * `Record<string, unknown>`. Depth 1 keeps top-level props + their immediate
+ * nested object shapes typed; deeper ARM config trees become loose. (#438)
+ */
+const MAX_PROPERTY_TYPE_DEPTH = 1;
+/**
+ * Property-type definition names that are always emitted as typed interfaces,
+ * regardless of reachability/depth — common nested ARM shapes worth typing for
+ * authoring ergonomics. Kept in sync with the azure `validate` required-names
+ * check (it asserts these survive code generation). (#438)
+ */
+export const CURATED_PROPERTY_TYPE_DEFS = new Set([
+    "Sku",
+    "Identity",
+    "NetworkProfile",
+    "StorageProfile",
+    "OsDisk",
+    "ImageReference",
+    "IpConfiguration",
+    "SecurityRule",
+    "SubnetProperties",
+    "SiteConfig",
+]);
+/**
+ * Parse an ARM schema (exploded per-resource format) into typed structures.
+ */
+export function parseArmSchema(data) {
+    const raw = JSON.parse(typeof data === "string" ? data : data.toString("utf-8"));
+    const resourceType = raw.resourceType;
+    const apiVersion = raw.apiVersion;
+    const resourceDef = raw.resourceDefinition;
+    const definitions = raw.definitions ?? {};
+    // Deployment scopes stamped by the fetch explode (#1545). Only carried
+    // through when the resource exists somewhere other than plain
+    // resource-group scope, so the common case stays field-free.
+    const rawScopes = raw.deployScopes;
+    const deployScopes = rawScopes && !(rawScopes.length === 1 && rawScopes[0] === "resourceGroup")
+        ? rawScopes
+        : undefined;
+    const shortName = armShortName(resourceType);
+    const fakeSchema = { definitions };
+    // Parse resource-level fields and nested properties
+    const props = [];
+    const resourceLevelFields = [];
+    if (resourceDef.properties) {
+        for (const [name, prop] of Object.entries(resourceDef.properties)) {
+            if (name === "type" || name === "apiVersion")
+                continue; // These are injected
+            const unwrapped = unwrapExpressionOneOf(prop);
+            if (RESOURCE_LEVEL_FIELDS.has(name)) {
+                resourceLevelFields.push(name);
+            }
+            // If this is the "properties" container, expand its sub-properties
+            if (name === "properties" && unwrapped.properties) {
+                const innerRequired = new Set(unwrapped.required ?? []);
+                for (const [innerName, innerProp] of Object.entries(unwrapped.properties)) {
+                    const innerUnwrapped = unwrapExpressionOneOf(innerProp);
+                    const tsType = resolvePropertyType(innerUnwrapped, definitions, shortName);
+                    props.push({
+                        name: innerName,
+                        tsType,
+                        required: innerRequired.has(innerName),
+                        description: innerUnwrapped.description,
+                        enum: innerUnwrapped.enum,
+                        constraints: extractConstraints(innerUnwrapped),
+                    });
+                }
+                continue;
+            }
+            const tsType = resolvePropertyType(unwrapped, definitions, shortName);
+            const requiredSet = new Set(resourceDef.required ?? []);
+            props.push({
+                name,
+                tsType,
+                required: requiredSet.has(name),
+                description: unwrapped.description,
+                enum: unwrapped.enum,
+                constraints: extractConstraints(unwrapped),
+            });
+        }
+    }
+    // Parse definitions into property types and enums
+    const propertyTypes = [];
+    const enums = [];
+    for (const [defName, def] of Object.entries(definitions)) {
+        // Skip expression-related definitions
+        if (defName === "expression" || defName.startsWith("http"))
+            continue;
+        if (isEnumDefinition(def)) {
+            enums.push({
+                name: `${shortName}_${defName}`,
+                values: def.enum,
+            });
+            continue;
+        }
+        if (def.properties) {
+            const defRequired = new Set(def.required ?? []);
+            const defProps = [];
+            for (const [propName, prop] of Object.entries(def.properties)) {
+                const unwrapped = unwrapExpressionOneOf(prop);
+                const tsType = resolvePropertyType(unwrapped, definitions, shortName);
+                defProps.push({
+                    name: propName,
+                    tsType,
+                    required: defRequired.has(propName),
+                    description: unwrapped.description,
+                    enum: unwrapped.enum,
+                    constraints: extractConstraints(unwrapped),
+                });
+            }
+            propertyTypes.push({
+                name: `${shortName}_${defName}`,
+                specType: defName,
+                properties: defProps,
+            });
+        }
+    }
+    // Attributes from curated map
+    const attrs = CURATED_ATTRIBUTES[resourceType] ?? [
+        { name: "id", tsType: "string" },
+    ];
+    // Bound the emitted property types to keep the generated declaration shippable (#438).
+    const boundedPropertyTypes = boundPropertyTypes(shortName, props, propertyTypes, new Set(enums.map((e) => e.name)), { maxDepth: MAX_PROPERTY_TYPE_DEPTH, curatedDefs: CURATED_PROPERTY_TYPE_DEFS });
+    // Detect tagging support (if tags field exists)
+    const hasTags = resourceLevelFields.includes("tags");
+    const tagging = hasTags
+        ? { taggable: true, tagOnCreate: true, tagUpdatable: true }
+        : undefined;
+    return {
+        resource: {
+            typeName: resourceType,
+            apiVersion,
+            properties: props,
+            attributes: attrs,
+            resourceLevelFields,
+            ...(tagging && { tagging }),
+            ...(deployScopes && { deployScopes }),
+        },
+        propertyTypes: boundedPropertyTypes,
+        enums,
+    };
+}
+// --- Unwrap oneOf expression wrappers ---
+/**
+ * ARM schemas wrap real types in oneOf with an expression $ref.
+ * Detect this pattern and return the real type.
+ */
+function unwrapExpressionOneOf(prop) {
+    if (!prop.oneOf || prop.oneOf.length < 2)
+        return prop;
+    const nonExpr = prop.oneOf.filter((item) => {
+        if (item.$ref && EXPRESSION_REF_PATTERN.test(item.$ref))
+            return false;
+        return true;
+    });
+    if (nonExpr.length === 1) {
+        // Merge description from parent if present
+        const result = { ...nonExpr[0] };
+        if (prop.description && !result.description) {
+            result.description = prop.description;
+        }
+        return result;
+    }
+    return prop;
+}
+// --- Type resolution (delegated to core) ---
+function resolvePropertyType(prop, definitions, shortName) {
+    const fakeDoc = { definitions };
+    return coreResolvePropertyType(prop, fakeDoc, (defName) => `${shortName}_${defName}`);
+}
+function extractConstraints(prop) {
+    return coreExtractConstraints(prop);
+}
+export const constraintsIsEmpty = coreConstraintsIsEmpty;
+function isEnumDefinition(def) {
+    return coreIsEnumDefinition(def);
+}
+/**
+ * Extract short resource name:
+ * "Microsoft.Storage/storageAccounts" → "storageAccounts"
+ */
+export function armShortName(typeName) {
+    const slashIdx = typeName.lastIndexOf("/");
+    return slashIdx >= 0 ? typeName.slice(slashIdx + 1) : typeName;
+}
+/**
+ * Extract service name:
+ * "Microsoft.Storage/storageAccounts" → "Storage"
+ */
+export function armServiceName(typeName) {
+    const match = typeName.match(/^Microsoft\.([^/]+)/);
+    // Strip dots from hierarchical providers (e.g. "App.ContainerApps" → "AppContainerApps")
+    return match ? match[1].replace(/\./g, "") : typeName;
+}

package/dist/taggable.js

@@ -0,0 +1,34 @@
+/**
+ * Shared taggable resource lookup — loads from the generated lexicon JSON.
+ *
+ * Lazy-loaded and cached for the lifetime of the process.
+ */
+import { readFileSync } from "fs";
+import { join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+let _cached;
+const __dirname_ = moduleSourceDir(import.meta.url);
+/**
+ * Load taggable resource types from the lexicon JSON.
+ * Result is cached after first call.
+ */
+export function loadTaggableResources() {
+    if (_cached)
+        return _cached;
+    const set = new Set();
+    try {
+        const lexiconPath = join(__dirname_, "generated", "lexicon-azure.json");
+        const content = readFileSync(lexiconPath, "utf-8");
+        const data = JSON.parse(content);
+        for (const [_name, entry] of Object.entries(data)) {
+            if (entry.kind === "resource" && entry.resourceType && entry.tagging?.taggable) {
+                set.add(entry.resourceType);
+            }
+        }
+    }
+    catch {
+        // Lexicon not available — skip
+    }
+    _cached = set;
+    return set;
+}

package/dist/validate-cli.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env tsx
+/**
+ * Thin entry point for `npm run validate` in lexicon-azure.
+ */
+import { validate } from "./validate.js";
+const result = await validate();
+for (const check of result.checks) {
+    const status = check.ok ? "OK" : "FAIL";
+    const msg = check.error ? ` — ${check.error}` : "";
+    console.error(`  [${status}] ${check.name}${msg}`);
+}
+if (!result.success) {
+    console.error("Validation failed");
+    process.exit(1);
+}
+console.error("All validation checks passed.");

package/dist/validate.js

@@ -0,0 +1,53 @@
+/**
+ * Validate generated lexicon-azure artifacts.
+ */
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+import { validateLexiconArtifacts } from "@intentius/chant/codegen/validate";
+import { CURATED_PROPERTY_TYPE_DEFS } from "./spec/parse.js";
+const REQUIRED_NAMES = [
+    // Core compute resources
+    "VirtualMachine", "VirtualMachineScaleSet", "AvailabilitySet",
+    // Networking
+    "VirtualNetwork", "Subnet", "NetworkInterface",
+    "NetworkSecurityGroup", "PublicIPAddress", "LoadBalancer",
+    // Storage
+    "StorageAccount", "BlobContainer",
+    // Web & App
+    "WebApp", "AppServicePlan",
+    // Containers
+    "ManagedCluster", "ContainerRegistry",
+    // Databases
+    "SqlServer", "SqlDatabase",
+    // Security & Identity
+    "KeyVault", "ManagedIdentity",
+    // Governance — org hierarchy + policy primitives (#1545).  once claimed
+    // these existed when they did not; this gate keeps them from vanishing again.
+    "ManagementGroup", "SubscriptionAlias", "PolicyDefinition", "PolicyAssignment",
+    // DNS & Traffic
+    "DnsZone", "TrafficManagerProfile",
+    // Curated property types kept typed by the codegen (#438) — single source of truth.
+    ...CURATED_PROPERTY_TYPE_DEFS,
+];
+export async function validate(opts) {
+    const basePath = opts?.basePath ?? dirname(dirname(fileURLToPath(import.meta.url)));
+    return validateLexiconArtifacts({
+        lexiconJsonFilename: "lexicon-azure.json",
+        requiredNames: REQUIRED_NAMES,
+        // Curated property types are emitted under resource-prefixed/variant names
+        // after bounding (#438), so match required names by substring.
+        requiredNamesMatchSubstring: true,
+        basePath,
+        // chant #1475 — azure generates from a commit sha of
+        // azure-resource-manager-schemas (#1144), so a fresh generate is
+        // deterministic. Gate the surface on every validate: the #1144 pin left
+        // the snapshot 483 entries behind until #1572 re-baselined it, because
+        // nothing compared the two on a PR.
+        checkSurfaceSnapshot: "always",
+        coverageThresholds: {
+            minPropertyPct: 1,
+            minLifecyclePct: 1,
+            minAttrPct: 1,
+        },
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.124.30",
+  "version": "0.124.32",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -32,27 +32,27 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./detect": {
       "development": "./src/detect.ts",
       "types": "./dist/detect.d.ts",
-      "default": "./src/detect.ts"
+      "default": "./dist/detect.js"
     },
     "./op/activities": {
       "development": "./src/op/activities/index.ts",
       "types": "./dist/op/activities/index.d.ts",
-      "default": "./src/op/activities/index.ts"
+      "default": "./dist/op/activities/index.js"
     },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
-      "default": "./src/lint/post-synth/index.ts"
+      "default": "./dist/lint/post-synth/index.js"
     },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
@@ -64,7 +64,7 @@
     "validate": "tsx src/validate-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "dependencies": {
     "fflate": "^0.8.2"
@@ -74,6 +74,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.30"
+    "@intentius/chant": "^0.124.32"
   }
 }