@intentius/chant-lexicon-azure 0.124.31 → 0.124.32

package/dist/default-tags.js

@@ -0,0 +1,50 @@
+/**
+ * Default Tags — declares project-wide tags for all taggable Azure resources.
+ *
+ * When a project exports a `defaultTags(...)` declaration, the serializer
+ * automatically injects those tags into every taggable resource at synthesis
+ * time. Explicit tags on individual resources take precedence.
+ */
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+/**
+ * Marker symbol for default tags identification.
+ */
+export const DEFAULT_TAGS_MARKER = Symbol.for("chant.azure.defaultTags");
+/**
+ * Type guard for DefaultTags.
+ */
+export function isDefaultTags(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        DEFAULT_TAGS_MARKER in value &&
+        value[DEFAULT_TAGS_MARKER] === true);
+}
+/**
+ * Declare project-wide default tags for all taggable Azure resources.
+ *
+ * Tags are injected at synthesis time into every resource that supports
+ * tagging. If a resource has an explicit tag with the same key, the
+ * explicit value wins.
+ *
+ * @param tags - Array of { key, value } tag entries
+ * @returns A DefaultTags Declarable
+ *
+ * @example
+ * ```ts
+ * import { defaultTags, Azure } from "@intentius/chant-lexicon-azure";
+ *
+ * export const tags = defaultTags([
+ *   { key: "Project", value: "my-app" },
+ *   { key: "Environment", value: "production" },
+ * ]);
+ * ```
+ */
+export function defaultTags(tags) {
+    return {
+        [DEFAULT_TAGS_MARKER]: true,
+        [DECLARABLE_MARKER]: true,
+        lexicon: "azure",
+        entityType: "chant:azure:defaultTags",
+        tags,
+    };
+}

package/dist/deploy-scopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-scopes.d.ts","sourceRoot":"","sources":["../src/deploy-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEjF,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAE1F,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,eAA4C,CAAC;AAEjF;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;IACzC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAQnE;AAED,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAKxD,CAAC;AA4BF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA4B7D;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,EAAE,CAEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,WAAW,CAiBjF;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,WAAW,CAOnE"}
+{"version":3,"file":"deploy-scopes.d.ts","sourceRoot":"","sources":["../src/deploy-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEjF,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAE1F,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,eAA4C,CAAC;AAEjF;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;IACzC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAQnE;AAED,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAKxD,CAAC;AA4BF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA4B7D;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,EAAE,CAEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,WAAW,CAiBjF;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,WAAW,CAOnE"}

package/dist/deploy-scopes.js

@@ -0,0 +1,157 @@
+/**
+ * ARM deployment-scope metadata (#1545).
+ *
+ * The generated lexicon records `deployScopes` for resources that exist
+ * somewhere other than plain resource-group scope (management groups,
+ * subscription aliases, policy definitions). This module loads that map and
+ * resolves which deployment scope a template targets, shared by the
+ * serializer (picks the template $schema) and AZR030 (flags resources
+ * emitted at a scope their schema does not define).
+ *
+ * Lazy-loaded and cached for the lifetime of the process.
+ */
+import { readFileSync } from "fs";
+import { join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+/** Marker symbol for deployment-scope pin identification. */
+export const DEPLOYMENT_SCOPE_MARKER = Symbol.for("chant.azure.deploymentScope");
+/** Type guard for DeploymentScope. */
+export function isDeploymentScope(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        DEPLOYMENT_SCOPE_MARKER in value &&
+        value[DEPLOYMENT_SCOPE_MARKER] === true);
+}
+/**
+ * Pin the project's deployment scope. Without a pin the serializer picks
+ * the scope every resource supports that is closest to a resource group,
+ * which cannot tell a management-group policy project from a subscription
+ * one — policy definitions and assignments deploy at both. One pin per
+ * project; AZR030 flags resources whose schema does not define the pinned
+ * scope.
+ *
+ * @example
+ * ```ts
+ * export const scope = deploymentScope("managementGroup");
+ * ```
+ */
+export function deploymentScope(scope) {
+    return {
+        [DEPLOYMENT_SCOPE_MARKER]: true,
+        [DECLARABLE_MARKER]: true,
+        lexicon: "azure",
+        entityType: "chant:azure:deploymentScope",
+        scope,
+    };
+}
+/** Template $schema URL per deployment scope. */
+export const TEMPLATE_SCHEMAS = {
+    resourceGroup: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+    subscription: "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
+    managementGroup: "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
+    tenant: "https://schema.management.azure.com/schemas/2019-08-01/tenantDeploymentTemplate.json#",
+};
+const RESOURCE_GROUP_ONLY = ["resourceGroup"];
+let _cached;
+/**
+ * Directory of this module, resolved lazily. On workerd `import.meta.url`
+ * is undefined and `fileURLToPath` throws, so this must never run at module
+ * scope (#1621): the post-synth barrel imports this file and a module-scope
+ * throw kills the worker at startup. Returns undefined when unresolvable;
+ * callers then take the documented resource-group-only fallback.
+ */
+function moduleDir() {
+    try {
+        return moduleSourceDir(import.meta.url);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Load per-resource deployment scopes from the lexicon JSON.
+ * Only resources with a non-default scope set appear; everything else is
+ * plain resource-group scope. Result is cached after first call.
+ */
+export function loadDeployScopes() {
+    if (_cached)
+        return _cached;
+    const map = new Map();
+    try {
+        let content;
+        const dir = moduleDir();
+        // Try generated/ (dev) first, then dist/meta.json (installed package)
+        for (const candidate of dir ? [
+            join(dir, "generated", "lexicon-azure.json"),
+            join(dir, "..", "dist", "meta.json"),
+        ] : []) {
+            try {
+                content = readFileSync(candidate, "utf-8");
+                break;
+            }
+            catch { }
+        }
+        if (content) {
+            const data = JSON.parse(content);
+            for (const entry of Object.values(data)) {
+                if (entry.kind === "resource" && entry.resourceType && entry.deployScopes?.length) {
+                    map.set(entry.resourceType, entry.deployScopes);
+                }
+            }
+        }
+    }
+    catch {
+        // Lexicon not available — every resource reads as resource-group scope
+    }
+    _cached = map;
+    return map;
+}
+/** Deployment scopes for one ARM resource type (defaults to resource group). */
+export function deployScopesFor(resourceType) {
+    return loadDeployScopes().get(resourceType) ?? RESOURCE_GROUP_ONLY;
+}
+/**
+ * Resolve the deployment scope for a template containing the given resource
+ * types: the scopes every resource supports, intersected.
+ *
+ * Resource-group scope wins whenever the intersection allows it (the
+ * pre-#1545 behavior for every template that could already be emitted).
+ * Otherwise the scope closest to a resource group is chosen. An empty
+ * intersection has no valid single-template answer; resource-group scope is
+ * returned and AZR030 reports the resources that cannot deploy there.
+ */
+export function resolveTemplateScope(resourceTypes) {
+    let candidates;
+    for (const type of resourceTypes) {
+        const scopes = deployScopesFor(type);
+        if (!candidates) {
+            candidates = new Set(scopes);
+        }
+        else {
+            for (const scope of [...candidates]) {
+                if (!scopes.includes(scope))
+                    candidates.delete(scope);
+            }
+        }
+    }
+    if (!candidates || candidates.size === 0)
+        return "resourceGroup";
+    for (const scope of ["resourceGroup", "subscription", "managementGroup", "tenant"]) {
+        if (candidates.has(scope))
+            return scope;
+    }
+    return "resourceGroup";
+}
+/** Map a template $schema URL back to its deployment scope. */
+export function scopeForTemplateSchema(schema) {
+    if (typeof schema === "string") {
+        if (schema.includes("subscriptionDeploymentTemplate"))
+            return "subscription";
+        if (schema.includes("managementGroupDeploymentTemplate"))
+            return "managementGroup";
+        if (schema.includes("tenantDeploymentTemplate"))
+            return "tenant";
+    }
+    return "resourceGroup";
+}

package/dist/describe-resources.js

@@ -0,0 +1,187 @@
+/**
+ * Live introspection of an Azure resource group over ARM (#1212).
+ *
+ * For each declared Azure entity, GETs
+ *   {endpoint}/subscriptions/{sub}/resourceGroups/{env}/providers/{type}/{name}
+ *
+ * on the applier's own transport (`./api/read-client.ts`, which is
+ * `az-apply.ts`'s client pointed at the read side) rather than shelling
+ * `az resource show`. The payload is the same ARM JSON either way — the CLI was
+ * only ever relaying it — so this is transport, not translation: no CLI to
+ * spawn, reads that run concurrently, failures carrying ARM's own error code,
+ * and an emulator override that reaches floci-az the same way every other
+ * lexicon's does.
+ *
+ * The response maps to a ResourceMetadata entry keyed by chant entity name
+ * (using props.name from #39's entity-prop pass-through). The environment
+ * argument is treated as the Azure resource group name.
+ *
+ * Resource-not-found is an absence — `state diff --live` then reports it as
+ * missing. Nested resource types (e.g.
+ * `Microsoft.Storage/storageAccounts/blobServices`) are NOT-OBSERVED
+ * (`unsupported-kind`, #1089): `az resource show` doesn't accept a compound
+ * type, so chant never asks, and a blob service that already exists must not
+ * come back as a proposed `create`. Auth failures and unreachable subscriptions
+ * are holes for the same reason.
+ */
+import { boundedConcurrently, observation } from "@intentius/chant/observation";
+import { readOwnership } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership.js";
+import { AzureReadError, getResource, isNotFound } from "./api/read-client.js";
+function pruneUndefined(obj) {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (v !== undefined)
+            out[k] = v;
+    }
+    return out;
+}
+/**
+ * Top-level ARM type — i.e. exactly one `/` separating provider from kind.
+ * Nested types like `Microsoft.Storage/storageAccounts/blobServices` need a
+ * different query path that this implementation doesn't yet support.
+ *
+ * Exported so the deep reader (./deep-observe.ts, #1086) applies the exact
+ * same scope limit — a nested type is `unsupported-kind` at both depths, not
+ * silently deeper on one and not the other.
+ */
+export function isTopLevelType(entityType) {
+    const slashCount = (entityType.match(/\//g) ?? []).length;
+    return slashCount === 1;
+}
+/**
+ * Classify an `az resource show` failure (#1089). Only the CLI's explicit
+ * not-found establishes absence; everything else — an expired login, a
+ * subscription that can't be resolved, a network failure — proves nothing.
+ */
+export function classifyAzFailure(err) {
+    const raw = typeof err === "object" && err !== null && typeof err.stderr === "string"
+        ? (err.stderr.trim() || String(err.message ?? err))
+        : String(err?.message ?? err);
+    const lower = raw.toLowerCase();
+    const detail = (raw.split("\n").find((l) => l.trim().length > 0) ?? raw).trim().slice(0, 200);
+    if (lower.includes("resourcenotfound") ||
+        lower.includes("was not found") ||
+        lower.includes("could not be found") ||
+        lower.includes("does not exist")) {
+        return { absent: true };
+    }
+    if (lower.includes("please run 'az login'") ||
+        lower.includes("az login") ||
+        lower.includes("authenticationfailed") ||
+        lower.includes("expired") ||
+        lower.includes("authorizationfailed") ||
+        lower.includes("forbidden")) {
+        return { absent: false, reason: "no-credentials", detail };
+    }
+    if (lower.includes("subscriptionnotfound") ||
+        lower.includes("no subscription") ||
+        lower.includes("please run 'az account set'")) {
+        return { absent: false, reason: "no-binding", detail };
+    }
+    return { absent: false, reason: "read-failed", detail };
+}
+/**
+ * Classify an ARM failure off its own error code (#1212).
+ *
+ * The CLI classifier above matched on prose because stderr was all it had.
+ * ARM sends `{ error: { code, message } }`, so the code is the signal and the
+ * message is only for the human — the same distinction the AWS read client
+ * makes. Kept beside `classifyAzFailure` rather than replacing it: the CLI
+ * path still exists for a signed read against real ARM.
+ */
+export function classifyArmFailure(err) {
+    const code = err instanceof AzureReadError ? (err.code ?? "") : "";
+    const message = err instanceof Error ? err.message : String(err);
+    const detail = (code ? `${code}: ${message}` : message).slice(0, 200);
+    const both = `${code} ${message}`.toLowerCase();
+    if (both.includes("authenticationfailed") ||
+        both.includes("authorizationfailed") ||
+        both.includes("expired") ||
+        both.includes("forbidden") ||
+        (err instanceof AzureReadError && (err.status === 401 || err.status === 403))) {
+        return { reason: "no-credentials", detail };
+    }
+    if (both.includes("subscriptionnotfound") || both.includes("resourcegroupnotfound")) {
+        return { reason: "no-binding", detail };
+    }
+    return { reason: "read-failed", detail };
+}
+export async function describeResources(options) {
+    const result = {};
+    const unobserved = {};
+    const skippedNested = [];
+    const readable = [];
+    // The environment is the resource group, as it has always been on this path.
+    const client = {
+        resourceGroup: options.environment,
+        ...(process.env.AZURE_ENDPOINT_URL ? { endpoint: process.env.AZURE_ENDPOINT_URL } : {}),
+        ...(process.env.AZURE_SUBSCRIPTION_ID ? { subscriptionId: process.env.AZURE_SUBSCRIPTION_ID } : {}),
+        ...(options.http ? { http: options.http } : {}),
+    };
+    for (const [entityName, { entityType, props }] of options.entities) {
+        if (!entityType.startsWith("Microsoft.")) {
+            // Not an ARM resource type, so there is no ARM URL to GET.
+            // Unobserved rather than skipped: a silent skip reads as absence (#1089).
+            unobserved[entityName] = {
+                type: entityType,
+                reason: "unsupported-kind",
+                detail: "not an ARM resource type (expected Microsoft.<provider>/<kind>)",
+            };
+            continue;
+        }
+        if (!isTopLevelType(entityType)) {
+            skippedNested.push(entityName);
+            unobserved[entityName] = {
+                type: entityType,
+                reason: "unsupported-kind",
+                detail: "a nested ARM type needs a different read path; chant never queried this resource",
+            };
+            continue;
+        }
+        const name = props.name;
+        if (!name) {
+            unobserved[entityName] = {
+                type: entityType,
+                reason: "read-failed",
+                detail: "declared entity has no name to query by",
+            };
+            continue;
+        }
+        readable.push({ entityName, entityType, name });
+    }
+    // Concurrent, where the CLI path was one spawn after another (#1201/#1212).
+    await boundedConcurrently(readable, async ({ entityName, entityType, name }) => {
+        try {
+            const body = await getResource(client, entityType, name);
+            result[entityName] = {
+                type: entityType,
+                physicalId: body.id,
+                status: body.properties?.provisioningState ?? "PRESENT",
+                // Marker identity (#1222): the ARM envelope carries the resource's
+                // tags, so the stamped stack/env identity is readable here even though
+                // this path declares no ownership channel (the verdict stays out —
+                // floci-az drops tags, so a verdict here would misreport under the
+                // emulator; the identity, when the tags are present, is verbatim).
+                marker: readOwnership(body.tags, AZURE_TAG_OWNERSHIP_KEYS),
+                attributes: pruneUndefined({
+                    location: body.location,
+                    tags: body.tags,
+                }),
+            };
+        }
+        catch (err) {
+            // Not-found leaves the entity out (absence). Auth/binding/other failures
+            // are recorded as holes so they can't become creates (#1089).
+            if (isNotFound(err))
+                return;
+            const outcome = classifyArmFailure(err);
+            unobserved[entityName] = { type: entityType, reason: outcome.reason, detail: outcome.detail };
+        }
+    });
+    if (skippedNested.length > 0) {
+        // eslint-disable-next-line no-console
+        console.warn(`[azure] ${skippedNested.length} nested-type entity(ies) reported as unobserved (not absent) — az resource show doesn't accept compound types: ${skippedNested.slice(0, 5).join(", ")}${skippedNested.length > 5 ? ", ..." : ""}`);
+    }
+    return observation(result, unobserved);
+}

package/dist/detect.js

@@ -0,0 +1,17 @@
+/** Edge-safe template detection for azure (ARM) — see #426. */
+export function detectTemplate(content) {
+    if (typeof content !== "string")
+        return false;
+    try {
+        const parsed = JSON.parse(content);
+        return (typeof parsed === "object" &&
+            parsed !== null &&
+            "$schema" in parsed &&
+            typeof parsed.$schema === "string" &&
+            parsed.$schema.includes("deploymentTemplate") &&
+            Array.isArray(parsed.resources));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/export-resources.js

@@ -0,0 +1,108 @@
+/**
+ * Live export for the Azure lexicon — implements LexiconPlugin.exportResources()
+ * so `chant import --from <azure-env>` regenerates Azure resources as chant
+ * TypeScript.
+ *
+ * The environment argument is the Azure resource group. Two transports, same
+ * IR:
+ *
+ * - With `AZURE_ENDPOINT_URL` set (the emulator lane, and the var azure's own
+ *   observers already read on every live call), export rides the applier's ARM
+ *   transport (#1212's swap, extended to the cloud→code direction for #1214):
+ *   list the group's resources, GET each one whole, scrub the server-managed
+ *   surface back to the declared shape, and hand the result to the same
+ *   `ArmParser` the static-import path uses. Unsigned, exactly like `azApply`
+ *   — which is why this path is gated on the ambient var rather than replacing
+ *   the CLI: real ARM wants a bearer token.
+ * - Without it, the signed path: `az group export` via the Azure CLI,
+ *   unchanged.
+ *
+ * Selector/ownership filtering and IR-building are pure in
+ * `./import/live-export`; all I/O lives here.
+ */
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { parseExportedTemplate } from "./import/live-export.js";
+import { getResourceById, listResources } from "./api/read-client.js";
+import { AZURE_READ_ONLY_NAMES, AZURE_SERVER_COMPUTED_NAMES } from "./deep-observe.js";
+const execAsync = promisify(exec);
+/** Generic ARM api-version, same as the read client's — adequate for every top-level type chant declares. */
+const EXPORT_API_VERSION = "2021-04-01";
+/**
+ * Envelope bookkeeping ARM stamps on every body — never part of the declared
+ * shape at any depth. `id` is NOT here: a nested `routeTable.id` is a declared
+ * cross-reference; only an array element's self-`id` is scrubbed (below), the
+ * same two rules deep observation applies.
+ */
+const ENVELOPE_KEYS = new Set(["etag", "systemData"]);
+/**
+ * Scrub a live ARM body back to the declared shape (the contract's default
+ * fidelity): server-populated names, server-computed surfaces, NSG default
+ * rules and nested envelope bookkeeping all drop; everything a user would
+ * have authored stays.
+ */
+function scrub(value) {
+    if (Array.isArray(value)) {
+        return value.map((el) => {
+            if (el !== null && typeof el === "object" && !Array.isArray(el)) {
+                const { id: _selfId, ...rest } = el;
+                return scrub(rest);
+            }
+            return scrub(el);
+        });
+    }
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (AZURE_READ_ONLY_NAMES.has(k) || AZURE_SERVER_COMPUTED_NAMES.has(k))
+                continue;
+            if (ENVELOPE_KEYS.has(k) || k === "defaultSecurityRules")
+                continue;
+            out[k] = scrub(v);
+        }
+        return out;
+    }
+    return value;
+}
+/** One live body → one ARM-template resource, the shape `ArmParser` reads. */
+function toTemplateResource(body, verbatim) {
+    const { id: _id, type, name, ...rest } = body;
+    const content = verbatim ? rest : scrub(rest);
+    return { type, apiVersion: EXPORT_API_VERSION, name, ...content };
+}
+async function exportViaArm(endpoint, options) {
+    const client = { endpoint, resourceGroup: options.environment };
+    const listed = await listResources(client);
+    const resources = [];
+    for (const entry of listed) {
+        if (typeof entry.id !== "string")
+            continue;
+        const body = await getResourceById(client, entry.id);
+        resources.push(toTemplateResource(body, options.verbatim === true));
+    }
+    const template = {
+        $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+        contentVersion: "1.0.0.0",
+        resources,
+    };
+    return parseExportedTemplate(JSON.stringify(template), options.selector, options.owned);
+}
+export async function exportResources(options) {
+    const endpoint = process.env.AZURE_ENDPOINT_URL;
+    if (endpoint)
+        return exportViaArm(endpoint, options);
+    const cmd = [
+        "az", "group", "export",
+        "--resource-group", options.environment,
+        "--output", "json",
+    ].join(" ");
+    let stdout;
+    try {
+        ({ stdout } = await execAsync(cmd));
+    }
+    catch (err) {
+        const stderr = err.stderr ?? err.message;
+        throw new Error(`Failed to export resource group "${options.environment}": ${stderr}`);
+    }
+    return parseExportedTemplate(stdout, options.selector, options.owned);
+}