@intentius/chant-lexicon-azure 0.124.31 → 0.124.32

package/dist/generated/runtime.js

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/dist/governance.js

@@ -0,0 +1,144 @@
+/**
+ * Azure governance authoring: the desired-state config
+ * shape an external governance reconciler reconciles, and `landingZoneConfig()` — the
+ * typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven management-group tree walker cannot be one. The split mirrors
+ * the AWS/GCP slices (lexicons/{aws,gcp}/src/governance.ts): authoring emits
+ * config (this module, arbitrary cardinality); resources for greenfield
+ * bootstrap are the fixed-shape composites in `composites/landing-zone.ts`;
+ * the reconciler consumes only the config.
+ *
+ * Azure has no OrganizationRoot analog — the tenant and its root management
+ * group come from Entra ID, never from the resource API. Subscriptions the
+ * tree declares reconcile through Microsoft.Subscription/aliases (existing
+ * ids are placed, missing ones created from `billingScope`); aliases deploy
+ * at tenant scope only (#1545).
+ */
+// ---------------------------------------------------------------------------
+// Baseline guardrails (shared with the bootstrap composites)
+// ---------------------------------------------------------------------------
+export const DENY_CLASSIC_RESOURCES = {
+    description: "Classic (ASM) compute, network, and storage resources cannot be created.",
+    displayName: "Deny classic resources",
+    mode: "All",
+    policyRule: {
+        if: { field: "type", like: "Microsoft.Classic*" },
+        then: { effect: "deny" },
+    },
+};
+export const DENY_UNMANAGED_DISKS = {
+    description: "Virtual machines and scale sets must use managed disks.",
+    displayName: "Deny unmanaged disks",
+    mode: "All",
+    policyRule: {
+        if: {
+            anyOf: [
+                {
+                    allOf: [
+                        { field: "type", equals: "Microsoft.Compute/virtualMachines" },
+                        { field: "Microsoft.Compute/virtualMachines/osDisk.uri", exists: "true" },
+                    ],
+                },
+                {
+                    allOf: [
+                        { field: "type", equals: "Microsoft.Compute/virtualMachineScaleSets" },
+                        {
+                            anyOf: [
+                                { field: "Microsoft.Compute/VirtualMachineScaleSets/osDisk.vhdContainers", exists: "true" },
+                                { field: "Microsoft.Compute/VirtualMachineScaleSets/osdisk.imageUrl", exists: "true" },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        },
+        then: { effect: "deny" },
+    },
+};
+/** Allow resource creation only in `locations` ("global" is always excepted). */
+export function locationRestriction(locations) {
+    return {
+        description: `Resources may only be created in [${locations.join(", ")}].`,
+        displayName: "Allowed locations",
+        mode: "Indexed",
+        policyRule: {
+            if: {
+                allOf: [
+                    { field: "location", notIn: [...locations] },
+                    { field: "location", notEquals: "global" },
+                ],
+            },
+            then: { effect: "deny" },
+        },
+    };
+}
+/**
+ * The built-in DeployIfNotExists policy "Configure Azure Activity logs to
+ * stream to specified Log Analytics workspace" — the activity-log audit
+ * sink is wired by assigning it, not by declaring diagnostic settings in
+ * every subscription (Microsoft.Insights/diagnosticSettings is not in the
+ * generated surface, and the assignment covers future subscriptions too).
+ */
+export const ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID = "/providers/Microsoft.Authorization/policyDefinitions/2465583e-4e78-4c15-b6be-a36cbc7c8b0f";
+/**
+ * The recommended foundation management-group structure. Exported so
+ * callers can extend it rather than restate it.
+ */
+export const FOUNDATION_MANAGEMENT_GROUPS = {
+    Security: {},
+    Infrastructure: {},
+    Sandbox: {},
+    Workloads: {},
+};
+/**
+ * Author the desired-state tree an external governance reconciler reconciles. Pure.
+ * Throws when the tree assigns a policy name with no definition; only
+ * policies the tree actually assigns are included in the output.
+ */
+export function landingZoneConfig(props = {}) {
+    const foundation = props.foundation ?? true;
+    const policies = {
+        ...(foundation
+            ? { "deny-classic-resources": DENY_CLASSIC_RESOURCES, "deny-unmanaged-disks": DENY_UNMANAGED_DISKS }
+            : {}),
+        ...(props.allowedLocations?.length
+            ? { "location-restriction": locationRestriction(props.allowedLocations) }
+            : {}),
+        ...props.policies,
+    };
+    const managementGroups = { ...(foundation ? FOUNDATION_MANAGEMENT_GROUPS : {}), ...props.managementGroups };
+    const rootPolicies = [
+        ...(foundation ? ["deny-classic-resources", "deny-unmanaged-disks"] : []),
+        ...(props.allowedLocations?.length ? ["location-restriction"] : []),
+        ...(props.rootPolicies ?? []),
+    ];
+    const assigned = new Set(rootPolicies);
+    const collect = (tree) => {
+        for (const node of Object.values(tree)) {
+            for (const p of node.policies ?? [])
+                assigned.add(p);
+            if (node.children)
+                collect(node.children);
+        }
+    };
+    collect(managementGroups);
+    for (const name of assigned) {
+        if (!policies[name]) {
+            throw new Error(`landingZoneConfig: policy "${name}" is assigned but not defined in policies`);
+        }
+    }
+    return {
+        tenant: {
+            ...(rootPolicies.length ? { policies: rootPolicies } : {}),
+            ...(foundation ? { blockSubscriptionsLeavingTenant: true } : {}),
+        },
+        managementGroups,
+        policies: Object.fromEntries(Object.entries(policies).filter(([n]) => assigned.has(n))),
+        ...(props.activityLogWorkspaceId
+            ? { auditSinks: { activityLog: { workspaceId: props.activityLogWorkspaceId } } }
+            : {}),
+    };
+}

package/dist/import/generator.js

@@ -0,0 +1,140 @@
+/**
+ * ARM template → TypeScript code generator.
+ *
+ * Converts intermediate representation to idiomatic chant TypeScript.
+ */
+import { loadLexiconRegistry } from "@intentius/chant/codegen/registry";
+import { createRequire } from "module";
+const require = createRequire(import.meta.url);
+import { join } from "path";
+/**
+ * TypeScript code generator for ARM templates.
+ */
+export class ArmGenerator {
+    constructor() {
+        this.typeToClass = new Map();
+        // Was a silent catch, which left this map empty and made the import emit
+        // `// Unknown resource type: Microsoft.…` — indistinguishable from a
+        // genuine coverage gap in the lexicon. A missing registry now says so
+        // (#1367).
+        const meta = loadLexiconRegistry(join(import.meta.dirname, "../.."), "azure");
+        for (const [className, entry] of Object.entries(meta)) {
+            if (entry.kind === "resource" && !className.includes("_")) {
+                this.typeToClass.set(entry.resourceType, className);
+            }
+        }
+    }
+    generate(ir) {
+        const lines = [];
+        // Collect imports
+        const importedClasses = new Set();
+        const importedIntrinsics = new Set();
+        let needsAzure = false;
+        for (const resource of ir.resources) {
+            const cls = this.typeToClass.get(resource.type);
+            if (cls)
+                importedClasses.add(cls);
+            // Check for Azure pseudo-parameters in values
+            if (this.hasAzurePseudo(resource.properties)) {
+                needsAzure = true;
+            }
+        }
+        if (ir.parameters.length > 0) {
+            // Parameters would need a Parameter import from core
+        }
+        // Build import statement
+        const symbols = [...importedClasses].sort();
+        if (importedIntrinsics.size > 0) {
+            symbols.push(...[...importedIntrinsics].sort());
+        }
+        if (needsAzure) {
+            symbols.push("Azure");
+        }
+        if (symbols.length > 0) {
+            lines.push(`import { ${symbols.join(", ")} } from "@intentius/chant-lexicon-azure";`);
+            lines.push("");
+        }
+        // Generate resources
+        for (const resource of ir.resources) {
+            const cls = this.typeToClass.get(resource.type);
+            const varName = this.toVarName(resource.logicalId);
+            if (cls) {
+                lines.push(`export const ${varName} = new ${cls}(${this.generateProps(resource.properties, 1)});`);
+            }
+            else {
+                lines.push(`// Unknown resource type: ${resource.type}`);
+                lines.push(`// export const ${varName} = new ${resource.type}(${this.generateProps(resource.properties, 1)});`);
+            }
+            lines.push("");
+        }
+        return [
+            {
+                path: "main.ts",
+                content: lines.join("\n") + "\n",
+            },
+        ];
+    }
+    toVarName(name) {
+        // Convert to camelCase
+        return name.charAt(0).toLowerCase() + name.slice(1);
+    }
+    generateProps(props, depth) {
+        if (!props || Object.keys(props).length === 0)
+            return "{}";
+        const indent = "  ".repeat(depth);
+        const innerIndent = "  ".repeat(depth + 1);
+        const entries = [];
+        for (const [key, value] of Object.entries(props)) {
+            entries.push(`${innerIndent}${key}: ${this.generateValue(value, depth + 1)},`);
+        }
+        return `{\n${entries.join("\n")}\n${indent}}`;
+    }
+    generateValue(value, depth) {
+        if (value === null || value === undefined)
+            return "undefined";
+        if (typeof value === "string")
+            return JSON.stringify(value);
+        if (typeof value === "number" || typeof value === "boolean")
+            return String(value);
+        if (Array.isArray(value)) {
+            if (value.length === 0)
+                return "[]";
+            const items = value.map((v) => this.generateValue(v, depth + 1));
+            return `[${items.join(", ")}]`;
+        }
+        if (typeof value === "object") {
+            const obj = value;
+            // Handle intrinsic markers
+            if ("__intrinsic" in obj) {
+                return this.generateIntrinsic(obj);
+            }
+            return this.generateProps(obj, depth);
+        }
+        return String(value);
+    }
+    generateIntrinsic(obj) {
+        const name = obj.__intrinsic;
+        switch (name) {
+            case "ResourceGroup":
+                return `Azure.ResourceGroup${obj.property?.charAt(0).toUpperCase()}${obj.property?.slice(1)}`;
+            case "Subscription":
+                return `Azure.SubscriptionId`;
+            case "Ref":
+                return obj.name;
+            case "ResourceId":
+                return `ResourceId(${obj.args.map((a) => JSON.stringify(a)).join(", ")})`;
+            case "Reference":
+                return `Reference(${obj.args.map((a) => JSON.stringify(a)).join(", ")})`;
+            case "Concat":
+                return `Concat(${obj.args.map((a) => JSON.stringify(a)).join(", ")})`;
+            case "UniqueString":
+                return `UniqueString(${obj.args.map((a) => JSON.stringify(a)).join(", ")})`;
+            default:
+                return JSON.stringify(obj);
+        }
+    }
+    hasAzurePseudo(props) {
+        const json = JSON.stringify(props);
+        return json.includes("resourceGroup()") || json.includes("subscription()");
+    }
+}

package/dist/import/live-export.js

@@ -0,0 +1,39 @@
+import { hasOwnershipMarker } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "../ownership.js";
+import { ArmParser } from "./parser.js";
+/**
+ * Map a live ARM template (from `az group export`) to full-fidelity export IR.
+ *
+ * `az group export --output json` returns an ARM template — either as a JSON
+ * object or, via the CLI, a JSON string. `ArmParser` already turns the template
+ * into `TemplateIR` — the same IR the static-import path uses — so the result
+ * feeds `ArmGenerator` (templateGenerator) unchanged. Pure: all I/O stays in
+ * the caller (`../export-resources`).
+ *
+ * Mirrors AWS `parseStackTemplate`. The one shape difference: ARM tags are a
+ * `Record<string,string>` map (not the `{Key,Value}[]` array CloudFormation
+ * uses), so the ownership filter reads `properties.tags` directly without
+ * `tagArrayToMap`, against the `azure-tag` channel (`chant-managed-by`).
+ */
+export function parseExportedTemplate(templateBody, selector, owned) {
+    const content = typeof templateBody === "string" ? templateBody : JSON.stringify(templateBody);
+    const ir = new ArmParser().parse(content);
+    const hasSelector = selector && (selector.type !== undefined || selector.name !== undefined);
+    if (!hasSelector && !owned)
+        return ir;
+    return {
+        ...ir,
+        resources: ir.resources.filter((r) => {
+            if (selector?.type !== undefined && r.type !== selector.type)
+                return false;
+            if (selector?.name !== undefined && r.logicalId !== selector.name)
+                return false;
+            if (owned) {
+                const tags = r.properties.tags;
+                if (!hasOwnershipMarker(tags, AZURE_TAG_OWNERSHIP_KEYS))
+                    return false;
+            }
+            return true;
+        }),
+    };
+}

package/dist/import/parser.js

@@ -0,0 +1,192 @@
+/**
+ * ARM template JSON parser — converts ARM templates to intermediate representation.
+ *
+ * Handles ARM bracket expressions: [resourceId(...)], [reference(...)],
+ * [parameters(...)], [variables(...)], [concat(...)], etc.
+ */
+import { BaseValueParser } from "@intentius/chant/import/base-parser";
+/**
+ * ARM template parser.
+ */
+export class ArmParser extends BaseValueParser {
+    // ARM expresses intrinsics as bracketed string expressions (e.g.
+    // "[resourceId(...)]"), not single-key objects, so there are no object-form
+    // intrinsics to dispatch during value walking.
+    dispatchIntrinsic() {
+        return null;
+    }
+    parse(content) {
+        const template = JSON.parse(content);
+        if (!template.resources || !Array.isArray(template.resources)) {
+            throw new Error("Invalid ARM template: missing resources array");
+        }
+        const parameters = [];
+        const resources = [];
+        // Parse parameters
+        if (template.parameters) {
+            for (const [name, param] of Object.entries(template.parameters)) {
+                const p = param;
+                parameters.push({
+                    name,
+                    type: mapArmParameterType(p.type),
+                    description: p.metadata?.description ?? p.description,
+                    defaultValue: p.defaultValue,
+                });
+            }
+        }
+        // Parse resources
+        for (const resource of template.resources) {
+            const r = resource;
+            const type = r.type;
+            const name = r.name;
+            // Collect all properties including resource-level fields
+            const properties = {};
+            // Resource-level fields
+            for (const field of ["location", "sku", "kind", "identity", "tags", "zones", "plan"]) {
+                if (r[field] !== undefined) {
+                    properties[field] = this.parseValue(r[field]);
+                }
+            }
+            // Nested properties
+            if (r.properties && typeof r.properties === "object") {
+                for (const [key, value] of Object.entries(r.properties)) {
+                    properties[key] = this.parseValue(value);
+                }
+            }
+            // Parse dependsOn
+            const dependsOn = r.dependsOn;
+            const deps = dependsOn?.map((d) => this.extractResourceName(d)) ?? [];
+            resources.push({
+                logicalId: name,
+                type,
+                properties,
+                // ResourceIR has no dedicated dependsOn field — preserve ARM dependencies in metadata.
+                ...(deps.length > 0 && { metadata: { dependsOn: deps } }),
+            });
+        }
+        return {
+            parameters,
+            resources,
+            metadata: {
+                format: "arm",
+                schema: template.$schema,
+                contentVersion: template.contentVersion,
+            },
+        };
+    }
+    /**
+     * Parse a value, handling ARM bracket expressions.
+     */
+    parseValue(value) {
+        if (typeof value === "string") {
+            return this.parseBracketExpression(value);
+        }
+        if (Array.isArray(value)) {
+            return value.map((v) => this.parseValue(v));
+        }
+        if (typeof value === "object" && value !== null) {
+            const result = {};
+            for (const [k, v] of Object.entries(value)) {
+                result[k] = this.parseValue(v);
+            }
+            return result;
+        }
+        return value;
+    }
+    /**
+     * Parse ARM bracket expressions like [resourceId(...)], [reference(...)], etc.
+     */
+    parseBracketExpression(value) {
+        if (!value.startsWith("[") || !value.endsWith("]"))
+            return value;
+        // Escaped bracket
+        if (value.startsWith("[["))
+            return value.slice(1);
+        const expr = value.slice(1, -1);
+        // resourceId(...)
+        const resourceIdMatch = expr.match(/^resourceId\((.+)\)$/);
+        if (resourceIdMatch) {
+            return { __intrinsic: "ResourceId", args: this.parseArgs(resourceIdMatch[1]) };
+        }
+        // reference(...)
+        const referenceMatch = expr.match(/^reference\((.+)\)$/);
+        if (referenceMatch) {
+            return { __intrinsic: "Reference", args: this.parseArgs(referenceMatch[1]) };
+        }
+        // parameters(...)
+        const parametersMatch = expr.match(/^parameters\('([^']+)'\)$/);
+        if (parametersMatch) {
+            return { __intrinsic: "Ref", name: parametersMatch[1] };
+        }
+        // concat(...)
+        const concatMatch = expr.match(/^concat\((.+)\)$/);
+        if (concatMatch) {
+            return { __intrinsic: "Concat", args: this.parseArgs(concatMatch[1]) };
+        }
+        // resourceGroup().location, resourceGroup().name, etc.
+        const rgMatch = expr.match(/^resourceGroup\(\)\.(\w+)$/);
+        if (rgMatch) {
+            return { __intrinsic: "ResourceGroup", property: rgMatch[1] };
+        }
+        // subscription().subscriptionId, etc.
+        const subMatch = expr.match(/^subscription\(\)\.(\w+)$/);
+        if (subMatch) {
+            return { __intrinsic: "Subscription", property: subMatch[1] };
+        }
+        // uniqueString(...)
+        const uniqueMatch = expr.match(/^uniqueString\((.+)\)$/);
+        if (uniqueMatch) {
+            return { __intrinsic: "UniqueString", args: this.parseArgs(uniqueMatch[1]) };
+        }
+        // Return raw expression as-is
+        return value;
+    }
+    /**
+     * Parse comma-separated args from a function call string.
+     */
+    parseArgs(argsStr) {
+        const args = [];
+        let depth = 0;
+        let current = "";
+        for (const char of argsStr) {
+            if (char === "(")
+                depth++;
+            if (char === ")")
+                depth--;
+            if (char === "," && depth === 0) {
+                args.push(current.trim().replace(/^'|'$/g, ""));
+                current = "";
+            }
+            else {
+                current += char;
+            }
+        }
+        if (current.trim()) {
+            args.push(current.trim().replace(/^'|'$/g, ""));
+        }
+        return args;
+    }
+    /**
+     * Extract a resource name from a dependsOn resourceId expression.
+     */
+    extractResourceName(dep) {
+        if (dep.startsWith("[")) {
+            // Try to extract from resourceId expression
+            const match = dep.match(/resourceId\([^,]+,\s*'([^']+)'\)/);
+            if (match)
+                return match[1];
+        }
+        return dep;
+    }
+}
+function mapArmParameterType(type) {
+    switch (type?.toLowerCase()) {
+        case "string": return "String";
+        case "int": return "Number";
+        case "bool": return "String";
+        case "array": return "CommaDelimitedList";
+        case "object": return "String";
+        case "securestring": return "String";
+        default: return "String";
+    }
+}

package/dist/index.js

@@ -0,0 +1,44 @@
+/**
+ * @intentius/chant-lexicon-azure — barrel export
+ *
+ * Azure Resource Manager lexicon for chant.
+ */
+// Typed Op step-builder wrappers (chant #1288 Stage 2) — azApply/azDelete/
+// azGroupEnsure/azGroupDelete/flociAzUp/flociAzDown with authoring-time
+// types derived from this lexicon's own *Args interfaces (see
+// ./op/builders.ts's module doc for why these live here rather than in
+// core). Opt-in: `@intentius/chant/op`'s same-named exports are core's
+// original untyped builders, unchanged.
+export { azApply, azDelete, azGroupEnsure, azGroupDelete, flociAzUp, flociAzDown } from "./op/builders.js";
+// --- Core ---
+export { defaultTags } from "./default-tags.js";
+export { deploymentScope, isDeploymentScope } from "./deploy-scopes.js";
+export { azureSerializer } from "./serializer.js";
+export { azurePlugin } from "./plugin.js";
+export { Parameter } from "./parameter.js";
+// Deep observation (#1086): the `az resource show` reader and the noise
+// rules it shares with core's normalization pass.
+export { observeResourcesDeepAzure, azureDeepNormalizationHooks, AZURE_READ_ONLY_NAMES, AZURE_SERVER_COMPUTED_NAMES, AZURE_SERVICE_DEFAULTS, } from "./deep-observe.js";
+// --- Intrinsics ---
+export { ResourceId, ResourceIdIntrinsic, Reference, ReferenceIntrinsic, Concat, ConcatIntrinsic, ResourceGroup, ResourceGroupIntrinsic, Subscription, SubscriptionIntrinsic, UniqueString, UniqueStringIntrinsic, Format, FormatIntrinsic, If, IfIntrinsic, ListKeys, ListKeysIntrinsic, } from "./intrinsics.js";
+// --- Pseudo-parameters ---
+export { Azure, ResourceGroupName, ResourceGroupLocation, ResourceGroupId, SubscriptionId, TenantId, DeploymentName, } from "./pseudo.js";
+// --- Re-exports from core ---
+export { isChildProject } from "@intentius/chant/child-project";
+export { stackOutput, isStackOutput } from "@intentius/chant/stack-output";
+export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon-output";
+// --- Generated resource classes ---
+export * from "./generated/index.js";
+// --- Composites ---
+export { StorageAccountSecure, VnetDefault, VmLinux, AppService, AksCluster, SqlDatabase, KeyVaultSecure, ContainerRegistrySecure, FunctionApp, ServiceBusPipeline, CosmosDatabase, ApplicationGateway, ContainerInstance, RedisCache, PrivateEndpoint, GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink, } from "./composites/index.js";
+// Azure governance authoring: the desired-state config the Azure
+// external governance reconciler applies, and the typed landing-zone authoring layer.
+export { landingZoneConfig, locationRestriction, DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS, ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID, FOUNDATION_MANAGEMENT_GROUPS, } from "./governance.js";
+// --- RBAC role constants ---
+export { StorageRoles, ComputeRoles, NetworkRoles, KeyVaultRoles, SqlRoles, ContainerRoles, AppServiceRoles, IdentityRoles, } from "./actions/index.js";
+// --- Codegen pipeline ---
+export { generate, writeGeneratedFiles } from "./codegen/generate.js";
+export { packageLexicon } from "./codegen/package.js";
+// --- Spec utilities ---
+export { fetchArmSchemas } from "./spec/fetch.js";
+export { parseArmSchema, armShortName, armServiceName } from "./spec/parse.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "75b76ca101cd4281f2e5ef71bf40181bc0ef256800cbe3e985a817d64de8787d",
+    "manifest.json": "73f94421607348da234c7b2fe2431c917da7c16edc29fa1606a5a41498acf91f",
     "meta.json": "8c7a1ea3cfaf39461d3e758fa2b0cbd70c7800fac736e56df8d14a3e07ef1840",
     "types/index.d.ts": "b20aaa3eeb957a6a5833dcbf5fd99ce1365285eafd4b78dc9383371b1a9d4b61",
     "rules/hardcoded-location.ts": "0b895449c8c94066e81721c46be24249231029fe13b471477456df5c4e45b8bf",
@@ -37,5 +37,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "00374ddfe2e11e4ab5f717b8d65951349635108e28e7d1c6afd177e5f31c1b2e"
+  "composite": "95455caf05c28b24f7081e35276586087791d81c4b2d88d516a7fd35f5d8a59c"
 }