@intentius/chant-lexicon-azure 0.124.31 → 0.124.33

package/dist/actions/appservice.js

@@ -0,0 +1,7 @@
+/**
+ * Azure App Service RBAC built-in role constants.
+ */
+export const AppServiceRoles = {
+    WebPlanContributor: "Web Plan Contributor",
+    WebsiteContributor: "Website Contributor",
+};

package/dist/actions/compute.js

@@ -0,0 +1,9 @@
+/**
+ * Azure Compute RBAC built-in role constants.
+ */
+export const ComputeRoles = {
+    VirtualMachineContributor: "Virtual Machine Contributor",
+    VirtualMachineAdminLogin: "Virtual Machine Administrator Login",
+    VirtualMachineUserLogin: "Virtual Machine User Login",
+    DiskSnapshotContributor: "Disk Snapshot Contributor",
+};

package/dist/actions/container.js

@@ -0,0 +1,14 @@
+/**
+ * Azure Container RBAC built-in role constants (AKS + ACR).
+ */
+export const ContainerRoles = {
+    AksClusterAdmin: "Azure Kubernetes Service Cluster Admin Role",
+    AksClusterUser: "Azure Kubernetes Service Cluster User Role",
+    AksContributor: "Azure Kubernetes Service Contributor Role",
+    AksRbacAdmin: "Azure Kubernetes Service RBAC Admin",
+    AksRbacReader: "Azure Kubernetes Service RBAC Reader",
+    AcrPull: "AcrPull",
+    AcrPush: "AcrPush",
+    AcrDelete: "AcrDelete",
+    AcrImageSigner: "AcrImageSigner",
+};

package/dist/actions/identity.js

@@ -0,0 +1,11 @@
+/**
+ * Azure Identity & Access RBAC built-in role constants.
+ */
+export const IdentityRoles = {
+    Contributor: "Contributor",
+    Owner: "Owner",
+    Reader: "Reader",
+    UserAccessAdministrator: "User Access Administrator",
+    ManagedIdentityContributor: "Managed Identity Contributor",
+    ManagedIdentityOperator: "Managed Identity Operator",
+};

package/dist/actions/index.js

@@ -0,0 +1,11 @@
+/**
+ * Azure RBAC built-in role constants — barrel export.
+ */
+export { StorageRoles } from "./storage.js";
+export { ComputeRoles } from "./compute.js";
+export { NetworkRoles } from "./network.js";
+export { KeyVaultRoles } from "./keyvault.js";
+export { SqlRoles } from "./sql.js";
+export { ContainerRoles } from "./container.js";
+export { AppServiceRoles } from "./appservice.js";
+export { IdentityRoles } from "./identity.js";

package/dist/actions/keyvault.js

@@ -0,0 +1,12 @@
+/**
+ * Azure Key Vault RBAC built-in role constants.
+ */
+export const KeyVaultRoles = {
+    Administrator: "Key Vault Administrator",
+    CertificatesOfficer: "Key Vault Certificates Officer",
+    CryptoOfficer: "Key Vault Crypto Officer",
+    CryptoUser: "Key Vault Crypto User",
+    Reader: "Key Vault Reader",
+    SecretsOfficer: "Key Vault Secrets Officer",
+    SecretsUser: "Key Vault Secrets User",
+};

package/dist/actions/network.js

@@ -0,0 +1,9 @@
+/**
+ * Azure Network RBAC built-in role constants.
+ */
+export const NetworkRoles = {
+    NetworkContributor: "Network Contributor",
+    DnsZoneContributor: "DNS Zone Contributor",
+    PrivateDnsZoneContributor: "Private DNS Zone Contributor",
+    TrafficManagerContributor: "Traffic Manager Contributor",
+};

package/dist/actions/sql.js

@@ -0,0 +1,9 @@
+/**
+ * Azure SQL RBAC built-in role constants.
+ */
+export const SqlRoles = {
+    ServerContributor: "SQL Server Contributor",
+    DbContributor: "SQL DB Contributor",
+    SecurityManager: "SQL Security Manager",
+    ManagedInstanceContributor: "SQL Managed Instance Contributor",
+};

package/dist/actions/storage.js

@@ -0,0 +1,15 @@
+/**
+ * Azure Storage RBAC built-in role constants.
+ */
+export const StorageRoles = {
+    BlobDataContributor: "Storage Blob Data Contributor",
+    BlobDataReader: "Storage Blob Data Reader",
+    BlobDataOwner: "Storage Blob Data Owner",
+    AccountContributor: "Storage Account Contributor",
+    QueueDataContributor: "Storage Queue Data Contributor",
+    QueueDataReader: "Storage Queue Data Reader",
+    TableDataContributor: "Storage Table Data Contributor",
+    TableDataReader: "Storage Table Data Reader",
+    FileDataPrivilegedContributor: "Storage File Data Privileged Contributor",
+    FileDataPrivilegedReader: "Storage File Data Privileged Reader",
+};

package/dist/api/read-client.js

@@ -0,0 +1,146 @@
+/**
+ * The native Azure read transport (#1212) — the read half of what
+ * `op/activities/az-apply.ts` already does for writes.
+ *
+ * Azure's observers shelled `az resource show`, once per declared entity,
+ * serially, and read the failure out of the CLI's stderr. The applier does
+ * not: `azApply` PUTs each resource at its ARM URL over `fetch`, honours an
+ * endpoint override, and is injectable for tests. Since `az resource show`
+ * returns the ARM JSON that endpoint would have returned anyway, this is
+ * transport only — the payload the readers normalize is unchanged, which is
+ * what made Azure the cheapest of the three observers to move.
+ *
+ * ## Signing
+ *
+ * Requests are unsigned, exactly like `azApply`'s. That is what makes the
+ * emulator lane work with no credential plumbing, and the reason this is
+ * scoped to floci-az rather than announced as a real-ARM read path: real ARM
+ * wants a bearer token. The `az` CLI path remains for a signed read until
+ * token acquisition lands here.
+ */
+/** Default ARM host, matching the applier's. */
+const DEFAULT_ENDPOINT = "https://management.azure.com";
+/** floci-az's fixed local subscription, matching the applier's. */
+const DEFAULT_SUBSCRIPTION = "00000000-0000-0000-0000-000000000001";
+/** Generic ARM resource read, adequate for every top-level type chant declares. */
+const DEFAULT_API_VERSION = "2021-04-01";
+/** A failed read, carrying the status and ARM's own error code where it sent one. */
+export class AzureReadError extends Error {
+    constructor(message, status, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "AzureReadError";
+    }
+}
+/** True when the read failed only because the resource is not there. */
+export function isNotFound(err) {
+    return err instanceof AzureReadError && err.status === 404;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const defaultHttp = async (method, url, body, signal) => {
+    const res = await fetch(url, {
+        method,
+        headers: body === undefined ? undefined : { "content-type": "application/json" },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal,
+    });
+    return { status: res.status, text: await res.text() };
+};
+/** The ARM URL for one resource in the group — the same shape the applier PUTs to. */
+export function armResourceReadUrl(options, type, name, apiVersion = DEFAULT_API_VERSION) {
+    const base = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
+    const subscription = options.subscriptionId ?? DEFAULT_SUBSCRIPTION;
+    return `${base}/subscriptions/${subscription}/resourceGroups/${options.resourceGroup}/providers/${type}/${name}?api-version=${apiVersion}`;
+}
+/**
+ * ARM's error envelope is `{ error: { code, message } }`. Reading the code
+ * rather than the prose is the point of moving off the CLI: `ResourceNotFound`
+ * is a fact, "(ResourceNotFound) The Resource … was not found" is a sentence
+ * that changes between CLI versions.
+ */
+function readError(status, text) {
+    let code;
+    let message = `ARM read failed with HTTP ${status}`;
+    try {
+        const body = JSON.parse(text);
+        const error = isRecord(body) ? body.error : undefined;
+        if (isRecord(error)) {
+            if (typeof error.code === "string")
+                code = error.code;
+            if (typeof error.message === "string")
+                message = error.message;
+        }
+    }
+    catch {
+        // A non-JSON body from a proxy or a gateway — the status is all there is.
+    }
+    return new AzureReadError(message, status, code);
+}
+/**
+ * GET the resource-group's resource list — the enumeration half live export
+ * needs (#1214). Real ARM returns envelopes (id/name/type/location/tags);
+ * callers wanting the full body follow up with {@link getResourceById}.
+ */
+export async function listResources(options) {
+    const http = options.http ?? defaultHttp;
+    const base = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
+    const subscription = options.subscriptionId ?? DEFAULT_SUBSCRIPTION;
+    const url = `${base}/subscriptions/${subscription}/resourceGroups/${options.resourceGroup}/resources?api-version=${DEFAULT_API_VERSION}`;
+    const res = await http("GET", url, undefined, options.signal);
+    if (res.status >= 300)
+        throw readError(res.status, res.text);
+    try {
+        const body = JSON.parse(res.text);
+        const value = isRecord(body) ? body.value : undefined;
+        if (!Array.isArray(value))
+            throw new AzureReadError("unparseable ARM resource list", res.status);
+        return value.filter(isRecord);
+    }
+    catch (err) {
+        if (err instanceof AzureReadError)
+            throw err;
+        throw new AzureReadError("unparseable ARM resource list", res.status);
+    }
+}
+/** GET one resource by its full ARM id — the read for a list entry, nested types included. */
+export async function getResourceById(options, id, apiVersion = DEFAULT_API_VERSION) {
+    const http = options.http ?? defaultHttp;
+    const base = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
+    const url = `${base}${id}?api-version=${apiVersion}`;
+    const res = await http("GET", url, undefined, options.signal);
+    if (res.status >= 300)
+        throw readError(res.status, res.text);
+    try {
+        const body = JSON.parse(res.text);
+        if (!isRecord(body))
+            throw new AzureReadError(`unparseable ARM body for ${id}`, res.status);
+        return body;
+    }
+    catch (err) {
+        if (err instanceof AzureReadError)
+            throw err;
+        throw new AzureReadError(`unparseable ARM body for ${id}`, res.status);
+    }
+}
+/** GET one resource. Throws {@link AzureReadError}; 404 means absent, which callers check with {@link isNotFound}. */
+export async function getResource(options, type, name, apiVersion) {
+    const http = options.http ?? defaultHttp;
+    const url = armResourceReadUrl(options, type, name, apiVersion);
+    const res = await http("GET", url, undefined, options.signal);
+    if (res.status >= 300)
+        throw readError(res.status, res.text);
+    try {
+        const body = JSON.parse(res.text);
+        if (!isRecord(body))
+            throw new AzureReadError(`unparseable ARM body for ${type}/${name}`, res.status);
+        return body;
+    }
+    catch (err) {
+        if (err instanceof AzureReadError)
+            throw err;
+        throw new AzureReadError(`unparseable ARM body for ${type}/${name}`, res.status);
+    }
+}

package/dist/codegen/docs-cli.js

@@ -0,0 +1,2 @@
+import { generateDocs } from "./docs.js";
+await generateDocs({ verbose: true });

package/dist/codegen/docs.js

@@ -0,0 +1,83 @@
+/**
+ * Azure ARM documentation generator.
+ *
+ * Calls the core docsPipeline with Azure-specific config:
+ * service grouping, resource type URLs, and overview content.
+ *
+ * writeDocsSite puts the pages in the main docs site under
+ * docs/src/content/docs/lexicons/azure/ (chant #3993).
+ */
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import { docsPipeline, writeDocsSite } from "@intentius/chant/codegen/docs";
+const __dirname_ = dirname(fileURLToPath(import.meta.url));
+const pkgDir = join(__dirname_, "..", "..");
+/**
+ * Extract the Azure service name from an ARM resource type.
+ * e.g. "Microsoft.Storage/storageAccounts" → "Storage"
+ */
+function serviceFromType(resourceType) {
+    const match = resourceType.match(/^Microsoft\.([^/]+)/);
+    return match ? match[1] : "Other";
+}
+const overview = `The **Azure Resource Manager** lexicon provides support for defining Azure infrastructure using chant's declarative TypeScript syntax. Resources are serialized to ARM template JSON.
+
+This lexicon is generated from the official [Azure Resource Manager Schemas](https://github.com/Azure/azure-resource-manager-schemas) and includes coverage for commonly used resource types.
+
+Install it with:
+
+\`\`\`bash
+npm install --save-dev @intentius/chant-lexicon-azure
+\`\`\``;
+const outputFormat = `The Azure lexicon serializes resources into **ARM template JSON**.
+
+## Building
+
+Run \`chant build\` to produce an ARM template from your declarations:
+
+\`\`\`bash
+chant build
+# Writes dist/template.json
+\`\`\`
+
+The generated template includes:
+
+- \`$schema\` pointing to the ARM deployment template schema
+- \`contentVersion: "1.0.0.0"\`
+- \`parameters\` section for input parameters
+- \`resources\` array with typed Azure resources
+- \`outputs\` section for stack outputs
+
+## Deploying
+
+Use the Azure CLI to deploy the generated template:
+
+\`\`\`bash
+az deployment group create \\
+  --resource-group my-rg \\
+  --template-file dist/template.json
+\`\`\``;
+const docsConfig = {
+    name: "azure",
+    displayName: "Azure Resource Manager",
+    description: "Typed constructors for Azure Resource Manager templates",
+    distDir: join(pkgDir, "dist"),
+    outDir: join(pkgDir, "docs"),
+    basePath: process.env.DOCS_BASE_PATH ?? "/chant/lexicons/azure/",
+    overview,
+    outputFormat,
+    serviceFromType,
+    // `lint-rules` below is the rules documentation; the generated `rules` table
+    // would duplicate it and land in no sidebar (#1312). aws, k8s, gitlab and
+    // github already suppress it for the same reason.
+};
+/**
+ * Generate the Azure docs site.
+ */
+export async function generateDocs(opts) {
+    const result = docsPipeline(docsConfig);
+    writeDocsSite(docsConfig, result);
+    if (opts?.verbose) {
+        console.error(`Generated ${result.pages.size} doc pages`);
+    }
+}

package/dist/codegen/generate-cli.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env tsx
+/**
+ * Thin entry point for `npm run generate` in lexicon-azure.
+ */
+import { generate, writeGeneratedFiles } from "./generate.js";
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+const result = await generate({ verbose: true });
+const pkgDir = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
+writeGeneratedFiles(result, pkgDir);
+console.error(`Generated ${result.resources} resources, ${result.properties} property types, ${result.enums} enums`);

package/dist/codegen/generate-lexicon.js

@@ -0,0 +1,77 @@
+/**
+ * Lexicon JSON generator — produces lexicon-azure.json with metadata for all resources.
+ *
+ * Output is a Record<string, LexiconEntry> keyed by generated class name.
+ */
+import { armShortName } from "../spec/parse.js";
+import { buildRegistry, serializeRegistry, } from "@intentius/chant/codegen/generate-registry";
+/**
+ * Curated create-only properties for common ARM resources.
+ * ARM public schemas lack x-ms-mutability; this map captures
+ * well-known immutable properties that cannot be changed after creation.
+ */
+const CURATED_CREATE_ONLY = {
+    "Microsoft.Storage/storageAccounts": ["kind", "location"],
+    "Microsoft.Compute/virtualMachines": ["location", "zones"],
+    "Microsoft.Compute/virtualMachineScaleSets": ["location", "zones"],
+    "Microsoft.Network/virtualNetworks": ["location"],
+    "Microsoft.Network/networkSecurityGroups": ["location"],
+    "Microsoft.Network/publicIPAddresses": ["location", "zones", "sku"],
+    "Microsoft.Network/loadBalancers": ["location", "sku"],
+    "Microsoft.Web/serverfarms": ["location"],
+    "Microsoft.Web/sites": ["location"],
+    "Microsoft.ContainerService/managedClusters": ["location", "dnsPrefix"],
+    "Microsoft.ContainerRegistry/registries": ["location"],
+    "Microsoft.Sql/servers": ["location"],
+    "Microsoft.Sql/servers_databases": ["location"],
+    "Microsoft.KeyVault/vaults": ["location"],
+    "Microsoft.DocumentDB/databaseAccounts": ["location", "kind"],
+    "Microsoft.ManagedIdentity/userAssignedIdentities": ["location"],
+    "Microsoft.Network/dnsZones": ["location"],
+    "Microsoft.Insights/components": ["location", "kind"],
+    "Microsoft.OperationalInsights/workspaces": ["location"],
+    "Microsoft.EventHub/namespaces": ["location", "sku"],
+    "Microsoft.ServiceBus/namespaces": ["location", "sku"],
+    "Microsoft.Cache/redis": ["location"],
+    "Microsoft.Resources/deployments": ["location"],
+};
+/**
+ * Generate the lexicon-azure.json content.
+ */
+export function generateLexiconJSON(results, naming) {
+    // Adapt ArmSchemaParseResult[] to RegistryResource[]
+    const registryResources = results.map((r) => ({
+        typeName: r.resource.typeName,
+        attributes: r.resource.attributes,
+        properties: r.resource.properties,
+        propertyTypes: r.propertyTypes,
+    }));
+    const entries = buildRegistry(registryResources, naming, {
+        shortName: armShortName,
+        buildEntry: (resource, _tsName, attrs, propConstraints) => {
+            const armType = resource.typeName;
+            const r = results.find((res) => res.resource.typeName === armType);
+            const createOnly = CURATED_CREATE_ONLY[armType];
+            return {
+                resourceType: armType,
+                kind: "resource",
+                lexicon: "azure",
+                apiVersion: r.resource.apiVersion,
+                ...(attrs && { attrs }),
+                ...(propConstraints && { propertyConstraints: propConstraints }),
+                ...(r.resource.resourceLevelFields.length > 0 && {
+                    resourceLevelFields: r.resource.resourceLevelFields,
+                }),
+                ...(r.resource.tagging && { tagging: r.resource.tagging }),
+                ...(createOnly && { createOnly }),
+                ...(r.resource.deployScopes && { deployScopes: r.resource.deployScopes }),
+            };
+        },
+        buildPropertyEntry: (resourceType, propertyType) => ({
+            resourceType: `${resourceType}.${propertyType}`,
+            kind: "property",
+            lexicon: "azure",
+        }),
+    });
+    return serializeRegistry(entries);
+}

package/dist/codegen/generate-typescript.js

@@ -0,0 +1,163 @@
+/**
+ * TypeScript declaration file generator — produces index.d.ts with all resource classes.
+ *
+ * Output includes:
+ * - Resource classes with typed constructors and readonly attributes
+ * - Property type classes
+ * - Enum union types
+ * - Static content (ARM intrinsics, Azure pseudo-parameters, common interfaces)
+ */
+import { armShortName } from "../spec/parse.js";
+import { propertyTypeName, extractDefName } from "./naming.js";
+import { writeResourceClass, writePropertyClass, writeEnumType, } from "@intentius/chant/codegen/generate-typescript";
+/**
+ * Generate the complete .d.ts file content.
+ */
+export function generateTypeScriptDeclarations(results, naming) {
+    const lines = [];
+    lines.push("// Code generated by chant azure generate. DO NOT EDIT generated sections.");
+    const resources = [];
+    const properties = [];
+    const enums = [];
+    for (const r of results) {
+        const armType = r.resource.typeName;
+        const tsName = naming.resolve(armType);
+        if (!tsName)
+            continue;
+        // Build remap from parser property type names to resolved names
+        const shortName = armShortName(armType);
+        const remap = new Map();
+        for (const pt of r.propertyTypes) {
+            const defName = extractDefName(pt.name, shortName);
+            remap.set(pt.name, propertyTypeName(tsName, defName));
+        }
+        for (const e of r.enums) {
+            const defName = extractDefName(e.name, shortName);
+            remap.set(e.name, propertyTypeName(tsName, defName));
+        }
+        // Map ParsedProperty/ParsedAttribute → DtsProperty/DtsAttribute
+        const dtsProps = r.resource.properties.map((p) => ({
+            name: p.name,
+            type: p.tsType,
+            required: p.required,
+            description: p.description,
+        }));
+        const dtsAttrs = r.resource.attributes.map((a) => ({
+            name: a.name.replace(/\./g, "_"),
+            type: a.tsType,
+        }));
+        resources.push({ tsName, properties: dtsProps, attributes: dtsAttrs, remap });
+        // Alias entries
+        for (const alias of naming.aliases(armType)) {
+            resources.push({ tsName: alias, properties: dtsProps, attributes: dtsAttrs, remap });
+        }
+        const ptAliases = naming.propertyTypeAliases(armType);
+        for (const pt of r.propertyTypes) {
+            const defName = extractDefName(pt.name, shortName);
+            const ptName = propertyTypeName(tsName, defName);
+            const ptProps = pt.properties.map((p) => ({
+                name: p.name,
+                type: p.tsType,
+                required: p.required,
+                description: p.description,
+            }));
+            properties.push({ tsName: ptName, properties: ptProps, remap });
+            if (ptAliases) {
+                const aliasName = ptAliases.get(defName);
+                if (aliasName) {
+                    properties.push({ tsName: aliasName, properties: ptProps, remap });
+                }
+            }
+        }
+        for (const e of r.enums) {
+            const defName = extractDefName(e.name, shortName);
+            const eName = propertyTypeName(tsName, defName);
+            enums.push({ tsName: eName, values: e.values });
+        }
+    }
+    // Sort all entries alphabetically
+    resources.sort((a, b) => a.tsName.localeCompare(b.tsName));
+    properties.sort((a, b) => a.tsName.localeCompare(b.tsName));
+    enums.sort((a, b) => a.tsName.localeCompare(b.tsName));
+    // Section 1: Resource classes
+    lines.push("");
+    lines.push("// --- Resource classes ---");
+    for (const re of resources) {
+        writeResourceClass(lines, re.tsName, re.properties, re.attributes, re.remap, "ArmResourceAttributes");
+    }
+    // Section 2: Property classes
+    lines.push("");
+    lines.push("// --- Property classes ---");
+    for (const pe of properties) {
+        writePropertyClass(lines, pe.tsName, pe.properties, pe.remap);
+    }
+    // Section 3: Enum types
+    if (enums.length > 0) {
+        lines.push("");
+        lines.push("// --- Enum types ---");
+        for (const ee of enums) {
+            writeEnumType(lines, ee.tsName, ee.values);
+        }
+    }
+    // Section 4: Static content
+    lines.push("");
+    lines.push(staticTypeScript());
+    lines.push("");
+    return lines.join("\n");
+}
+// --- Static content ---
+function staticTypeScript() {
+    const lines = [];
+    // ARM template functions
+    lines.push("// --- ARM template functions ---");
+    lines.push("");
+    const intrinsics = [
+        ["Concat", "(...values: unknown[]): any"],
+        ["Format", "(format: string, ...args: unknown[]): any"],
+        ["If", "(condition: string, trueValue: unknown, falseValue: unknown): any"],
+        ["ListKeys", "(resourceId: unknown, apiVersion: string): any"],
+        ["Reference", "(name: string, apiVersion?: string): any"],
+        ["ResourceGroup", "(): any"],
+        ["ResourceId", "(type: string, ...names: unknown[]): any"],
+        ["Subscription", "(): any"],
+        ["UniqueString", "(...values: unknown[]): any"],
+    ];
+    intrinsics.sort((a, b) => a[0].localeCompare(b[0]));
+    for (const [name, sig] of intrinsics) {
+        lines.push(`export declare function ${name}${sig};`);
+    }
+    // Azure pseudo-parameters
+    lines.push("");
+    lines.push("// --- Azure pseudo-parameters ---");
+    lines.push("");
+    lines.push("export declare const Azure: {");
+    const pseudoParams = [
+        "DeploymentName",
+        "ResourceGroupId",
+        "ResourceGroupLocation",
+        "ResourceGroupName",
+        "SubscriptionId",
+        "TenantId",
+    ];
+    for (const p of pseudoParams) {
+        lines.push(`  readonly ${p}: any;`);
+    }
+    lines.push("};");
+    // Type interfaces
+    lines.push("");
+    lines.push("// --- Type interfaces ---");
+    lines.push("");
+    lines.push("export interface Declarable {");
+    lines.push("  readonly entityType: string;");
+    lines.push("}");
+    lines.push("");
+    lines.push("export interface ArmResourceAttributes {");
+    lines.push("  DependsOn?: Declarable | Declarable[] | string | string[];");
+    lines.push("}");
+    lines.push("");
+    lines.push("export interface Tag {");
+    lines.push("  key: string;");
+    lines.push("  value: string;");
+    lines.push("}");
+    return lines.join("\n");
+}