@intentius/chant-lexicon-azure 0.124.31 → 0.124.33

package/dist/spec/api-versions.js

@@ -0,0 +1,130 @@
+/**
+ * API version resolution for Azure Resource Manager schemas.
+ *
+ * ARM schemas are organized by API date:
+ *   schemas/{date}/Microsoft.{Provider}.json
+ *
+ * This module picks the latest API version per provider.
+ */
+/**
+ * Parse an API date string (e.g. "2023-01-01" or "2023-01-01-preview").
+ * Returns a numeric value for comparison: date timestamp with preview
+ * versions ranked below their GA counterpart.
+ */
+export function parseApiDate(dateStr) {
+    const isPreview = dateStr.endsWith("-preview");
+    const cleaned = isPreview ? dateStr.replace(/-preview$/, "") : dateStr;
+    const ts = new Date(cleaned).getTime();
+    // Preview versions sort just below their GA date
+    return isPreview ? ts - 1 : ts;
+}
+/**
+ * Compare two API date strings. Returns positive if a > b.
+ */
+export function compareApiDates(a, b) {
+    return parseApiDate(a) - parseApiDate(b);
+}
+/**
+ * Extract provider name and API version from a schema file path.
+ *
+ * Input:  "azure-resource-manager-schemas-main/schemas/2023-01-01/Microsoft.Storage.json"
+ * Output: { provider: "Microsoft.Storage", apiVersion: "2023-01-01" }
+ */
+export function parseSchemaPath(path) {
+    // Match schemas/{date}/Microsoft.{Provider}.json
+    const match = path.match(/schemas\/(\d{4}-\d{2}-\d{2}(?:-preview)?)\/(Microsoft\.[^/]+)\.json$/);
+    if (!match)
+        return null;
+    return { apiVersion: match[1], provider: match[2] };
+}
+/**
+ * Per-provider API-version pins.
+ *
+ * `latestVersionPerProvider` picks the single newest version per provider, but
+ * Azure spreads resources across versions — a newer version can DROP a resource
+ * an older one defined. Microsoft.Authorization's latest preview no longer
+ * includes the plain `roleAssignments` / `roleDefinitions` resources; they live
+ * in 2022-04-01, the latest stable that still has them. Pin it so those
+ * generate (the naming table maps both). See #223.
+ *
+ * Microsoft.Compute has the same issue (#1144): at the schema commit pinned
+ * in ../spec/fetch.ts, the newest dated `Microsoft.Compute.json` (2026-03-02)
+ * is a narrow disk-only delta that drops `virtualMachines`,
+ * `virtualMachineScaleSets`, and `availabilitySets` entirely — not a rename,
+ * an omission, since Azure alternates between a "VM flavor" and a "disk
+ * flavor" of this file across dates rather than publishing one cumulative
+ * file. 2026-03-01 is the most recent date that still has the VM family
+ * (validate.ts's REQUIRED_NAMES and composites/vm-linux.ts depend on it);
+ * it drops the disk-only resources (disks, diskAccesses, diskEncryptionSets,
+ * snapshots), which nothing here currently references.
+ *
+ * A pin can list several versions (#1545): Azure publishes some providers as
+ * per-family deltas, so no single date carries every resource we need. The
+ * files merge in the order listed — the first file that defines a resource
+ * name wins, later files only contribute resources not yet seen.
+ * Microsoft.Authorization needs three: 2022-04-01 for roleAssignments /
+ * roleDefinitions (#223), 2026-06-01 (latest stable policy file) for
+ * policyAssignments / policyDefinitions / policySetDefinitions and their
+ * _versions children, and 2022-07-01-preview for policyExemptions, which has
+ * no GA date and whose newer preview files (2024-12-01-preview and later)
+ * drag in policy variables we don't want yet.
+ *
+ * Microsoft.AzureStackHCI splits the same way (#1795): the newest dated file
+ * (2026-05-01-preview) carries only the cluster/edge-device family, while the
+ * VM family (virtualMachineInstances, virtualNetworks, networkInterfaces,
+ * publicIPAddresses, galleryImages, virtualHardDisks, ...) last appears in
+ * 2026-04-01-preview. Pin both, newest first — the cluster/edge family
+ * generates from 2026-05-01-preview and the VM family fills in from
+ * 2026-04-01-preview. `Microsoft.DataReplication/replicationVaults_
+ * privateEndpointConnectionProxies` dropped out in the same re-baseline but
+ * is NOT pinnable back: no dated Microsoft.DataReplication.json at the
+ * AZURE_SCHEMA_COMMIT pin (2021-02-16-preview, 2024-09-01, 2026-05-01)
+ * defines it — upstream removed the resource, so it stays gone.
+ *
+ * Microsoft.Management and Microsoft.Subscription are pinned to their latest
+ * GA dates: the naive latest for both is a preview (2024-02-01-preview adds
+ * serviceGroups; 2025-11-01-preview adds changeTenantRequest), and the
+ * management-group hierarchy should not author against preview apiVersions.
+ */
+export const PROVIDER_VERSION_OVERRIDES = {
+    "Microsoft.Authorization": ["2022-04-01", "2026-06-01", "2022-07-01-preview"],
+    "Microsoft.AzureStackHCI": ["2026-05-01-preview", "2026-04-01-preview"],
+    "Microsoft.Compute": ["2026-03-01"],
+    "Microsoft.Management": ["2023-04-01"],
+    "Microsoft.Subscription": ["2021-10-01"],
+};
+/**
+ * Given a set of schema paths, return the schema files to generate from, per
+ * provider: the single latest API version, unless
+ * {@link PROVIDER_VERSION_OVERRIDES} pins the provider to one or more chosen
+ * versions (used where "latest" drops resources we depend on). For pinned
+ * providers the array preserves the pin order — callers merge the files
+ * first-wins per resource name.
+ *
+ * Returns a Map of provider → [{ path, apiVersion }, ...].
+ */
+export function latestVersionPerProvider(paths) {
+    const best = new Map();
+    for (const p of paths) {
+        const parsed = parseSchemaPath(p);
+        if (!parsed)
+            continue;
+        const pinned = PROVIDER_VERSION_OVERRIDES[parsed.provider];
+        if (pinned) {
+            // Only accept the pinned versions for an overridden provider,
+            // slotted into pin order.
+            if (pinned.includes(parsed.apiVersion)) {
+                const files = best.get(parsed.provider) ?? [];
+                files.push({ path: p, apiVersion: parsed.apiVersion });
+                files.sort((a, b) => pinned.indexOf(a.apiVersion) - pinned.indexOf(b.apiVersion));
+                best.set(parsed.provider, files);
+            }
+            continue;
+        }
+        const existing = best.get(parsed.provider);
+        if (!existing || compareApiDates(parsed.apiVersion, existing[0].apiVersion) > 0) {
+            best.set(parsed.provider, [{ path: p, apiVersion: parsed.apiVersion }]);
+        }
+    }
+    return best;
+}

package/dist/spec/fetch.js

@@ -0,0 +1,196 @@
+/**
+ * Azure Resource Manager schema fetching.
+ *
+ * Downloads the azure-resource-manager-schemas repo tarball,
+ * extracts provider JSON schemas, deduplicates by latest API version,
+ * and "explodes" multi-resource files into one entry per resource.
+ */
+import { homedir } from "os";
+import { join } from "path";
+import { fetchWithCache, extractFromTar, clearCacheFile } from "@intentius/chant/codegen/fetch";
+import { latestVersionPerProvider } from "./api-versions.js";
+/** Per-attempt download timeout for a multi-megabyte archive. */
+const ARCHIVE_ATTEMPT_TIMEOUT_MS = 120000;
+/**
+ * Pinned commit of Azure/azure-resource-manager-schemas (#1144).
+ *
+ * The repo has no tagged releases, so unlike gcp (`KCC_VERSION`) or k8s
+ * (`K8S_SCHEMA_VERSION`) there is no version tag to pin against — codegen
+ * used to fetch `refs/heads/main` directly. That meant a cold cache picked
+ * up whatever upstream state had landed since the cache last expired, while
+ * a warm cache kept serving whatever was current when it was last filled.
+ * Azure republishes per-provider schema files under new dates constantly,
+ * and a later date can drop resources an earlier one defined (see
+ * PROVIDER_VERSION_OVERRIDES in ./api-versions.ts) — so which resources
+ * even exist to generate depends on exactly when you fetch, not just what
+ * the fetch URL happens to be. That broke composites/vm-linux.ts at tsc
+ * nondeterministically, depending on which runner's cache was warm.
+ *
+ * Pinning to a commit SHA makes generation reproducible regardless of cache
+ * state. Bump policy: #523's scheduled lexicon-upgrade cron (rolling-spec
+ * bucket, sub-issue #526) is meant to propose bumps to this constant as a
+ * reviewable PR once built. Until then, bump by hand: take the current
+ * `main` HEAD sha from
+ * https://github.com/Azure/azure-resource-manager-schemas/commits/main,
+ * regenerate, fix up any composite left referencing a renamed or vanished
+ * export (adding a PROVIDER_VERSION_OVERRIDES entry if a resource dropped
+ * out of the naive "latest by date" pick), and update this constant +
+ * comment.
+ */
+export const AZURE_SCHEMA_COMMIT = "0085cb6f3a98e735359807143bcb1667aeec930f";
+const TARBALL_URL = `https://github.com/Azure/azure-resource-manager-schemas/archive/${AZURE_SCHEMA_COMMIT}.tar.gz`;
+const CACHE_DIR = join(homedir(), ".chant");
+// The cache filename embeds the pin so a stale tarball from before a bump
+// can never mask the bump: restoring an old ~/.chant (e.g. a CI cache
+// partial-key fallback, or a developer's pre-existing cache) simply misses
+// this filename and re-downloads, instead of silently serving pre-bump
+// schemas under a name that still matches (#1144).
+const CACHE_FILE = join(CACHE_DIR, `azure-resource-manager-schemas-${AZURE_SCHEMA_COMMIT}.tar.gz`);
+/** Paths to skip (common-types, non-provider files). */
+function isProviderSchema(path) {
+    if (path.includes("common-types/"))
+        return false;
+    if (path.includes("test/"))
+        return false;
+    if (!path.includes("/schemas/"))
+        return false;
+    // Must match schemas/{date}/Microsoft.*.json
+    return /schemas\/\d{4}-\d{2}-\d{2}(?:-preview)?\/Microsoft\.[^/]+\.json$/.test(path);
+}
+/**
+ * Normalize schema-file provider name to canonical ARM provider.
+ * "Microsoft.Network.NRP" → "Microsoft.Network"
+ * "Microsoft.Sql.Legacy"  → "Microsoft.Sql"
+ * "Microsoft.Compute"     → "Microsoft.Compute" (unchanged)
+ */
+function normalizeProvider(fileProvider) {
+    const parts = fileProvider.split(".");
+    // Microsoft.X.Y... → Microsoft.X
+    return parts.length > 2 ? `${parts[0]}.${parts[1]}` : fileProvider;
+}
+/**
+ * Providers whose scope-specific resource definition sections are read in
+ * addition to `resourceDefinitions` (#1545).
+ *
+ * Deliberately an allowlist: reading the scoped sections for every provider
+ * would pull hundreds of subscription/tenant-scope resources into the
+ * generated surface at once (and back into tsc time — see the #438 bounding
+ * story). Only the org-hierarchy and policy providers need them today; grow
+ * this set intentionally, checking generated size and azure tsc time after.
+ */
+const SCOPED_SECTION_PROVIDERS = new Set([
+    "Microsoft.Management",
+    "Microsoft.Subscription",
+    "Microsoft.Authorization",
+]);
+/** Scope sections of a provider file, in definition-priority order. */
+const SCOPE_SECTIONS = [
+    { key: "resourceDefinitions", scope: "resourceGroup" },
+    { key: "subscription_resourceDefinitions", scope: "subscription" },
+    { key: "managementGroup_resourceDefinitions", scope: "managementGroup" },
+    { key: "tenant_resourceDefinitions", scope: "tenant" },
+];
+/**
+ * Explode one provider schema file into per-resource schema entries,
+ * writing into `out` keyed by resource type. Resource types already present
+ * in `out` are left untouched (first file wins across a multi-version pin).
+ *
+ * For providers in {@link SCOPED_SECTION_PROVIDERS} all deployment-scope
+ * sections are read; the definition comes from the highest-priority section
+ * that has it, and `deployScopes` unions every section that defines it.
+ */
+export function explodeProviderSchema(provider, apiVersion, providerSchema, out) {
+    const definitions = providerSchema.definitions ?? {};
+    const sections = SCOPED_SECTION_PROVIDERS.has(normalizeProvider(provider))
+        ? SCOPE_SECTIONS
+        : SCOPE_SECTIONS.slice(0, 1);
+    // Gather each resource name's definition (highest-priority section wins)
+    // and the union of scopes that define it.
+    const byName = new Map();
+    for (const { key, scope } of sections) {
+        const defs = providerSchema[key];
+        if (!defs)
+            continue;
+        for (const [resourceName, resourceDef] of Object.entries(defs)) {
+            const existing = byName.get(resourceName);
+            if (existing) {
+                existing.scopes.push(scope);
+            }
+            else {
+                byName.set(resourceName, { def: resourceDef, scopes: [scope] });
+            }
+        }
+    }
+    for (const [resourceName, { def, scopes }] of byName) {
+        const resourceType = `${normalizeProvider(provider)}/${resourceName}`;
+        if (out.has(resourceType))
+            continue;
+        // Build a per-resource schema that includes the resource def + shared definitions + apiVersion
+        const perResourceSchema = {
+            resourceType,
+            apiVersion,
+            provider,
+            resourceName,
+            deployScopes: scopes,
+            resourceDefinition: def,
+            definitions,
+        };
+        out.set(resourceType, Buffer.from(JSON.stringify(perResourceSchema)));
+    }
+}
+/**
+ * Fetch ARM schemas and return a Map keyed by resource type
+ * (e.g. "Microsoft.Storage/storageAccounts") to raw JSON bytes.
+ *
+ * Each provider file is "exploded" so that every resourceDefinition
+ * becomes its own entry with the shared definitions included.
+ */
+export async function fetchArmSchemas(force = false) {
+    const tarGz = await fetchWithCache({ url: TARBALL_URL, cacheFile: CACHE_FILE, attemptTimeoutMs: ARCHIVE_ATTEMPT_TIMEOUT_MS }, force);
+    // Gunzip
+    const { gunzipSync } = await import("fflate");
+    const tarData = gunzipSync(new Uint8Array(tarGz));
+    // Extract all provider schema files
+    const allFiles = extractFromTar(tarData, isProviderSchema);
+    // Deduplicate: keep only the latest API version per provider, or the pinned
+    // versions (in pin order) for providers in PROVIDER_VERSION_OVERRIDES.
+    const paths = [...allFiles.keys()];
+    const selected = latestVersionPerProvider(paths);
+    // Explode: one provider file has N resourceDefinitions → emit N entries.
+    // With a multi-version pin the first file that defines a resource wins.
+    const schemas = new Map();
+    for (const [provider, files] of selected) {
+        // First-wins applies within one provider's pin list; across providers the
+        // pre-#1545 behavior is kept (a later provider file may overwrite a
+        // normalized-name collision, e.g. Microsoft.Sql.Legacy vs Microsoft.Sql).
+        const providerSchemas = new Map();
+        for (const { path, apiVersion } of files) {
+            const data = allFiles.get(path);
+            if (!data)
+                continue;
+            try {
+                const providerSchema = JSON.parse(data.toString("utf-8"));
+                explodeProviderSchema(provider, apiVersion, providerSchema, providerSchemas);
+            }
+            catch {
+                // Skip files that can't be parsed
+            }
+        }
+        for (const [resourceType, buf] of providerSchemas) {
+            schemas.set(resourceType, buf);
+        }
+    }
+    return schemas;
+}
+/**
+ * Get the cache file path (for testing).
+ */
+export function getCachePath() {
+    return CACHE_FILE;
+}
+/**
+ * Clear the cache (for testing).
+ */
+export function clearCache() {
+    clearCacheFile(CACHE_FILE);
+}

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAiE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAI9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7E;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AA+GD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,aAWrC,CAAC;AAEH;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,oBAAoB,CAwI1E;AA+CD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAiE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAI9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7E;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAyHD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,aAWrC,CAAC;AAEH;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,oBAAoB,CAwI1E;AA+CD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvD"}

package/dist/spec/parse.js

@@ -0,0 +1,318 @@
+/**
+ * Azure Resource Manager JSON Schema parser.
+ *
+ * Parses each exploded ARM schema into typed structures suitable for code generation:
+ * resources with properties and attributes, property types from definitions,
+ * and enum types from string enum definitions.
+ *
+ * Key differences from CloudFormation parsing:
+ * - ARM has resource-level fields (name, type, apiVersion, location, sku, kind,
+ *   identity, tags, zones, plan) separate from properties.properties
+ * - ARM schemas use oneOf wrappers with expression refs that must be unwrapped
+ * - ARM schemas lack readOnlyProperties — attributes are curated
+ */
+import { resolvePropertyType as coreResolvePropertyType, extractConstraints as coreExtractConstraints, constraintsIsEmpty as coreConstraintsIsEmpty, isEnumDefinition as coreIsEnumDefinition, } from "@intentius/chant/codegen/json-schema";
+import { boundPropertyTypes } from "@intentius/chant/codegen/bound-property-types";
+/** ARM resource-level fields that live outside properties.properties. */
+const RESOURCE_LEVEL_FIELDS = new Set([
+    "name",
+    "type",
+    "apiVersion",
+    "location",
+    "sku",
+    "kind",
+    "identity",
+    "tags",
+    "zones",
+    "plan",
+]);
+/** Expression reference pattern in ARM oneOf wrappers. */
+const EXPRESSION_REF_PATTERN = /definitions\.json#\/definitions\/expression|common\/definitions\.json/;
+/**
+ * Curated attributes for common ARM resources.
+ * ARM schemas lack readOnlyProperties, so we maintain this list.
+ */
+const CURATED_ATTRIBUTES = {
+    "Microsoft.Storage/storageAccounts": [
+        { name: "id", tsType: "string" },
+        { name: "primaryEndpoints", tsType: "string" },
+        { name: "primaryLocation", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Compute/virtualMachines": [
+        { name: "id", tsType: "string" },
+        { name: "vmId", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/virtualNetworks": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/networkSecurityGroups": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/publicIPAddresses": [
+        { name: "id", tsType: "string" },
+        { name: "ipAddress", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/networkInterfaces": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Web/serverfarms": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Web/sites": [
+        { name: "id", tsType: "string" },
+        { name: "defaultHostName", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.ContainerService/managedClusters": [
+        { name: "id", tsType: "string" },
+        { name: "fqdn", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+        { name: "nodeResourceGroup", tsType: "string" },
+    ],
+    "Microsoft.Sql/servers": [
+        { name: "id", tsType: "string" },
+        { name: "fullyQualifiedDomainName", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Sql/servers_databases": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.KeyVault/vaults": [
+        { name: "id", tsType: "string" },
+        { name: "vaultUri", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.ContainerRegistry/registries": [
+        { name: "id", tsType: "string" },
+        { name: "loginServer", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.DocumentDB/databaseAccounts": [
+        { name: "id", tsType: "string" },
+        { name: "documentEndpoint", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    "Microsoft.Network/loadBalancers": [
+        { name: "id", tsType: "string" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+    // The app's hostname, for DNS in front of it (#4179). Dotted names read a
+    // nested field of reference()'s properties, as AWS's Endpoint.Address does.
+    "Microsoft.App/containerApps": [
+        { name: "id", tsType: "string" },
+        { name: "configuration.ingress.fqdn", tsType: "string" },
+        { name: "latestRevisionFqdn", tsType: "string" },
+        { name: "latestRevisionName", tsType: "string" },
+        { name: "outboundIpAddresses", tsType: "string[]" },
+        { name: "provisioningState", tsType: "string" },
+    ],
+};
+/**
+ * Maximum nesting depth of generated property-type interfaces.
+ *
+ * ARM schemas embed a named definition for every nested object, and fully
+ * expanding all of them per-resource produces a ~273MB declaration that is not
+ * shippable as `.d.ts`. We instead emit only the property types reachable from
+ * a resource's top-level properties within this depth; references that are
+ * deeper, or to definitions no resource property reaches, are loosened to
+ * `Record<string, unknown>`. Depth 1 keeps top-level props + their immediate
+ * nested object shapes typed; deeper ARM config trees become loose. (#438)
+ */
+const MAX_PROPERTY_TYPE_DEPTH = 1;
+/**
+ * Property-type definition names that are always emitted as typed interfaces,
+ * regardless of reachability/depth — common nested ARM shapes worth typing for
+ * authoring ergonomics. Kept in sync with the azure `validate` required-names
+ * check (it asserts these survive code generation). (#438)
+ */
+export const CURATED_PROPERTY_TYPE_DEFS = new Set([
+    "Sku",
+    "Identity",
+    "NetworkProfile",
+    "StorageProfile",
+    "OsDisk",
+    "ImageReference",
+    "IpConfiguration",
+    "SecurityRule",
+    "SubnetProperties",
+    "SiteConfig",
+]);
+/**
+ * Parse an ARM schema (exploded per-resource format) into typed structures.
+ */
+export function parseArmSchema(data) {
+    const raw = JSON.parse(typeof data === "string" ? data : data.toString("utf-8"));
+    const resourceType = raw.resourceType;
+    const apiVersion = raw.apiVersion;
+    const resourceDef = raw.resourceDefinition;
+    const definitions = raw.definitions ?? {};
+    // Deployment scopes stamped by the fetch explode (#1545). Only carried
+    // through when the resource exists somewhere other than plain
+    // resource-group scope, so the common case stays field-free.
+    const rawScopes = raw.deployScopes;
+    const deployScopes = rawScopes && !(rawScopes.length === 1 && rawScopes[0] === "resourceGroup")
+        ? rawScopes
+        : undefined;
+    const shortName = armShortName(resourceType);
+    const fakeSchema = { definitions };
+    // Parse resource-level fields and nested properties
+    const props = [];
+    const resourceLevelFields = [];
+    if (resourceDef.properties) {
+        for (const [name, prop] of Object.entries(resourceDef.properties)) {
+            if (name === "type" || name === "apiVersion")
+                continue; // These are injected
+            const unwrapped = unwrapExpressionOneOf(prop);
+            if (RESOURCE_LEVEL_FIELDS.has(name)) {
+                resourceLevelFields.push(name);
+            }
+            // If this is the "properties" container, expand its sub-properties
+            if (name === "properties" && unwrapped.properties) {
+                const innerRequired = new Set(unwrapped.required ?? []);
+                for (const [innerName, innerProp] of Object.entries(unwrapped.properties)) {
+                    const innerUnwrapped = unwrapExpressionOneOf(innerProp);
+                    const tsType = resolvePropertyType(innerUnwrapped, definitions, shortName);
+                    props.push({
+                        name: innerName,
+                        tsType,
+                        required: innerRequired.has(innerName),
+                        description: innerUnwrapped.description,
+                        enum: innerUnwrapped.enum,
+                        constraints: extractConstraints(innerUnwrapped),
+                    });
+                }
+                continue;
+            }
+            const tsType = resolvePropertyType(unwrapped, definitions, shortName);
+            const requiredSet = new Set(resourceDef.required ?? []);
+            props.push({
+                name,
+                tsType,
+                required: requiredSet.has(name),
+                description: unwrapped.description,
+                enum: unwrapped.enum,
+                constraints: extractConstraints(unwrapped),
+            });
+        }
+    }
+    // Parse definitions into property types and enums
+    const propertyTypes = [];
+    const enums = [];
+    for (const [defName, def] of Object.entries(definitions)) {
+        // Skip expression-related definitions
+        if (defName === "expression" || defName.startsWith("http"))
+            continue;
+        if (isEnumDefinition(def)) {
+            enums.push({
+                name: `${shortName}_${defName}`,
+                values: def.enum,
+            });
+            continue;
+        }
+        if (def.properties) {
+            const defRequired = new Set(def.required ?? []);
+            const defProps = [];
+            for (const [propName, prop] of Object.entries(def.properties)) {
+                const unwrapped = unwrapExpressionOneOf(prop);
+                const tsType = resolvePropertyType(unwrapped, definitions, shortName);
+                defProps.push({
+                    name: propName,
+                    tsType,
+                    required: defRequired.has(propName),
+                    description: unwrapped.description,
+                    enum: unwrapped.enum,
+                    constraints: extractConstraints(unwrapped),
+                });
+            }
+            propertyTypes.push({
+                name: `${shortName}_${defName}`,
+                specType: defName,
+                properties: defProps,
+            });
+        }
+    }
+    // Attributes from curated map
+    const attrs = CURATED_ATTRIBUTES[resourceType] ?? [
+        { name: "id", tsType: "string" },
+    ];
+    // Bound the emitted property types to keep the generated declaration shippable (#438).
+    const boundedPropertyTypes = boundPropertyTypes(shortName, props, propertyTypes, new Set(enums.map((e) => e.name)), { maxDepth: MAX_PROPERTY_TYPE_DEPTH, curatedDefs: CURATED_PROPERTY_TYPE_DEFS });
+    // Detect tagging support (if tags field exists)
+    const hasTags = resourceLevelFields.includes("tags");
+    const tagging = hasTags
+        ? { taggable: true, tagOnCreate: true, tagUpdatable: true }
+        : undefined;
+    return {
+        resource: {
+            typeName: resourceType,
+            apiVersion,
+            properties: props,
+            attributes: attrs,
+            resourceLevelFields,
+            ...(tagging && { tagging }),
+            ...(deployScopes && { deployScopes }),
+        },
+        propertyTypes: boundedPropertyTypes,
+        enums,
+    };
+}
+// --- Unwrap oneOf expression wrappers ---
+/**
+ * ARM schemas wrap real types in oneOf with an expression $ref.
+ * Detect this pattern and return the real type.
+ */
+function unwrapExpressionOneOf(prop) {
+    if (!prop.oneOf || prop.oneOf.length < 2)
+        return prop;
+    const nonExpr = prop.oneOf.filter((item) => {
+        if (item.$ref && EXPRESSION_REF_PATTERN.test(item.$ref))
+            return false;
+        return true;
+    });
+    if (nonExpr.length === 1) {
+        // Merge description from parent if present
+        const result = { ...nonExpr[0] };
+        if (prop.description && !result.description) {
+            result.description = prop.description;
+        }
+        return result;
+    }
+    return prop;
+}
+// --- Type resolution (delegated to core) ---
+function resolvePropertyType(prop, definitions, shortName) {
+    const fakeDoc = { definitions };
+    return coreResolvePropertyType(prop, fakeDoc, (defName) => `${shortName}_${defName}`);
+}
+function extractConstraints(prop) {
+    return coreExtractConstraints(prop);
+}
+export const constraintsIsEmpty = coreConstraintsIsEmpty;
+function isEnumDefinition(def) {
+    return coreIsEnumDefinition(def);
+}
+/**
+ * Extract short resource name:
+ * "Microsoft.Storage/storageAccounts" → "storageAccounts"
+ */
+export function armShortName(typeName) {
+    const slashIdx = typeName.lastIndexOf("/");
+    return slashIdx >= 0 ? typeName.slice(slashIdx + 1) : typeName;
+}
+/**
+ * Extract service name:
+ * "Microsoft.Storage/storageAccounts" → "Storage"
+ */
+export function armServiceName(typeName) {
+    const match = typeName.match(/^Microsoft\.([^/]+)/);
+    // Strip dots from hierarchical providers (e.g. "App.ContainerApps" → "AppContainerApps")
+    return match ? match[1].replace(/\./g, "") : typeName;
+}