@intentius/chant-lexicon-azure 0.124.31 → 0.124.33

package/dist/taggable.js

@@ -0,0 +1,34 @@
+/**
+ * Shared taggable resource lookup — loads from the generated lexicon JSON.
+ *
+ * Lazy-loaded and cached for the lifetime of the process.
+ */
+import { readFileSync } from "fs";
+import { join } from "path";
+import { moduleSourceDir } from "@intentius/chant/module-source";
+let _cached;
+const __dirname_ = moduleSourceDir(import.meta.url);
+/**
+ * Load taggable resource types from the lexicon JSON.
+ * Result is cached after first call.
+ */
+export function loadTaggableResources() {
+    if (_cached)
+        return _cached;
+    const set = new Set();
+    try {
+        const lexiconPath = join(__dirname_, "generated", "lexicon-azure.json");
+        const content = readFileSync(lexiconPath, "utf-8");
+        const data = JSON.parse(content);
+        for (const [_name, entry] of Object.entries(data)) {
+            if (entry.kind === "resource" && entry.resourceType && entry.tagging?.taggable) {
+                set.add(entry.resourceType);
+            }
+        }
+    }
+    catch {
+        // Lexicon not available — skip
+    }
+    _cached = set;
+    return set;
+}

package/dist/types/index.d.ts

@@ -4232,7 +4232,12 @@ export declare class containerApps {
     /** Resource tags. */
     tags?: Record<string, unknown>;
   }, attributes?: ArmResourceAttributes);
+  readonly configuration_ingress_fqdn: string;
   readonly id: string;
+  readonly latestRevisionFqdn: string;
+  readonly latestRevisionName: string;
+  readonly outboundIpAddresses: string[];
+  readonly provisioningState: string;
 }
 
 export declare class containerApps_authConfigs {

package/dist/validate-cli.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env tsx
+/**
+ * Thin entry point for `npm run validate` in lexicon-azure.
+ */
+import { validate } from "./validate.js";
+const result = await validate();
+for (const check of result.checks) {
+    const status = check.ok ? "OK" : "FAIL";
+    const msg = check.error ? ` — ${check.error}` : "";
+    console.error(`  [${status}] ${check.name}${msg}`);
+}
+if (!result.success) {
+    console.error("Validation failed");
+    process.exit(1);
+}
+console.error("All validation checks passed.");

package/dist/validate.js

@@ -0,0 +1,53 @@
+/**
+ * Validate generated lexicon-azure artifacts.
+ */
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+import { validateLexiconArtifacts } from "@intentius/chant/codegen/validate";
+import { CURATED_PROPERTY_TYPE_DEFS } from "./spec/parse.js";
+const REQUIRED_NAMES = [
+    // Core compute resources
+    "VirtualMachine", "VirtualMachineScaleSet", "AvailabilitySet",
+    // Networking
+    "VirtualNetwork", "Subnet", "NetworkInterface",
+    "NetworkSecurityGroup", "PublicIPAddress", "LoadBalancer",
+    // Storage
+    "StorageAccount", "BlobContainer",
+    // Web & App
+    "WebApp", "AppServicePlan",
+    // Containers
+    "ManagedCluster", "ContainerRegistry",
+    // Databases
+    "SqlServer", "SqlDatabase",
+    // Security & Identity
+    "KeyVault", "ManagedIdentity",
+    // Governance — org hierarchy + policy primitives (#1545).  once claimed
+    // these existed when they did not; this gate keeps them from vanishing again.
+    "ManagementGroup", "SubscriptionAlias", "PolicyDefinition", "PolicyAssignment",
+    // DNS & Traffic
+    "DnsZone", "TrafficManagerProfile",
+    // Curated property types kept typed by the codegen (#438) — single source of truth.
+    ...CURATED_PROPERTY_TYPE_DEFS,
+];
+export async function validate(opts) {
+    const basePath = opts?.basePath ?? dirname(dirname(fileURLToPath(import.meta.url)));
+    return validateLexiconArtifacts({
+        lexiconJsonFilename: "lexicon-azure.json",
+        requiredNames: REQUIRED_NAMES,
+        // Curated property types are emitted under resource-prefixed/variant names
+        // after bounding (#438), so match required names by substring.
+        requiredNamesMatchSubstring: true,
+        basePath,
+        // chant #1475 — azure generates from a commit sha of
+        // azure-resource-manager-schemas (#1144), so a fresh generate is
+        // deterministic. Gate the surface on every validate: the #1144 pin left
+        // the snapshot 483 entries behind until #1572 re-baselined it, because
+        // nothing compared the two on a PR.
+        checkSurfaceSnapshot: "always",
+        coverageThresholds: {
+            minPropertyPct: 1,
+            minLifecyclePct: 1,
+            minAttrPct: 1,
+        },
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.124.31",
+  "version": "0.124.33",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -32,27 +32,27 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./detect": {
       "development": "./src/detect.ts",
       "types": "./dist/detect.d.ts",
-      "default": "./src/detect.ts"
+      "default": "./dist/detect.js"
     },
     "./op/activities": {
       "development": "./src/op/activities/index.ts",
       "types": "./dist/op/activities/index.d.ts",
-      "default": "./src/op/activities/index.ts"
+      "default": "./dist/op/activities/index.js"
     },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
-      "default": "./src/lint/post-synth/index.ts"
+      "default": "./dist/lint/post-synth/index.js"
     },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
@@ -64,7 +64,7 @@
     "validate": "tsx src/validate-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "dependencies": {
     "fflate": "^0.8.2"
@@ -74,6 +74,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.31"
+    "@intentius/chant": "^0.124.33"
   }
 }

package/src/attributes.test.ts

@@ -0,0 +1,17 @@
+/**
+ * A Container App's hostname is referenceable (#4179), so DNS in another
+ * lexicon can point at it: `configuration.ingress.fqdn` is read through
+ * `configuration_ingress_fqdn`.
+ */
+
+import { describe, expect, test } from "vitest";
+import { AttrRef } from "@intentius/chant";
+import { containerApps } from "./index";
+
+describe("Container App attributes", () => {
+  test("configuration.ingress.fqdn and latestRevisionFqdn are AttrRefs", () => {
+    const app = new containerApps({ name: "web", location: "eastus" } as never) as unknown as Record<string, unknown>;
+    expect((app.configuration_ingress_fqdn as AttrRef).attribute).toBe("configuration.ingress.fqdn");
+    expect(app.latestRevisionFqdn).toBeInstanceOf(AttrRef);
+  });
+});

package/src/codegen/generate-typescript.ts

@@ -78,7 +78,7 @@ export function generateTypeScriptDeclarations(
       description: p.description,
     }));
     const dtsAttrs: DtsAttribute[] = r.resource.attributes.map((a) => ({
-      name: a.name,
+      name: a.name.replace(/\./g, "_"),
       type: a.tsType,
     }));
 

package/src/codegen/generate.ts

@@ -95,7 +95,7 @@ function generateRuntimeIndex(
     // Build attrs map
     const attrs: Record<string, string> = {};
     for (const a of r.resource.attributes) {
-      attrs[a.name] = a.name;
+      attrs[a.name.replace(/\./g, "_")] = a.name;
     }
 
     resourceEntries.push({ tsName, resourceType: armType, attrs });

package/src/codegen/package.ts

@@ -6,7 +6,7 @@
 import { readFileSync } from "fs";
 import { azurePlugin } from "../plugin";
 import { dirname } from "path";
-import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import type { IntrinsicDef } from "@intentius/chant/lexicon";
 import {
   packagePipeline,
@@ -18,7 +18,7 @@ import { generate } from "./generate";
 
 export type { PackageOptions, PackageResult };
 
-const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const pkgDir = dirname(moduleSourceDir(import.meta.url));
 
 /**
  * Map intrinsic name to its ARM output key.

package/src/deploy-scopes.ts

@@ -14,6 +14,7 @@
 import { readFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
 
 export type DeployScope = "resourceGroup" | "subscription" | "managementGroup" | "tenant";
@@ -94,7 +95,7 @@ let _cached: Map<string, DeployScope[]> | undefined;
  */
 function moduleDir(): string | undefined {
   try {
-    return dirname(fileURLToPath(import.meta.url));
+    return moduleSourceDir(import.meta.url);
   } catch {
     return undefined;
   }

package/src/generated/index.d.ts

@@ -4232,7 +4232,12 @@ export declare class containerApps {
     /** Resource tags. */
     tags?: Record<string, unknown>;
   }, attributes?: ArmResourceAttributes);
+  readonly configuration_ingress_fqdn: string;
   readonly id: string;
+  readonly latestRevisionFqdn: string;
+  readonly latestRevisionName: string;
+  readonly outboundIpAddresses: string[];
+  readonly provisioningState: string;
 }
 
 export declare class containerApps_authConfigs {

package/src/generated/index.ts

@@ -314,7 +314,7 @@ export const connections_flows = /* @__PURE__ */ createResource("Microsoft.Azure
 export const connectors = /* @__PURE__ */ createResource("Microsoft.Workloads/connectors", "azure", {"id":"id"});
 export const connectors_acssBackups = /* @__PURE__ */ createResource("Microsoft.Workloads/connectors_acssBackups", "azure", {"id":"id"});
 export const Consumptionbudgets = /* @__PURE__ */ createResource("Microsoft.Consumption/budgets", "azure", {"id":"id"});
-export const containerApps = /* @__PURE__ */ createResource("Microsoft.App/containerApps", "azure", {"id":"id"});
+export const containerApps = /* @__PURE__ */ createResource("Microsoft.App/containerApps", "azure", {"id":"id","configuration_ingress_fqdn":"configuration.ingress.fqdn","latestRevisionFqdn":"latestRevisionFqdn","latestRevisionName":"latestRevisionName","outboundIpAddresses":"outboundIpAddresses","provisioningState":"provisioningState"});
 export const containerApps_authConfigs = /* @__PURE__ */ createResource("Microsoft.App/containerApps_authConfigs", "azure", {"id":"id"});
 export const containerApps_resiliencyPolicies = /* @__PURE__ */ createResource("Microsoft.App/containerApps_resiliencyPolicies", "azure", {"id":"id"});
 export const containerApps_sourcecontrols = /* @__PURE__ */ createResource("Microsoft.App/containerApps_sourcecontrols", "azure", {"id":"id"});

package/src/generated/lexicon-azure.json

@@ -33235,7 +33235,12 @@
     "lexicon": "azure",
     "apiVersion": "2025-02-02-preview",
     "attrs": {
-      "id": "id"
+      "id": "id",
+      "configuration_ingress_fqdn": "configuration.ingress.fqdn",
+      "latestRevisionFqdn": "latestRevisionFqdn",
+      "latestRevisionName": "latestRevisionName",
+      "outboundIpAddresses": "outboundIpAddresses",
+      "provisioningState": "provisioningState"
     },
     "propertyConstraints": {
       "kind": {

package/src/health.test.ts

@@ -0,0 +1,66 @@
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { appRunningStatusEntry, containerAppEntry, observeHealthAzure } from "./health";
+import type { AzHttp } from "./op/activities/az-apply";
+
+const AT = "2026-10-20T21:00:00.000Z";
+const now = () => new Date(AT);
+const entities = new Map([["web", { entityType: "Microsoft.App/containerApps", props: { name: "web-app" } }]]);
+
+describe("azure health (#4177)", () => {
+  let saved: string | undefined;
+  beforeEach(() => {
+    saved = process.env.AZURE_ENDPOINT_URL;
+    process.env.AZURE_ENDPOINT_URL = "http://localhost:4577";
+  });
+  afterEach(() => {
+    if (saved === undefined) delete process.env.AZURE_ENDPOINT_URL;
+    else process.env.AZURE_ENDPOINT_URL = saved;
+  });
+
+  test("judges the active revisions", () => {
+    const rev = (runningState: string, extra: Record<string, unknown> = {}) => ({
+      name: "web-app--r1",
+      properties: { active: true, runningState, replicas: 2, trafficWeight: 100, ...extra },
+    });
+    expect(containerAppEntry([rev("Running")], AT)).toMatchObject({ state: "healthy", detail: "web-app--r1 Running, 2 replica(s), 100% traffic" });
+    expect(containerAppEntry([rev("Running", { healthState: "Unhealthy" })], AT).state).toBe("unhealthy");
+    expect(containerAppEntry([rev("Failed")], AT).state).toBe("unhealthy");
+    expect(containerAppEntry([rev("Processing")], AT).state).toBe("unknown");
+    expect(containerAppEntry([{ name: "old", properties: { active: false, runningState: "Running" } }], AT)).toMatchObject({
+      state: "unhealthy",
+      detail: "no active revision (1 revision(s))",
+    });
+  });
+
+  test("the app's runningStatus answers when revisions cannot be listed", () => {
+    expect(appRunningStatusEntry("Running", AT).state).toBe("healthy");
+    expect(appRunningStatusEntry("Stopped", AT).state).toBe("unhealthy");
+  });
+
+  test("reads the app, then its revisions, at the endpoint override", async () => {
+    const urls: string[] = [];
+    const http: AzHttp = async (_method, url) => {
+      urls.push(url);
+      if (url.includes("/revisions")) {
+        return { status: 200, text: JSON.stringify({ value: [{ name: "web-app--r1", properties: { active: true, runningState: "Running", replicas: 1 } }] }) };
+      }
+      return { status: 200, text: JSON.stringify({ id: "/x", properties: {} }) };
+    };
+    const r = await observeHealthAzure({ environment: "rg", buildOutput: "", entities, http, now });
+    expect(r.entities.web).toMatchObject({ state: "healthy", observedAt: AT });
+    expect(urls[1]).toBe(
+      "http://localhost:4577/subscriptions/00000000-0000-0000-0000-000000000001/resourceGroups/rg/providers/Microsoft.App/containerApps/web-app/revisions?api-version=2024-03-01",
+    );
+  });
+
+  test("a 404 app is absent; an unreadable revisions list with no runningStatus is a hole", async () => {
+    const notFound: AzHttp = async () => ({ status: 404, text: JSON.stringify({ error: { code: "ResourceNotFound", message: "gone" } }) });
+    expect((await observeHealthAzure({ environment: "rg", buildOutput: "", entities, http: notFound })).absent).toEqual(["web"]);
+
+    const noRevisions: AzHttp = async (_m, url) =>
+      url.includes("/revisions") ? { status: 404, text: "" } : { status: 200, text: JSON.stringify({ id: "/x", properties: {} }) };
+    const r = await observeHealthAzure({ environment: "rg", buildOutput: "", entities, http: noRevisions });
+    expect(r.entities).toEqual({});
+    expect(r.unobserved.web?.reason).toBe("read-failed");
+  });
+});

package/src/health.ts

@@ -0,0 +1,162 @@
+/**
+ * Runtime health for Azure (#4177): Container Apps.
+ *
+ * For each declared `Microsoft.App/containerApps`, GET the app (a 404 is
+ * absent), then its revisions, and judge the active ones by their running and
+ * health state. Same transport and endpoint rule as `describe-resources.ts`, so
+ * `AZURE_ENDPOINT_URL` (floci-az) answers.
+ *
+ * When the revisions list cannot be read but the app carries a
+ * `runningStatus` (newer API versions do), that answers instead, and the detail
+ * says so.
+ */
+
+import type { HealthEntry, HealthReadOptions, HealthReadResult, UnobservedEntity } from "@intentius/chant/lexicon";
+import { armResourceReadUrl, AzureReadError, getResource, isNotFound, type AzureReadClientOptions } from "./api/read-client";
+import { classifyArmFailure } from "./describe-resources";
+import type { AzHttp } from "./op/activities/az-apply";
+
+export const AZURE_HEALTH_TYPES = ["Microsoft.App/containerApps"] as const;
+
+/** The Container Apps API version whose revisions carry `runningState` and `healthState`. */
+const CONTAINER_APPS_API_VERSION = "2024-03-01";
+
+export interface AzureHealthOptions extends HealthReadOptions {
+  http?: AzHttp;
+  now?: () => Date;
+}
+
+/** The fields of one revision that decide health. */
+export interface RevisionState {
+  name?: string;
+  properties?: {
+    active?: boolean;
+    runningState?: string;
+    healthState?: string;
+    replicas?: number;
+    trafficWeight?: number;
+    lastActiveTime?: string;
+    createdTime?: string;
+  };
+}
+
+const RUNNING = new Set(["running", "runningatmaxscale"]);
+const DOWN = new Set(["failed", "degraded", "stopped"]);
+
+/**
+ * The active revisions' verdict: unhealthy if none is active or any active one
+ * failed, degraded, stopped or reports `Unhealthy`; healthy if every active one
+ * is running and none is unhealthy; otherwise unknown (still provisioning).
+ */
+export function containerAppEntry(revisions: RevisionState[], observedAt: string): HealthEntry {
+  const type = "Microsoft.App/containerApps";
+  const active = revisions.filter((r) => r.properties?.active === true);
+  if (active.length === 0) {
+    return { type, state: "unhealthy", detail: `no active revision (${revisions.length} revision(s))`, observedAt };
+  }
+  const describe = (r: RevisionState): string => {
+    const p = r.properties ?? {};
+    const bits = [p.runningState ?? "no running state"];
+    if (p.healthState && p.healthState !== "None") bits.push(p.healthState);
+    if (typeof p.replicas === "number") bits.push(`${p.replicas} replica(s)`);
+    if (typeof p.trafficWeight === "number") bits.push(`${p.trafficWeight}% traffic`);
+    return `${r.name ?? "revision"} ${bits.join(", ")}`;
+  };
+  const detail = active.map(describe).join("; ");
+  const running = (r: RevisionState) => RUNNING.has((r.properties?.runningState ?? "").toLowerCase());
+  const down = (r: RevisionState) =>
+    DOWN.has((r.properties?.runningState ?? "").toLowerCase()) || r.properties?.healthState?.toLowerCase() === "unhealthy";
+  const checkedAt = active
+    .map((r) => r.properties?.lastActiveTime ?? r.properties?.createdTime)
+    .filter((t): t is string => typeof t === "string")
+    .sort()
+    .pop();
+  const state = active.some(down) ? "unhealthy" : active.every(running) ? "healthy" : "unknown";
+  return { type, state, detail, observedAt, ...(checkedAt ? { checkedAt } : {}) };
+}
+
+/** An app's own `runningStatus`, for when its revisions cannot be listed. */
+export function appRunningStatusEntry(runningStatus: string, observedAt: string): HealthEntry {
+  const lower = runningStatus.toLowerCase();
+  const state = RUNNING.has(lower) ? "healthy" : DOWN.has(lower) ? "unhealthy" : "unknown";
+  return {
+    type: "Microsoft.App/containerApps",
+    state,
+    detail: `app runningStatus ${runningStatus} (revisions not readable)`,
+    observedAt,
+  };
+}
+
+function hole(err: unknown): UnobservedEntity {
+  const { reason, detail } = classifyArmFailure(err);
+  return { type: "Microsoft.App/containerApps", reason, detail };
+}
+
+async function listRevisions(client: AzureReadClientOptions, name: string): Promise<RevisionState[]> {
+  const http = client.http!;
+  const url = armResourceReadUrl(client, "Microsoft.App/containerApps", `${name}/revisions`, CONTAINER_APPS_API_VERSION);
+  const res = await http("GET", url, undefined, client.signal);
+  if (res.status >= 300) throw new AzureReadError(`revisions read failed with HTTP ${res.status}`, res.status);
+  let body: unknown;
+  try {
+    body = JSON.parse(res.text);
+  } catch {
+    throw new AzureReadError("unparseable revisions list", res.status);
+  }
+  const value = body && typeof body === "object" ? (body as { value?: unknown }).value : undefined;
+  if (!Array.isArray(value)) throw new AzureReadError("unparseable revisions list", res.status);
+  return value as RevisionState[];
+}
+
+const defaultHttp: AzHttp = async (method, url, body, signal) => {
+  const res = await fetch(url, {
+    method,
+    headers: body === undefined ? undefined : { "content-type": "application/json" },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal,
+  });
+  return { status: res.status, text: await res.text() };
+};
+
+export async function observeHealthAzure(options: AzureHealthOptions): Promise<HealthReadResult> {
+  const observedAt = (options.now?.() ?? new Date()).toISOString();
+  const client: AzureReadClientOptions = {
+    resourceGroup: options.environment,
+    ...(process.env.AZURE_ENDPOINT_URL ? { endpoint: process.env.AZURE_ENDPOINT_URL } : {}),
+    ...(process.env.AZURE_SUBSCRIPTION_ID ? { subscriptionId: process.env.AZURE_SUBSCRIPTION_ID } : {}),
+    http: options.http ?? defaultHttp,
+  };
+  const entities: Record<string, HealthEntry> = {};
+  const unobserved: Record<string, UnobservedEntity> = {};
+  const absent: string[] = [];
+
+  await Promise.all(
+    [...options.entities].map(async ([entityName, { entityType, props }]) => {
+      const name = props.name as string | undefined;
+      if (!name) {
+        unobserved[entityName] = { type: entityType, reason: "read-failed", detail: "declared entity has no name to query by" };
+        return;
+      }
+      let app: Awaited<ReturnType<typeof getResource>>;
+      try {
+        app = await getResource(client, entityType, name, CONTAINER_APPS_API_VERSION);
+      } catch (err) {
+        if (isNotFound(err)) absent.push(entityName);
+        else unobserved[entityName] = hole(err);
+        return;
+      }
+      try {
+        entities[entityName] = containerAppEntry(await listRevisions(client, name), observedAt);
+      } catch (err) {
+        const runningStatus = app.properties?.runningStatus;
+        if (typeof runningStatus === "string" && runningStatus.length > 0) {
+          entities[entityName] = appRunningStatusEntry(runningStatus, observedAt);
+        } else {
+          unobserved[entityName] = hole(err);
+        }
+      }
+    }),
+  );
+
+  return { entities, unobserved, absent };
+}

package/src/lint/post-synth/arm-refs.ts

@@ -76,17 +76,19 @@ export function isBracketExpression(value: unknown): boolean {
  *
  * Handles:
  * - [resourceId('Type', 'name')]  -> extracts 'name'
+ * - [resourceId('Type', 'a', 'b')] -> extracts 'a/b'
  * - [reference('name')]           -> extracts 'name'
  * - [reference('name').prop]      -> extracts 'name'
  */
 export function extractRefsFromExpression(expr: string): string[] {
   const refs: string[] = [];
 
-  // Match resourceId('...', 'name') — extract the last quoted argument (the resource name)
-  const resourceIdPattern = /resourceId\s*\([^)]*,\s*'([^']+)'\s*\)/g;
+  // Match resourceId('Type', 'name', ...): the name is every quoted argument
+  // after the type, joined with "/" for a child resource ('vnet', 'subnet').
+  const resourceIdPattern = /resourceId\s*\(\s*'[^']+'((?:\s*,\s*'[^']+')+)\s*\)/g;
   let match: RegExpExecArray | null;
   while ((match = resourceIdPattern.exec(expr)) !== null) {
-    refs.push(match[1]);
+    refs.push([...match[1].matchAll(/'([^']+)'/g)].map((m) => m[1]).join("/"));
   }
 
   // Match reference('name') — extract the name

package/src/lint/post-synth/post-synth.test.ts

@@ -33,7 +33,7 @@ describe("findArmResourceRefs", () => {
     const refs = findArmResourceRefs({
       subnet: "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'myVnet', 'mySubnet')]",
     });
-    expect(refs.has("mySubnet")).toBe(true);
+    expect(refs.has("myVnet/mySubnet")).toBe(true);
   });
 
   test("extracts reference targets", () => {

package/src/lsp/completions.ts

@@ -1,7 +1,8 @@
 import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
 import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
 import { LexiconIndex, lexiconCompletions, type LexiconEntry } from "@intentius/chant/lsp/lexicon-providers";
-const require = createRequire(import.meta.url);
+const require = createRequire(moduleSourceUrl(import.meta.url));
 
 let cachedIndex: LexiconIndex | null = null;
 

package/src/lsp/hover.ts

@@ -1,7 +1,8 @@
 import { createRequire } from "module";
+import { moduleSourceUrl } from "@intentius/chant/module-source";
 import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
 import { LexiconIndex, lexiconHover, type LexiconEntry } from "@intentius/chant/lsp/lexicon-providers";
-const require = createRequire(import.meta.url);
+const require = createRequire(moduleSourceUrl(import.meta.url));
 
 let cachedIndex: LexiconIndex | null = null;
 

package/src/plugin.ts

@@ -13,6 +13,7 @@ import { createSkillsLoader } from "@intentius/chant/lexicon-plugin-helpers";
 import { readFileSync, readdirSync, existsSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
+import { moduleSourceDir } from "@intentius/chant/module-source";
 import { azureSerializer } from "./serializer";
 import { hardcodedLocationRule } from "./lint/rules/hardcoded-location";
 import { storageHttpsRule } from "./lint/rules/storage-https";
@@ -373,7 +374,7 @@ export const tags = defaultTags([
         required: ["query"],
       },
       handler: async (args: Record<string, unknown>) => {
-        const dir = dirname(fileURLToPath(import.meta.url));
+        const dir = moduleSourceDir(import.meta.url);
         try {
           const lexicon = JSON.parse(
             readFileSync(join(dir, "generated", "lexicon-azure.json"), "utf-8"),
@@ -398,7 +399,7 @@ export const tags = defaultTags([
         description: "All available Azure resource types",
         mimeType: "application/json",
         handler: async () => {
-          const dir = dirname(fileURLToPath(import.meta.url));
+          const dir = moduleSourceDir(import.meta.url);
           try {
             return readFileSync(join(dir, "generated", "lexicon-azure.json"), "utf-8");
           } catch {
@@ -485,6 +486,14 @@ export const tags = defaultTags([
   /** The noise rules the deep pass applies to both the live and declared trees. */
   deepNormalizationHooks: azureDeepNormalizationHooks,
 
+  /** Runtime health (#4177): Container Apps. Implementation in ./health.ts. */
+  healthTypes: ["Microsoft.App/containerApps"],
+
+  async observeHealth(options) {
+    const { observeHealthAzure } = await import("./health");
+    return observeHealthAzure(options);
+  },
+
   async exportResources(options) {
     const { exportResources } = await import("./export-resources");
     return exportResources(options);