@intentius/chant-lexicon-azure 0.124.31 → 0.124.33

package/dist/composites/storage-account.js

@@ -0,0 +1,59 @@
+/**
+ * StorageAccountSecure composite — Storage Account with security hardening.
+ *
+ * A higher-level construct that creates a Storage Account with
+ * HTTPS-only, encryption at rest, default-deny network rules, and TLS 1.2.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { StorageAccount } from "../generated/index.js";
+/**
+ * Create a StorageAccountSecure composite — returns a Storage Account
+ * resource with security best practices.
+ *
+ * @example
+ * ```ts
+ * import { StorageAccountSecure } from "@intentius/chant-lexicon-azure";
+ *
+ * const { storageAccount } = StorageAccountSecure({
+ *   name: "myappstorage01",
+ *   sku: "Standard_GRS",
+ *   tags: { environment: "production" },
+ * });
+ *
+ * export { storageAccount };
+ * ```
+ */
+export const StorageAccountSecure = Composite((props) => {
+    const { name, location = "[resourceGroup().location]", sku = "Standard_LRS", tags = {}, defaults, } = props;
+    const storageAccount = new StorageAccount(mergeDefaults({
+        name,
+        location,
+        tags: {
+            "managed-by": "chant",
+            ...tags,
+        },
+        sku: {
+            name: sku,
+        },
+        kind: "StorageV2",
+        supportsHttpsTrafficOnly: true,
+        minimumTlsVersion: "TLS1_2",
+        allowBlobPublicAccess: false,
+        encryption: {
+            services: {
+                blob: { enabled: true, keyType: "Account" },
+                file: { enabled: true, keyType: "Account" },
+                table: { enabled: true, keyType: "Account" },
+                queue: { enabled: true, keyType: "Account" },
+            },
+            keySource: "Microsoft.Storage",
+        },
+        networkAcls: {
+            bypass: "AzureServices",
+            defaultAction: "Deny",
+            ipRules: [],
+            virtualNetworkRules: [],
+        },
+    }, defaults?.storageAccount), { apiVersion: "2023-01-01" });
+    return { storageAccount };
+}, "StorageAccountSecure");

package/dist/composites/vm-linux.js

@@ -0,0 +1,139 @@
+/**
+ * VmLinux composite — Linux Virtual Machine + NIC + NSG + optional Public IP.
+ *
+ * A higher-level construct for deploying a Linux VM with SSH access,
+ * managed disk, and a Network Security Group.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { VirtualMachine, NetworkInterface, NetworkSecurityGroup, PublicIPAddress, } from "../generated/index.js";
+/**
+ * Create a VmLinux composite — returns a Linux VM, NIC, NSG,
+ * and optional Public IP.
+ *
+ * @example
+ * ```ts
+ * import { VmLinux } from "@intentius/chant-lexicon-azure";
+ *
+ * const { virtualMachine, nic, nsg, publicIpAddress } = VmLinux({
+ *   name: "my-vm",
+ *   vmSize: "Standard_B2s",
+ *   adminUsername: "azureuser",
+ *   sshPublicKey: "ssh-rsa AAAA...",
+ *   subnetId: "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'my-vnet', 'subnet-1')]",
+ *   publicIp: true,
+ * });
+ *
+ * export { virtualMachine, nic, nsg, publicIpAddress };
+ * ```
+ */
+export const VmLinux = Composite((props) => {
+    const { name, vmSize, adminUsername, sshPublicKey, subnetId, location = "[resourceGroup().location]", publicIp = false, tags = {}, defaults, } = props;
+    const commonTags = {
+        "managed-by": "chant",
+        ...tags,
+    };
+    const nsgName = `${name}-nsg`;
+    const nicName = `${name}-nic`;
+    const pipName = `${name}-pip`;
+    const nsg = new NetworkSecurityGroup(mergeDefaults({
+        name: nsgName,
+        location,
+        tags: commonTags,
+        securityRules: [
+            {
+                name: "AllowSSH",
+                properties: {
+                    priority: 1000,
+                    direction: "Inbound",
+                    access: "Allow",
+                    protocol: "Tcp",
+                    sourcePortRange: "*",
+                    destinationPortRange: "22",
+                    sourceAddressPrefix: "*",
+                    destinationAddressPrefix: "*",
+                },
+            },
+        ],
+    }, defaults?.nsg), { apiVersion: "2023-05-01" });
+    const ipConfiguration = {
+        name: "ipconfig1",
+        properties: {
+            privateIPAllocationMethod: "Dynamic",
+            subnet: {
+                id: subnetId,
+            },
+            ...(publicIp && {
+                publicIPAddress: {
+                    id: `[resourceId('Microsoft.Network/publicIPAddresses', '${pipName}')]`,
+                },
+            }),
+        },
+    };
+    const nic = new NetworkInterface(mergeDefaults({
+        name: nicName,
+        location,
+        tags: commonTags,
+        ipConfigurations: [ipConfiguration],
+        networkSecurityGroup: {
+            id: `[resourceId('Microsoft.Network/networkSecurityGroups', '${nsgName}')]`,
+        },
+    }, defaults?.nic), { apiVersion: "2023-05-01" });
+    const virtualMachine = new VirtualMachine(mergeDefaults({
+        name,
+        location,
+        tags: commonTags,
+        hardwareProfile: {
+            vmSize,
+        },
+        osProfile: {
+            computerName: name,
+            adminUsername,
+            linuxConfiguration: {
+                disablePasswordAuthentication: true,
+                ssh: {
+                    publicKeys: [
+                        {
+                            path: `/home/${adminUsername}/.ssh/authorized_keys`,
+                            keyData: sshPublicKey,
+                        },
+                    ],
+                },
+            },
+        },
+        storageProfile: {
+            imageReference: {
+                publisher: "Canonical",
+                offer: "0001-com-ubuntu-server-jammy",
+                sku: "22_04-lts-gen2",
+                version: "latest",
+            },
+            osDisk: {
+                createOption: "FromImage",
+                managedDisk: {
+                    storageAccountType: "Premium_LRS",
+                },
+            },
+        },
+        networkProfile: {
+            networkInterfaces: [
+                {
+                    id: `[resourceId('Microsoft.Network/networkInterfaces', '${nicName}')]`,
+                },
+            ],
+        },
+    }, defaults?.virtualMachine), { apiVersion: "2023-07-01" });
+    const result = { virtualMachine, nic, nsg };
+    if (publicIp) {
+        result.publicIpAddress = new PublicIPAddress(mergeDefaults({
+            name: pipName,
+            location,
+            tags: commonTags,
+            sku: {
+                name: "Standard",
+            },
+            publicIPAllocationMethod: "Static",
+            publicIPAddressVersion: "IPv4",
+        }, defaults?.publicIpAddress), { apiVersion: "2023-05-01" });
+    }
+    return result;
+}, "VmLinux");

package/dist/composites/vnet-default.js

@@ -0,0 +1,102 @@
+/**
+ * VnetDefault composite — Virtual Network + Subnets + NSG + Route Table.
+ *
+ * A higher-level construct for a standard Azure virtual network with
+ * two subnets, a Network Security Group, and a Route Table.
+ */
+import { Composite, mergeDefaults } from "@intentius/chant";
+import { VirtualNetwork, Subnet, NetworkSecurityGroup, RouteTable, } from "../generated/index.js";
+/**
+ * Create a VnetDefault composite — returns a Virtual Network,
+ * two Subnets, an NSG, and a Route Table.
+ *
+ * @example
+ * ```ts
+ * import { VnetDefault } from "@intentius/chant-lexicon-azure";
+ *
+ * const { virtualNetwork, subnet1, subnet2, nsg, routeTable } = VnetDefault({
+ *   name: "my-vnet",
+ *   addressPrefix: "10.0.0.0/16",
+ *   subnetPrefixes: ["10.0.1.0/24", "10.0.2.0/24"],
+ * });
+ *
+ * export { virtualNetwork, subnet1, subnet2, nsg, routeTable };
+ * ```
+ */
+export const VnetDefault = Composite((props) => {
+    const { name, addressPrefix = "10.0.0.0/16", subnetPrefixes = ["10.0.1.0/24", "10.0.2.0/24"], location = "[resourceGroup().location]", tags = {}, defaults, } = props;
+    const commonTags = {
+        "managed-by": "chant",
+        ...tags,
+    };
+    const nsgName = `${name}-nsg`;
+    const routeTableName = `${name}-rt`;
+    const nsg = new NetworkSecurityGroup(mergeDefaults({
+        name: nsgName,
+        location,
+        tags: commonTags,
+        securityRules: [],
+    }, defaults?.nsg), { apiVersion: "2023-05-01" });
+    const routeTable = new RouteTable(mergeDefaults({
+        name: routeTableName,
+        location,
+        tags: commonTags,
+        disableBgpRoutePropagation: false,
+        routes: [],
+    }, defaults?.routeTable), { apiVersion: "2023-05-01" });
+    const subnet1 = new Subnet(mergeDefaults({
+        name: `${name}/subnet-1`,
+        addressPrefix: subnetPrefixes[0],
+        networkSecurityGroup: {
+            id: `[resourceId('Microsoft.Network/networkSecurityGroups', '${nsgName}')]`,
+        },
+        routeTable: {
+            id: `[resourceId('Microsoft.Network/routeTables', '${routeTableName}')]`,
+        },
+    }, defaults?.subnet1), { apiVersion: "2023-05-01" });
+    const subnet2 = new Subnet(mergeDefaults({
+        name: `${name}/subnet-2`,
+        addressPrefix: subnetPrefixes[1],
+        networkSecurityGroup: {
+            id: `[resourceId('Microsoft.Network/networkSecurityGroups', '${nsgName}')]`,
+        },
+        routeTable: {
+            id: `[resourceId('Microsoft.Network/routeTables', '${routeTableName}')]`,
+        },
+    }, defaults?.subnet2), { apiVersion: "2023-05-01" });
+    const virtualNetwork = new VirtualNetwork(mergeDefaults({
+        name,
+        location,
+        tags: commonTags,
+        addressSpace: {
+            addressPrefixes: [addressPrefix],
+        },
+        subnets: [
+            {
+                name: "subnet-1",
+                properties: {
+                    addressPrefix: subnetPrefixes[0],
+                    networkSecurityGroup: {
+                        id: `[resourceId('Microsoft.Network/networkSecurityGroups', '${nsgName}')]`,
+                    },
+                    routeTable: {
+                        id: `[resourceId('Microsoft.Network/routeTables', '${routeTableName}')]`,
+                    },
+                },
+            },
+            {
+                name: "subnet-2",
+                properties: {
+                    addressPrefix: subnetPrefixes[1],
+                    networkSecurityGroup: {
+                        id: `[resourceId('Microsoft.Network/networkSecurityGroups', '${nsgName}')]`,
+                    },
+                    routeTable: {
+                        id: `[resourceId('Microsoft.Network/routeTables', '${routeTableName}')]`,
+                    },
+                },
+            },
+        ],
+    }, defaults?.virtualNetwork), { apiVersion: "2023-05-01" });
+    return { virtualNetwork, subnet1, subnet2, nsg, routeTable };
+}, "VnetDefault");

package/dist/coverage.js

@@ -0,0 +1,28 @@
+/**
+ * Azure lexicon coverage analysis.
+ */
+import { computeCoverage, formatSummary, formatVerbose, checkThresholds, } from "@intentius/chant/codegen/coverage";
+import { readFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+export { computeCoverage, overallPct, formatSummary, formatVerbose, checkThresholds, } from "@intentius/chant/codegen/coverage";
+export async function analyzeAzureCoverage(opts) {
+    const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+    const lexiconPath = join(pkgDir, "src", "generated", "lexicon-azure.json");
+    const content = readFileSync(lexiconPath, "utf-8");
+    const report = computeCoverage(content);
+    if (opts?.verbose) {
+        console.log(formatVerbose(report));
+    }
+    else {
+        console.log(formatSummary(report));
+    }
+    if (typeof opts?.minOverall === "number") {
+        const result = checkThresholds(report, { minOverallPct: opts.minOverall });
+        if (!result.ok) {
+            for (const v of result.violations)
+                console.error(`  FAIL: ${v}`);
+            throw new Error("Coverage below threshold");
+        }
+    }
+}

package/dist/deep-observe.js

@@ -0,0 +1,356 @@
+/**
+ * Azure deep observation (#1086) — the azure row of the deep-observe contract
+ * (#1014).
+ *
+ * `az resource show --resource-group <env> --name <name> --resource-type
+ * <type> -o json` already returns the full ARM resource — the same call the
+ * thin path (./describe-resources.ts) makes, which keeps `provisioningState`
+ * (as `status`) plus `location`/`tags`. The depth is free; the work is
+ * entirely normalization, per the issue.
+ *
+ * ## Why the live tree is flattened, not passed through raw
+ *
+ * Unlike AWS (whose declared props mirror CloudFormation's vocabulary 1:1, so
+ * the Cloud Control payload normalizes and diffs as-is), chant's Azure
+ * resource classes do not mirror the ARM response shape verbatim: codegen
+ * (`spec/parse.ts`'s `RESOURCE_LEVEL_FIELDS` pass) flattens ARM's `properties`
+ * wrapper onto the constructor's top level, so a storage account's declared
+ * `minimumTlsVersion` is a sibling of `location`/`tags`, not nested under a
+ * `properties` key. Passing the raw `az resource show` response through
+ * unflattened would make `properties.minimumTlsVersion` a path with no
+ * declared counterpart, ever — the same permanent-noise problem AWS avoids by
+ * having a vocabulary match to begin with. So this reader flattens
+ * `properties.*` up to the same top level chant's generated classes use,
+ * alongside the resource-level fields (`name`, `location`, `sku`, `kind`,
+ * `identity`, `tags`, `zones`, `plan`) ARM returns as siblings of `properties`.
+ *
+ * `id`, `type`, `etag` and `systemData` are the one thing that's *not*
+ * flattened in — they have no declared counterpart of any kind (chant's
+ * codegen skips `type`/`apiVersion` explicitly, and `id`/`etag`/`systemData`
+ * are pure ARM-envelope bookkeeping), so they are simply never read into the
+ * tree, the same way `type`/`physicalId` live outside `properties` on {@link
+ * DeepResourceObservation} rather than inside it.
+ *
+ * ## Scope
+ *
+ * Same as the thin path: any top-level ARM type (`Microsoft.<provider>/<kind>`,
+ * exactly one `/`) is readable; a nested compound type
+ * (`Microsoft.Storage/storageAccounts/blobServices`) is `unsupported-kind`,
+ * because `az resource show` does not accept a compound type name either.
+ * Deferred, not fixed, here — same as the issue's own "worth fixing here or
+ * explicitly deferring" — widening it is additive and needs no contract change.
+ *
+ * ## Nothing here talks to real Azure on its own terms
+ *
+ * ARM over the applier's own transport (`./api/read-client.ts`), exactly like
+ * the thin path (#1212) — no CLI, no ARM SDK, no ambient token. The payload is
+ * the same ARM JSON `az resource show` was relaying, so the normalization below
+ * is untouched by the move.
+ */
+import { boundedConcurrently } from "@intentius/chant/observation";
+import { getResource, isNotFound } from "./api/read-client.js";
+import { LEGACY_OWNERSHIP_TAG_KEY } from "./op/activities/az-apply.js";
+import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
+import { OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
+import { classifyArmFailure, isTopLevelType } from "./describe-resources.js";
+import { isBracketExpression } from "./lint/post-synth/arm-refs.js";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership.js";
+/**
+ * Reshape one `az resource show` response into chant's own flat declared
+ * vocabulary: the resource-level fields ARM returns as siblings of
+ * `properties`, plus every `properties.*` field spread onto that same top
+ * level (see the module doc). `id`/`type`/`etag`/`systemData` are envelope
+ * bookkeeping with no declared counterpart and are never read in at all.
+ *
+ * `queriedName` is the declared name the GET was addressed by. A child
+ * resource is declared as `vnet/subnet` while ARM answers with the leaf
+ * (`name: "subnet"`) — the same identity in two spellings, since the URL that
+ * returned 200 is the declared name. The leaf is folded back to the declared
+ * spelling; a name that is not the leaf of the query is kept as returned.
+ */
+function buildLiveProperties(obj, queriedName) {
+    const out = {};
+    if (obj.name !== undefined) {
+        out.name =
+            queriedName !== undefined && queriedName !== obj.name && queriedName.endsWith(`/${obj.name}`)
+                ? queriedName
+                : obj.name;
+    }
+    if (obj.location !== undefined)
+        out.location = obj.location;
+    if (obj.sku !== undefined)
+        out.sku = obj.sku;
+    if (obj.kind !== undefined)
+        out.kind = obj.kind;
+    if (obj.identity !== undefined)
+        out.identity = obj.identity;
+    if (obj.tags !== undefined)
+        out.tags = obj.tags;
+    if (obj.zones !== undefined)
+        out.zones = obj.zones;
+    if (obj.plan !== undefined)
+        out.plan = obj.plan;
+    if (obj.properties && typeof obj.properties === "object") {
+        for (const [k, v] of Object.entries(obj.properties)) {
+            if (v !== undefined)
+                out[k] = v;
+        }
+    }
+    return out;
+}
+// ── Noise rules (#1086) ──────────────────────────────────────────────────────
+/**
+ * Server-populated wherever they appear — matched on the final path segment,
+ * the same technique AWS's `AWS_READ_ONLY_NAMES` uses, because ARM repeats
+ * `provisioningState` at every resource-properties depth and a per-type list
+ * of full paths would be a maintenance trap. Deliberately excludes ambiguous
+ * names like `id`/`name`: a subnet's `properties.routeTable.id` is a declared
+ * cross-reference, and pruning it is how a normalization pass starts hiding
+ * real drift. (The resource's *own* envelope `id` is handled separately —
+ * see the module doc — precisely so this list never has to touch `id` at all.)
+ */
+export const AZURE_READ_ONLY_NAMES = new Set([
+    "provisioningState",
+    "resourceGuid",
+    "principalId",
+    "tenantId",
+    // The resource's own envelope etag never reaches the tree (see the module
+    // doc), but ARM also stamps one on every *nested* child — each security rule,
+    // each subnet — and nobody declares those.
+    "etag",
+]);
+/**
+ * Server-injected boilerplate no chant user ever declares nor could
+ * meaningfully override — Azure stamps every network security group with
+ * these regardless of what was requested, so unlike `AZURE_READ_ONLY_NAMES`
+ * this is dropped outright rather than compared.
+ */
+const AZURE_UNCONDITIONAL_PRUNE_NAMES = new Set(["defaultSecurityRules"]);
+/**
+ * Server-computed surfaces ARM fills in on its own (#1214, the AKS row of the
+ * CC round-trip): a managed cluster always comes back with `fqdn`,
+ * `currentKubernetesVersion` and `nodeResourceGroup` whether or not the
+ * declaration said anything about them. Unlike `AZURE_READ_ONLY_NAMES` these
+ * are counterpart-gated rather than pruned outright: `nodeResourceGroup` IS
+ * declarable at create time, so a declared value is still compared — only the
+ * purely server-filled appearance is noise. Sparse and evidence-based, like
+ * `AZURE_SERVICE_DEFAULTS`.
+ */
+export const AZURE_SERVER_COMPUTED_NAMES = new Set([
+    "currentKubernetesVersion",
+    "fqdn",
+    "nodeResourceGroup",
+]);
+/**
+ * ARM service defaults, per type, as index-erased property paths. Subtracted
+ * only where source never declared the property — cdk-real-drift's default
+ * subtraction, same as AWS's `AWS_SERVICE_DEFAULTS`. Sparse and evidence-based
+ * rather than exhaustive across 1900+ ARM types: widening this table is
+ * additive and needs no contract change.
+ */
+export const AZURE_SERVICE_DEFAULTS = {
+    "Microsoft.Storage/storageAccounts": {
+        minimumTlsVersion: "TLS1_2",
+    },
+};
+/** Arrays known to be ARM sets (server order is not authoring order), keyed by well-known ARM naming conventions. */
+const AZURE_SET_ARRAY_NAMES = new Set([
+    "securityRules",
+    "subnets",
+    "ipRules",
+    "virtualNetworkRules",
+    "addressPrefixes",
+    "dnsServers",
+    "zones",
+]);
+/**
+ * chant's own ownership marker, as tag paths (#1213 — the azure edition of
+ * AWS's #1301 correction). The serializer stamps `chant-stack`/`chant-env` from
+ * project config and `azApply` stamps the managed-by pair on every resource it
+ * PUTs, so a managed estate always carries them live while the declared
+ * *properties* the diff compares do not — chant reading its own signature back
+ * as drift. Counterpart-gated at the call site, so a source that declares one
+ * of these tags itself is still compared.
+ */
+const AZURE_OWNERSHIP_TAG_PATTERNS = new Set([
+    `tags.${AZURE_TAG_OWNERSHIP_KEYS.stack}`,
+    `tags.${AZURE_TAG_OWNERSHIP_KEYS.env}`,
+]);
+/**
+ * The managed-by pair is gated on the value as well: both keys always carry
+ * `"chant"` when chant wrote them, so `managed-by: terraform` appearing out of
+ * band still surfaces as the drift it is.
+ */
+const AZURE_MANAGED_BY_TAG_PATTERNS = new Set([
+    `tags.${AZURE_TAG_OWNERSHIP_KEYS.managedBy}`,
+    `tags.${LEGACY_OWNERSHIP_TAG_KEY}`,
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isEmptyRecord(value) {
+    return isRecord(value) && Object.keys(value).length === 0;
+}
+/** Stable JSON with sorted keys — the fallback ordering key for a set-like array without a `name` field. */
+function canonicalJson(value) {
+    return (JSON.stringify(value, (_k, v) => v && typeof v === "object" && !Array.isArray(v)
+        ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)))
+        : v) ?? "");
+}
+/** The final segment of an index-erased pattern (`properties.networkAcls.ipRules[]` → `ipRules`). */
+function lastSegment(pattern) {
+    const withoutIndex = pattern.replace(/\[\]$/, "");
+    const dot = withoutIndex.lastIndexOf(".");
+    return dot === -1 ? withoutIndex : withoutIndex.slice(dot + 1);
+}
+/**
+ * The azure lexicon's noise rules. Three classes, same as AWS: server-
+ * populated fields (by name, unconditional), controller-injected boilerplate
+ * (by name, unconditional), and ARM service defaults (gated on
+ * `counterpart === "absent"`) — plus tag-map defaults, which AWS has no
+ * equivalent for since its `Tags` is an array rather than a plain object (an
+ * ARM tag map's key order is already canonicalized unconditionally by core,
+ * since it is a plain object; only the *default empty map* needs a rule here).
+ */
+export const azureDeepNormalizationHooks = {
+    prune(node) {
+        const name = lastSegment(node.pattern);
+        if (AZURE_READ_ONLY_NAMES.has(name) || AZURE_UNCONDITIONAL_PRUNE_NAMES.has(name))
+            return true;
+        if (node.side !== "live" || node.counterpart !== "absent")
+            return false;
+        // ARM always returns *some* tag map; an empty one when nobody declared any
+        // tag at all is the default, not a finding.
+        if (node.pattern === "tags" && isEmptyRecord(node.value))
+            return true;
+        // A live `location` nobody declared is the effective placement, not drift:
+        // a child resource (a subnet) has no location property of its own to
+        // declare, and every top-level resource that CAN take one is declared with
+        // one (or with `[resourceGroup().location]`, which is a declared
+        // counterpart). Resource-level only — `pattern` is the exact top-level
+        // path, so a nested `.location` inside a declared property is untouched.
+        if (node.pattern === "location")
+            return true;
+        // A server-computed surface nobody declared is ARM doing its job, not
+        // drift (see the set's doc for why this is counterpart-gated).
+        if (AZURE_SERVER_COMPUTED_NAMES.has(name))
+            return true;
+        // chant's own ownership marker is not drift (see the sets' docs).
+        if (AZURE_OWNERSHIP_TAG_PATTERNS.has(node.pattern))
+            return true;
+        if (AZURE_MANAGED_BY_TAG_PATTERNS.has(node.pattern) && node.value === OWNERSHIP_MANAGED_BY_VALUE)
+            return true;
+        // ARM stamps a self-`id` on every element of a nested child collection —
+        // each security rule, each inline subnet. Only the element's *own* id
+        // (`securityRules[].id`, directly on the element): a declared
+        // cross-reference like `virtualNetworkRules[].id` has a counterpart and is
+        // still compared, and object-valued references (`routeTable.id`) never
+        // match the array-element shape.
+        if (node.pattern.endsWith("[].id"))
+            return true;
+        const defaults = AZURE_SERVICE_DEFAULTS[node.entityType];
+        if (!defaults || !Object.prototype.hasOwnProperty.call(defaults, node.pattern))
+            return false;
+        return canonicalJson(defaults[node.pattern]) === canonicalJson(node.value);
+    },
+    /**
+     * An ARM bracket-expression string (`"[resourceId(...)]"`) is an unevaluated
+     * reference: the applier resolves it at deploy time, so the live side holds
+     * the evaluated value and comparing the two is comparing a formula to its
+     * result. Collapsed to UNRESOLVED on the declared side only — a live payload
+     * cannot carry an unevaluated expression, and `[[`-escaped strings are ARM's
+     * own literal-`[` spelling, not expressions.
+     */
+    unresolved(node) {
+        return (node.side === "declared" &&
+            isBracketExpression(node.value) &&
+            !node.value.startsWith("[["));
+    },
+    /**
+     * The key doubles as a path segment (`securityRules[#allow-ssh]`), so a
+     * `name` field is the element's own identity where ARM gives one — which it
+     * does for essentially every nested rule/subnet/range collection — and
+     * canonical JSON only as a fallback for primitive-valued sets
+     * (`addressPrefixes`, `dnsServers`).
+     */
+    orderKey(element) {
+        const name = lastSegment(element.pattern);
+        if (!AZURE_SET_ARRAY_NAMES.has(name))
+            return undefined;
+        const el = element.element;
+        if (isRecord(el)) {
+            const key = typeof el.name === "string" ? el.name : undefined;
+            return key ?? canonicalJson(el);
+        }
+        return typeof el === "string" ? el : canonicalJson(el);
+    },
+};
+/**
+ * Read the live property tree for each declared entity via `az resource
+ * show`. One call per entity, same as the thin path — ARM has no bulk
+ * "describe everything in this group" call with per-resource depth the way
+ * CloudFormation's `describe-stack-resources` does, so there is no cheap
+ * list-then-describe split to make here the way AWS's own reader does.
+ */
+export async function observeResourcesDeepAzure(options) {
+    const resources = {};
+    const unobserved = {};
+    const readable = [];
+    const client = {
+        resourceGroup: options.environment,
+        ...(process.env.AZURE_ENDPOINT_URL ? { endpoint: process.env.AZURE_ENDPOINT_URL } : {}),
+        ...(process.env.AZURE_SUBSCRIPTION_ID ? { subscriptionId: process.env.AZURE_SUBSCRIPTION_ID } : {}),
+        ...(options.http ? { http: options.http } : {}),
+    };
+    for (const [entityName, { entityType, props }] of options.entities) {
+        if (!entityType.startsWith("Microsoft.")) {
+            unobserved[entityName] = {
+                type: entityType,
+                reason: "unsupported-kind",
+                detail: "not an ARM resource type (expected Microsoft.<provider>/<kind>)",
+            };
+            continue;
+        }
+        if (!isTopLevelType(entityType)) {
+            unobserved[entityName] = {
+                type: entityType,
+                reason: "unsupported-kind",
+                detail: "a nested ARM type needs a different read path; chant never queried this resource",
+            };
+            continue;
+        }
+        const name = props.name;
+        if (!name) {
+            unobserved[entityName] = {
+                type: entityType,
+                reason: "read-failed",
+                detail: "declared entity has no name to query by",
+            };
+            continue;
+        }
+        readable.push({ entityName, entityType, name });
+    }
+    await boundedConcurrently(readable, async ({ entityName, entityType, name }) => {
+        try {
+            const obj = (await getResource(client, entityType, name));
+            resources[entityName] = {
+                type: entityType,
+                physicalId: obj.id,
+                properties: normalizeDeepProperties(buildLiveProperties(obj, name), {
+                    entityType,
+                    side: "live",
+                    hooks: azureDeepNormalizationHooks,
+                }),
+            };
+        }
+        catch (err) {
+            // Not-found leaves the entity out (absence, same as the thin path).
+            // Auth/binding/other failures are holes so they can't become creates.
+            if (isNotFound(err))
+                return;
+            const outcome = classifyArmFailure(err);
+            unobserved[entityName] = { type: entityType, reason: outcome.reason, detail: outcome.detail };
+        }
+    });
+    return deepObservation(resources, unobserved);
+}