@intentius/chant-lexicon-azure 0.124.31 → 0.124.33

package/dist/generated/runtime.js

@@ -0,0 +1,4 @@
+/**
+ * Runtime factory constructors — re-exported from core.
+ */
+export { createResource, createProperty } from "@intentius/chant/runtime";

package/dist/governance.js

@@ -0,0 +1,144 @@
+/**
+ * Azure governance authoring: the desired-state config
+ * shape an external governance reconciler reconciles, and `landingZoneConfig()` — the
+ * typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven management-group tree walker cannot be one. The split mirrors
+ * the AWS/GCP slices (lexicons/{aws,gcp}/src/governance.ts): authoring emits
+ * config (this module, arbitrary cardinality); resources for greenfield
+ * bootstrap are the fixed-shape composites in `composites/landing-zone.ts`;
+ * the reconciler consumes only the config.
+ *
+ * Azure has no OrganizationRoot analog — the tenant and its root management
+ * group come from Entra ID, never from the resource API. Subscriptions the
+ * tree declares reconcile through Microsoft.Subscription/aliases (existing
+ * ids are placed, missing ones created from `billingScope`); aliases deploy
+ * at tenant scope only (#1545).
+ */
+// ---------------------------------------------------------------------------
+// Baseline guardrails (shared with the bootstrap composites)
+// ---------------------------------------------------------------------------
+export const DENY_CLASSIC_RESOURCES = {
+    description: "Classic (ASM) compute, network, and storage resources cannot be created.",
+    displayName: "Deny classic resources",
+    mode: "All",
+    policyRule: {
+        if: { field: "type", like: "Microsoft.Classic*" },
+        then: { effect: "deny" },
+    },
+};
+export const DENY_UNMANAGED_DISKS = {
+    description: "Virtual machines and scale sets must use managed disks.",
+    displayName: "Deny unmanaged disks",
+    mode: "All",
+    policyRule: {
+        if: {
+            anyOf: [
+                {
+                    allOf: [
+                        { field: "type", equals: "Microsoft.Compute/virtualMachines" },
+                        { field: "Microsoft.Compute/virtualMachines/osDisk.uri", exists: "true" },
+                    ],
+                },
+                {
+                    allOf: [
+                        { field: "type", equals: "Microsoft.Compute/virtualMachineScaleSets" },
+                        {
+                            anyOf: [
+                                { field: "Microsoft.Compute/VirtualMachineScaleSets/osDisk.vhdContainers", exists: "true" },
+                                { field: "Microsoft.Compute/VirtualMachineScaleSets/osdisk.imageUrl", exists: "true" },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        },
+        then: { effect: "deny" },
+    },
+};
+/** Allow resource creation only in `locations` ("global" is always excepted). */
+export function locationRestriction(locations) {
+    return {
+        description: `Resources may only be created in [${locations.join(", ")}].`,
+        displayName: "Allowed locations",
+        mode: "Indexed",
+        policyRule: {
+            if: {
+                allOf: [
+                    { field: "location", notIn: [...locations] },
+                    { field: "location", notEquals: "global" },
+                ],
+            },
+            then: { effect: "deny" },
+        },
+    };
+}
+/**
+ * The built-in DeployIfNotExists policy "Configure Azure Activity logs to
+ * stream to specified Log Analytics workspace" — the activity-log audit
+ * sink is wired by assigning it, not by declaring diagnostic settings in
+ * every subscription (Microsoft.Insights/diagnosticSettings is not in the
+ * generated surface, and the assignment covers future subscriptions too).
+ */
+export const ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID = "/providers/Microsoft.Authorization/policyDefinitions/2465583e-4e78-4c15-b6be-a36cbc7c8b0f";
+/**
+ * The recommended foundation management-group structure. Exported so
+ * callers can extend it rather than restate it.
+ */
+export const FOUNDATION_MANAGEMENT_GROUPS = {
+    Security: {},
+    Infrastructure: {},
+    Sandbox: {},
+    Workloads: {},
+};
+/**
+ * Author the desired-state tree an external governance reconciler reconciles. Pure.
+ * Throws when the tree assigns a policy name with no definition; only
+ * policies the tree actually assigns are included in the output.
+ */
+export function landingZoneConfig(props = {}) {
+    const foundation = props.foundation ?? true;
+    const policies = {
+        ...(foundation
+            ? { "deny-classic-resources": DENY_CLASSIC_RESOURCES, "deny-unmanaged-disks": DENY_UNMANAGED_DISKS }
+            : {}),
+        ...(props.allowedLocations?.length
+            ? { "location-restriction": locationRestriction(props.allowedLocations) }
+            : {}),
+        ...props.policies,
+    };
+    const managementGroups = { ...(foundation ? FOUNDATION_MANAGEMENT_GROUPS : {}), ...props.managementGroups };
+    const rootPolicies = [
+        ...(foundation ? ["deny-classic-resources", "deny-unmanaged-disks"] : []),
+        ...(props.allowedLocations?.length ? ["location-restriction"] : []),
+        ...(props.rootPolicies ?? []),
+    ];
+    const assigned = new Set(rootPolicies);
+    const collect = (tree) => {
+        for (const node of Object.values(tree)) {
+            for (const p of node.policies ?? [])
+                assigned.add(p);
+            if (node.children)
+                collect(node.children);
+        }
+    };
+    collect(managementGroups);
+    for (const name of assigned) {
+        if (!policies[name]) {
+            throw new Error(`landingZoneConfig: policy "${name}" is assigned but not defined in policies`);
+        }
+    }
+    return {
+        tenant: {
+            ...(rootPolicies.length ? { policies: rootPolicies } : {}),
+            ...(foundation ? { blockSubscriptionsLeavingTenant: true } : {}),
+        },
+        managementGroups,
+        policies: Object.fromEntries(Object.entries(policies).filter(([n]) => assigned.has(n))),
+        ...(props.activityLogWorkspaceId
+            ? { auditSinks: { activityLog: { workspaceId: props.activityLogWorkspaceId } } }
+            : {}),
+    };
+}

package/dist/health.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Runtime health for Azure (#4177): Container Apps.
+ *
+ * For each declared `Microsoft.App/containerApps`, GET the app (a 404 is
+ * absent), then its revisions, and judge the active ones by their running and
+ * health state. Same transport and endpoint rule as `describe-resources.ts`, so
+ * `AZURE_ENDPOINT_URL` (floci-az) answers.
+ *
+ * When the revisions list cannot be read but the app carries a
+ * `runningStatus` (newer API versions do), that answers instead, and the detail
+ * says so.
+ */
+import type { HealthEntry, HealthReadOptions, HealthReadResult } from "@intentius/chant/lexicon";
+import type { AzHttp } from "./op/activities/az-apply.js";
+export declare const AZURE_HEALTH_TYPES: readonly ["Microsoft.App/containerApps"];
+export interface AzureHealthOptions extends HealthReadOptions {
+    http?: AzHttp;
+    now?: () => Date;
+}
+/** The fields of one revision that decide health. */
+export interface RevisionState {
+    name?: string;
+    properties?: {
+        active?: boolean;
+        runningState?: string;
+        healthState?: string;
+        replicas?: number;
+        trafficWeight?: number;
+        lastActiveTime?: string;
+        createdTime?: string;
+    };
+}
+/**
+ * The active revisions' verdict: unhealthy if none is active or any active one
+ * failed, degraded, stopped or reports `Unhealthy`; healthy if every active one
+ * is running and none is unhealthy; otherwise unknown (still provisioning).
+ */
+export declare function containerAppEntry(revisions: RevisionState[], observedAt: string): HealthEntry;
+/** An app's own `runningStatus`, for when its revisions cannot be listed. */
+export declare function appRunningStatusEntry(runningStatus: string, observedAt: string): HealthEntry;
+export declare function observeHealthAzure(options: AzureHealthOptions): Promise<HealthReadResult>;
+//# sourceMappingURL=health.d.ts.map

package/dist/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AAGnH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,eAAO,MAAM,kBAAkB,YAAI,6BAA6B,CAAU,CAAC;AAK3E,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAKD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAyB7F;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAS5F;AAiCD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyC/F"}

package/dist/health.js

@@ -0,0 +1,137 @@
+/**
+ * Runtime health for Azure (#4177): Container Apps.
+ *
+ * For each declared `Microsoft.App/containerApps`, GET the app (a 404 is
+ * absent), then its revisions, and judge the active ones by their running and
+ * health state. Same transport and endpoint rule as `describe-resources.ts`, so
+ * `AZURE_ENDPOINT_URL` (floci-az) answers.
+ *
+ * When the revisions list cannot be read but the app carries a
+ * `runningStatus` (newer API versions do), that answers instead, and the detail
+ * says so.
+ */
+import { armResourceReadUrl, AzureReadError, getResource, isNotFound } from "./api/read-client.js";
+import { classifyArmFailure } from "./describe-resources.js";
+export const AZURE_HEALTH_TYPES = ["Microsoft.App/containerApps"];
+/** The Container Apps API version whose revisions carry `runningState` and `healthState`. */
+const CONTAINER_APPS_API_VERSION = "2024-03-01";
+const RUNNING = new Set(["running", "runningatmaxscale"]);
+const DOWN = new Set(["failed", "degraded", "stopped"]);
+/**
+ * The active revisions' verdict: unhealthy if none is active or any active one
+ * failed, degraded, stopped or reports `Unhealthy`; healthy if every active one
+ * is running and none is unhealthy; otherwise unknown (still provisioning).
+ */
+export function containerAppEntry(revisions, observedAt) {
+    const type = "Microsoft.App/containerApps";
+    const active = revisions.filter((r) => r.properties?.active === true);
+    if (active.length === 0) {
+        return { type, state: "unhealthy", detail: `no active revision (${revisions.length} revision(s))`, observedAt };
+    }
+    const describe = (r) => {
+        const p = r.properties ?? {};
+        const bits = [p.runningState ?? "no running state"];
+        if (p.healthState && p.healthState !== "None")
+            bits.push(p.healthState);
+        if (typeof p.replicas === "number")
+            bits.push(`${p.replicas} replica(s)`);
+        if (typeof p.trafficWeight === "number")
+            bits.push(`${p.trafficWeight}% traffic`);
+        return `${r.name ?? "revision"} ${bits.join(", ")}`;
+    };
+    const detail = active.map(describe).join("; ");
+    const running = (r) => RUNNING.has((r.properties?.runningState ?? "").toLowerCase());
+    const down = (r) => DOWN.has((r.properties?.runningState ?? "").toLowerCase()) || r.properties?.healthState?.toLowerCase() === "unhealthy";
+    const checkedAt = active
+        .map((r) => r.properties?.lastActiveTime ?? r.properties?.createdTime)
+        .filter((t) => typeof t === "string")
+        .sort()
+        .pop();
+    const state = active.some(down) ? "unhealthy" : active.every(running) ? "healthy" : "unknown";
+    return { type, state, detail, observedAt, ...(checkedAt ? { checkedAt } : {}) };
+}
+/** An app's own `runningStatus`, for when its revisions cannot be listed. */
+export function appRunningStatusEntry(runningStatus, observedAt) {
+    const lower = runningStatus.toLowerCase();
+    const state = RUNNING.has(lower) ? "healthy" : DOWN.has(lower) ? "unhealthy" : "unknown";
+    return {
+        type: "Microsoft.App/containerApps",
+        state,
+        detail: `app runningStatus ${runningStatus} (revisions not readable)`,
+        observedAt,
+    };
+}
+function hole(err) {
+    const { reason, detail } = classifyArmFailure(err);
+    return { type: "Microsoft.App/containerApps", reason, detail };
+}
+async function listRevisions(client, name) {
+    const http = client.http;
+    const url = armResourceReadUrl(client, "Microsoft.App/containerApps", `${name}/revisions`, CONTAINER_APPS_API_VERSION);
+    const res = await http("GET", url, undefined, client.signal);
+    if (res.status >= 300)
+        throw new AzureReadError(`revisions read failed with HTTP ${res.status}`, res.status);
+    let body;
+    try {
+        body = JSON.parse(res.text);
+    }
+    catch {
+        throw new AzureReadError("unparseable revisions list", res.status);
+    }
+    const value = body && typeof body === "object" ? body.value : undefined;
+    if (!Array.isArray(value))
+        throw new AzureReadError("unparseable revisions list", res.status);
+    return value;
+}
+const defaultHttp = async (method, url, body, signal) => {
+    const res = await fetch(url, {
+        method,
+        headers: body === undefined ? undefined : { "content-type": "application/json" },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal,
+    });
+    return { status: res.status, text: await res.text() };
+};
+export async function observeHealthAzure(options) {
+    const observedAt = (options.now?.() ?? new Date()).toISOString();
+    const client = {
+        resourceGroup: options.environment,
+        ...(process.env.AZURE_ENDPOINT_URL ? { endpoint: process.env.AZURE_ENDPOINT_URL } : {}),
+        ...(process.env.AZURE_SUBSCRIPTION_ID ? { subscriptionId: process.env.AZURE_SUBSCRIPTION_ID } : {}),
+        http: options.http ?? defaultHttp,
+    };
+    const entities = {};
+    const unobserved = {};
+    const absent = [];
+    await Promise.all([...options.entities].map(async ([entityName, { entityType, props }]) => {
+        const name = props.name;
+        if (!name) {
+            unobserved[entityName] = { type: entityType, reason: "read-failed", detail: "declared entity has no name to query by" };
+            return;
+        }
+        let app;
+        try {
+            app = await getResource(client, entityType, name, CONTAINER_APPS_API_VERSION);
+        }
+        catch (err) {
+            if (isNotFound(err))
+                absent.push(entityName);
+            else
+                unobserved[entityName] = hole(err);
+            return;
+        }
+        try {
+            entities[entityName] = containerAppEntry(await listRevisions(client, name), observedAt);
+        }
+        catch (err) {
+            const runningStatus = app.properties?.runningStatus;
+            if (typeof runningStatus === "string" && runningStatus.length > 0) {
+                entities[entityName] = appRunningStatusEntry(runningStatus, observedAt);
+            }
+            else {
+                unobserved[entityName] = hole(err);
+            }
+        }
+    }));
+    return { entities, unobserved, absent };
+}

package/dist/import/generator.js

@@ -0,0 +1,140 @@
+/**
+ * ARM template → TypeScript code generator.
+ *
+ * Converts intermediate representation to idiomatic chant TypeScript.
+ */
+import { loadLexiconRegistry } from "@intentius/chant/codegen/registry";
+import { createRequire } from "module";
+const require = createRequire(import.meta.url);
+import { join } from "path";
+/**
+ * TypeScript code generator for ARM templates.
+ */
+export class ArmGenerator {
+    constructor() {
+        this.typeToClass = new Map();
+        // Was a silent catch, which left this map empty and made the import emit
+        // `// Unknown resource type: Microsoft.…` — indistinguishable from a
+        // genuine coverage gap in the lexicon. A missing registry now says so
+        // (#1367).
+        const meta = loadLexiconRegistry(join(import.meta.dirname, "../.."), "azure");
+        for (const [className, entry] of Object.entries(meta)) {
+            if (entry.kind === "resource" && !className.includes("_")) {
+                this.typeToClass.set(entry.resourceType, className);
+            }
+        }
+    }
+    generate(ir) {
+        const lines = [];
+        // Collect imports
+        const importedClasses = new Set();
+        const importedIntrinsics = new Set();
+        let needsAzure = false;
+        for (const resource of ir.resources) {
+            const cls = this.typeToClass.get(resource.type);
+            if (cls)
+                importedClasses.add(cls);
+            // Check for Azure pseudo-parameters in values
+            if (this.hasAzurePseudo(resource.properties)) {
+                needsAzure = true;
+            }
+        }
+        if (ir.parameters.length > 0) {
+            // Parameters would need a Parameter import from core
+        }
+        // Build import statement
+        const symbols = [...importedClasses].sort();
+        if (importedIntrinsics.size > 0) {
+            symbols.push(...[...importedIntrinsics].sort());
+        }
+        if (needsAzure) {
+            symbols.push("Azure");
+        }
+        if (symbols.length > 0) {
+            lines.push(`import { ${symbols.join(", ")} } from "@intentius/chant-lexicon-azure";`);
+            lines.push("");
+        }
+        // Generate resources
+        for (const resource of ir.resources) {
+            const cls = this.typeToClass.get(resource.type);
+            const varName = this.toVarName(resource.logicalId);
+            if (cls) {
+                lines.push(`export const ${varName} = new ${cls}(${this.generateProps(resource.properties, 1)});`);
+            }
+            else {
+                lines.push(`// Unknown resource type: ${resource.type}`);
+                lines.push(`// export const ${varName} = new ${resource.type}(${this.generateProps(resource.properties, 1)});`);
+            }
+            lines.push("");
+        }
+        return [
+            {
+                path: "main.ts",
+                content: lines.join("\n") + "\n",
+            },
+        ];
+    }
+    toVarName(name) {
+        // Convert to camelCase
+        return name.charAt(0).toLowerCase() + name.slice(1);
+    }
+    generateProps(props, depth) {
+        if (!props || Object.keys(props).length === 0)
+            return "{}";
+        const indent = "  ".repeat(depth);
+        const innerIndent = "  ".repeat(depth + 1);
+        const entries = [];
+        for (const [key, value] of Object.entries(props)) {
+            entries.push(`${innerIndent}${key}: ${this.generateValue(value, depth + 1)},`);
+        }
+        return `{\n${entries.join("\n")}\n${indent}}`;
+    }
+    generateValue(value, depth) {
+        if (value === null || value === undefined)
+            return "undefined";
+        if (typeof value === "string")
+            return JSON.stringify(value);
+        if (typeof value === "number" || typeof value === "boolean")
+            return String(value);
+        if (Array.isArray(value)) {
+            if (value.length === 0)
+                return "[]";
+            const items = value.map((v) => this.generateValue(v, depth + 1));
+            return `[${items.join(", ")}]`;
+        }
+        if (typeof value === "object") {
+            const obj = value;
+            // Handle intrinsic markers
+            if ("__intrinsic" in obj) {
+                return this.generateIntrinsic(obj);
+            }
+            return this.generateProps(obj, depth);
+        }
+        return String(value);
+    }
+    generateIntrinsic(obj) {
+        const name = obj.__intrinsic;
+        switch (name) {
+            case "ResourceGroup":
+                return `Azure.ResourceGroup${obj.property?.charAt(0).toUpperCase()}${obj.property?.slice(1)}`;
+            case "Subscription":
+                return `Azure.SubscriptionId`;
+            case "Ref":
+                return obj.name;
+            case "ResourceId":
+                return `ResourceId(${obj.args.map((a) => JSON.stringify(a)).join(", ")})`;
+            case "Reference":
+                return `Reference(${obj.args.map((a) => JSON.stringify(a)).join(", ")})`;
+            case "Concat":
+                return `Concat(${obj.args.map((a) => JSON.stringify(a)).join(", ")})`;
+            case "UniqueString":
+                return `UniqueString(${obj.args.map((a) => JSON.stringify(a)).join(", ")})`;
+            default:
+                return JSON.stringify(obj);
+        }
+    }
+    hasAzurePseudo(props) {
+        const json = JSON.stringify(props);
+        return json.includes("resourceGroup()") || json.includes("subscription()");
+    }
+}

package/dist/import/live-export.js

@@ -0,0 +1,39 @@
+import { hasOwnershipMarker } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "../ownership.js";
+import { ArmParser } from "./parser.js";
+/**
+ * Map a live ARM template (from `az group export`) to full-fidelity export IR.
+ *
+ * `az group export --output json` returns an ARM template — either as a JSON
+ * object or, via the CLI, a JSON string. `ArmParser` already turns the template
+ * into `TemplateIR` — the same IR the static-import path uses — so the result
+ * feeds `ArmGenerator` (templateGenerator) unchanged. Pure: all I/O stays in
+ * the caller (`../export-resources`).
+ *
+ * Mirrors AWS `parseStackTemplate`. The one shape difference: ARM tags are a
+ * `Record<string,string>` map (not the `{Key,Value}[]` array CloudFormation
+ * uses), so the ownership filter reads `properties.tags` directly without
+ * `tagArrayToMap`, against the `azure-tag` channel (`chant-managed-by`).
+ */
+export function parseExportedTemplate(templateBody, selector, owned) {
+    const content = typeof templateBody === "string" ? templateBody : JSON.stringify(templateBody);
+    const ir = new ArmParser().parse(content);
+    const hasSelector = selector && (selector.type !== undefined || selector.name !== undefined);
+    if (!hasSelector && !owned)
+        return ir;
+    return {
+        ...ir,
+        resources: ir.resources.filter((r) => {
+            if (selector?.type !== undefined && r.type !== selector.type)
+                return false;
+            if (selector?.name !== undefined && r.logicalId !== selector.name)
+                return false;
+            if (owned) {
+                const tags = r.properties.tags;
+                if (!hasOwnershipMarker(tags, AZURE_TAG_OWNERSHIP_KEYS))
+                    return false;
+            }
+            return true;
+        }),
+    };
+}