@intentius/chant-lexicon-azure 0.124.32 → 0.124.34

package/dist/generated/index.js

@@ -313,7 +313,7 @@ export const connections_flows = /* @__PURE__ */ createResource("Microsoft.Azure
 export const connectors = /* @__PURE__ */ createResource("Microsoft.Workloads/connectors", "azure", { "id": "id" });
 export const connectors_acssBackups = /* @__PURE__ */ createResource("Microsoft.Workloads/connectors_acssBackups", "azure", { "id": "id" });
 export const Consumptionbudgets = /* @__PURE__ */ createResource("Microsoft.Consumption/budgets", "azure", { "id": "id" });
-export const containerApps = /* @__PURE__ */ createResource("Microsoft.App/containerApps", "azure", { "id": "id" });
+export const containerApps = /* @__PURE__ */ createResource("Microsoft.App/containerApps", "azure", { "id": "id", "configuration_ingress_fqdn": "configuration.ingress.fqdn", "latestRevisionFqdn": "latestRevisionFqdn", "latestRevisionName": "latestRevisionName", "outboundIpAddresses": "outboundIpAddresses", "provisioningState": "provisioningState" });
 export const containerApps_authConfigs = /* @__PURE__ */ createResource("Microsoft.App/containerApps_authConfigs", "azure", { "id": "id" });
 export const containerApps_resiliencyPolicies = /* @__PURE__ */ createResource("Microsoft.App/containerApps_resiliencyPolicies", "azure", { "id": "id" });
 export const containerApps_sourcecontrols = /* @__PURE__ */ createResource("Microsoft.App/containerApps_sourcecontrols", "azure", { "id": "id" });

package/dist/health.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Runtime health for Azure (#4177): Container Apps.
+ *
+ * For each declared `Microsoft.App/containerApps`, GET the app (a 404 is
+ * absent), then its revisions, and judge the active ones by their running and
+ * health state. Same transport and endpoint rule as `describe-resources.ts`, so
+ * `AZURE_ENDPOINT_URL` (floci-az) answers.
+ *
+ * When the revisions list cannot be read but the app carries a
+ * `runningStatus` (newer API versions do), that answers instead, and the detail
+ * says so.
+ */
+import type { HealthEntry, HealthReadOptions, HealthReadResult } from "@intentius/chant/lexicon";
+import type { AzHttp } from "./op/activities/az-apply.js";
+export declare const AZURE_HEALTH_TYPES: readonly ["Microsoft.App/containerApps"];
+export interface AzureHealthOptions extends HealthReadOptions {
+    http?: AzHttp;
+    now?: () => Date;
+}
+/** The fields of one revision that decide health. */
+export interface RevisionState {
+    name?: string;
+    properties?: {
+        active?: boolean;
+        runningState?: string;
+        healthState?: string;
+        replicas?: number;
+        trafficWeight?: number;
+        lastActiveTime?: string;
+        createdTime?: string;
+    };
+}
+/**
+ * The active revisions' verdict: unhealthy if none is active or any active one
+ * failed, degraded, stopped or reports `Unhealthy`; healthy if every active one
+ * is running and none is unhealthy; otherwise unknown (still provisioning).
+ */
+export declare function containerAppEntry(revisions: RevisionState[], observedAt: string): HealthEntry;
+/** An app's own `runningStatus`, for when its revisions cannot be listed. */
+export declare function appRunningStatusEntry(runningStatus: string, observedAt: string): HealthEntry;
+export declare function observeHealthAzure(options: AzureHealthOptions): Promise<HealthReadResult>;
+//# sourceMappingURL=health.d.ts.map

package/dist/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../src/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AAGnH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,eAAO,MAAM,kBAAkB,YAAI,6BAA6B,CAAU,CAAC;AAK3E,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAKD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAyB7F;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAS5F;AAiCD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyC/F"}

package/dist/health.js

@@ -0,0 +1,137 @@
+/**
+ * Runtime health for Azure (#4177): Container Apps.
+ *
+ * For each declared `Microsoft.App/containerApps`, GET the app (a 404 is
+ * absent), then its revisions, and judge the active ones by their running and
+ * health state. Same transport and endpoint rule as `describe-resources.ts`, so
+ * `AZURE_ENDPOINT_URL` (floci-az) answers.
+ *
+ * When the revisions list cannot be read but the app carries a
+ * `runningStatus` (newer API versions do), that answers instead, and the detail
+ * says so.
+ */
+import { armResourceReadUrl, AzureReadError, getResource, isNotFound } from "./api/read-client.js";
+import { classifyArmFailure } from "./describe-resources.js";
+export const AZURE_HEALTH_TYPES = ["Microsoft.App/containerApps"];
+/** The Container Apps API version whose revisions carry `runningState` and `healthState`. */
+const CONTAINER_APPS_API_VERSION = "2024-03-01";
+const RUNNING = new Set(["running", "runningatmaxscale"]);
+const DOWN = new Set(["failed", "degraded", "stopped"]);
+/**
+ * The active revisions' verdict: unhealthy if none is active or any active one
+ * failed, degraded, stopped or reports `Unhealthy`; healthy if every active one
+ * is running and none is unhealthy; otherwise unknown (still provisioning).
+ */
+export function containerAppEntry(revisions, observedAt) {
+    const type = "Microsoft.App/containerApps";
+    const active = revisions.filter((r) => r.properties?.active === true);
+    if (active.length === 0) {
+        return { type, state: "unhealthy", detail: `no active revision (${revisions.length} revision(s))`, observedAt };
+    }
+    const describe = (r) => {
+        const p = r.properties ?? {};
+        const bits = [p.runningState ?? "no running state"];
+        if (p.healthState && p.healthState !== "None")
+            bits.push(p.healthState);
+        if (typeof p.replicas === "number")
+            bits.push(`${p.replicas} replica(s)`);
+        if (typeof p.trafficWeight === "number")
+            bits.push(`${p.trafficWeight}% traffic`);
+        return `${r.name ?? "revision"} ${bits.join(", ")}`;
+    };
+    const detail = active.map(describe).join("; ");
+    const running = (r) => RUNNING.has((r.properties?.runningState ?? "").toLowerCase());
+    const down = (r) => DOWN.has((r.properties?.runningState ?? "").toLowerCase()) || r.properties?.healthState?.toLowerCase() === "unhealthy";
+    const checkedAt = active
+        .map((r) => r.properties?.lastActiveTime ?? r.properties?.createdTime)
+        .filter((t) => typeof t === "string")
+        .sort()
+        .pop();
+    const state = active.some(down) ? "unhealthy" : active.every(running) ? "healthy" : "unknown";
+    return { type, state, detail, observedAt, ...(checkedAt ? { checkedAt } : {}) };
+}
+/** An app's own `runningStatus`, for when its revisions cannot be listed. */
+export function appRunningStatusEntry(runningStatus, observedAt) {
+    const lower = runningStatus.toLowerCase();
+    const state = RUNNING.has(lower) ? "healthy" : DOWN.has(lower) ? "unhealthy" : "unknown";
+    return {
+        type: "Microsoft.App/containerApps",
+        state,
+        detail: `app runningStatus ${runningStatus} (revisions not readable)`,
+        observedAt,
+    };
+}
+function hole(err) {
+    const { reason, detail } = classifyArmFailure(err);
+    return { type: "Microsoft.App/containerApps", reason, detail };
+}
+async function listRevisions(client, name) {
+    const http = client.http;
+    const url = armResourceReadUrl(client, "Microsoft.App/containerApps", `${name}/revisions`, CONTAINER_APPS_API_VERSION);
+    const res = await http("GET", url, undefined, client.signal);
+    if (res.status >= 300)
+        throw new AzureReadError(`revisions read failed with HTTP ${res.status}`, res.status);
+    let body;
+    try {
+        body = JSON.parse(res.text);
+    }
+    catch {
+        throw new AzureReadError("unparseable revisions list", res.status);
+    }
+    const value = body && typeof body === "object" ? body.value : undefined;
+    if (!Array.isArray(value))
+        throw new AzureReadError("unparseable revisions list", res.status);
+    return value;
+}
+const defaultHttp = async (method, url, body, signal) => {
+    const res = await fetch(url, {
+        method,
+        headers: body === undefined ? undefined : { "content-type": "application/json" },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal,
+    });
+    return { status: res.status, text: await res.text() };
+};
+export async function observeHealthAzure(options) {
+    const observedAt = (options.now?.() ?? new Date()).toISOString();
+    const client = {
+        resourceGroup: options.environment,
+        ...(process.env.AZURE_ENDPOINT_URL ? { endpoint: process.env.AZURE_ENDPOINT_URL } : {}),
+        ...(process.env.AZURE_SUBSCRIPTION_ID ? { subscriptionId: process.env.AZURE_SUBSCRIPTION_ID } : {}),
+        http: options.http ?? defaultHttp,
+    };
+    const entities = {};
+    const unobserved = {};
+    const absent = [];
+    await Promise.all([...options.entities].map(async ([entityName, { entityType, props }]) => {
+        const name = props.name;
+        if (!name) {
+            unobserved[entityName] = { type: entityType, reason: "read-failed", detail: "declared entity has no name to query by" };
+            return;
+        }
+        let app;
+        try {
+            app = await getResource(client, entityType, name, CONTAINER_APPS_API_VERSION);
+        }
+        catch (err) {
+            if (isNotFound(err))
+                absent.push(entityName);
+            else
+                unobserved[entityName] = hole(err);
+            return;
+        }
+        try {
+            entities[entityName] = containerAppEntry(await listRevisions(client, name), observedAt);
+        }
+        catch (err) {
+            const runningStatus = app.properties?.runningStatus;
+            if (typeof runningStatus === "string" && runningStatus.length > 0) {
+                entities[entityName] = appRunningStatusEntry(runningStatus, observedAt);
+            }
+            else {
+                unobserved[entityName] = hole(err);
+            }
+        }
+    }));
+    return { entities, unobserved, absent };
+}

package/dist/integrity.json

@@ -1,13 +1,13 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "73f94421607348da234c7b2fe2431c917da7c16edc29fa1606a5a41498acf91f",
-    "meta.json": "8c7a1ea3cfaf39461d3e758fa2b0cbd70c7800fac736e56df8d14a3e07ef1840",
-    "types/index.d.ts": "b20aaa3eeb957a6a5833dcbf5fd99ce1365285eafd4b78dc9383371b1a9d4b61",
+    "manifest.json": "b7cb2339ce19b5990cef0993cd7beddc1d038585d6578f379d7a7eadb5f868a7",
+    "meta.json": "d2521221ed616d882ded4296f0071685bd74e4b645d55dabc9685733c37dc419",
+    "types/index.d.ts": "29631032bda9533849178968290e65d72250eab0b8bab424f2d9ef9b4e8546a4",
     "rules/hardcoded-location.ts": "0b895449c8c94066e81721c46be24249231029fe13b471477456df5c4e45b8bf",
     "rules/nsg-wildcard.ts": "8f9d44833ba364778c05731f84c20f00734bb0d40d9fd0d91645965d18a258ae",
     "rules/storage-https.ts": "d340ba970bd9b35304bd7d288a9e99610a7677e6c56af4846305a98d4df0fbbc",
-    "rules/arm-refs.ts": "913317ef4f61d1a879f0f559bc3dfc00d73020f7c1106d2cb743acad1de4a00d",
+    "rules/arm-refs.ts": "1ff54e29511d5b0572586d64d7c5ca476a13f401f14f89b4d601b01aa6dde891",
     "rules/azr010.ts": "c61da411a3b325d49f2f790030f11aa4d518a671a23ff3d13be5206e2ddfedab",
     "rules/azr011.ts": "81b05ecaaf6e90a8afc692cd203d28eddf6126a3d7d9d4d4955e4aa6f2c7fa4c",
     "rules/azr012.ts": "e59ddbab64c0bddd2d65bd5cb66e976f858d86216825a18837653d14224a321e",
@@ -37,5 +37,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "95455caf05c28b24f7081e35276586087791d81c4b2d88d516a7fd35f5d8a59c"
+  "composite": "039009b3a310fec3985cbd427c59397fa4b2cd76797302c53c1a7d1e1d8e1e77"
 }

package/dist/lint/post-synth/arm-refs.d.ts

@@ -55,6 +55,7 @@ export declare function isBracketExpression(value: unknown): boolean;
  *
  * Handles:
  * - [resourceId('Type', 'name')]  -> extracts 'name'
+ * - [resourceId('Type', 'a', 'b')] -> extracts 'a/b'
  * - [reference('name')]           -> extracts 'name'
  * - [reference('name').prop]      -> extracts 'name'
  */

package/dist/lint/post-synth/arm-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arm-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/arm-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,GAAG,IAAI,CAWzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBhE"}
+{"version":3,"file":"arm-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/arm-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,GAAG,IAAI,CAWzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBhE"}

package/dist/lint/post-synth/arm-refs.js

@@ -50,16 +50,18 @@ export function isBracketExpression(value) {
  *
  * Handles:
  * - [resourceId('Type', 'name')]  -> extracts 'name'
+ * - [resourceId('Type', 'a', 'b')] -> extracts 'a/b'
  * - [reference('name')]           -> extracts 'name'
  * - [reference('name').prop]      -> extracts 'name'
  */
 export function extractRefsFromExpression(expr) {
     const refs = [];
-    // Match resourceId('...', 'name') — extract the last quoted argument (the resource name)
-    const resourceIdPattern = /resourceId\s*\([^)]*,\s*'([^']+)'\s*\)/g;
+    // Match resourceId('Type', 'name', ...): the name is every quoted argument
+    // after the type, joined with "/" for a child resource ('vnet', 'subnet').
+    const resourceIdPattern = /resourceId\s*\(\s*'[^']+'((?:\s*,\s*'[^']+')+)\s*\)/g;
     let match;
     while ((match = resourceIdPattern.exec(expr)) !== null) {
-        refs.push(match[1]);
+        refs.push([...match[1].matchAll(/'([^']+)'/g)].map((m) => m[1]).join("/"));
     }
     // Match reference('name') — extract the name
     const referencePattern = /reference\s*\(\s*'([^']+)'\s*\)/g;

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.124.32",
+  "version": "0.124.34",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/meta.json

@@ -33235,7 +33235,12 @@
     "lexicon": "azure",
     "apiVersion": "2025-02-02-preview",
     "attrs": {
-      "id": "id"
+      "id": "id",
+      "configuration_ingress_fqdn": "configuration.ingress.fqdn",
+      "latestRevisionFqdn": "latestRevisionFqdn",
+      "latestRevisionName": "latestRevisionName",
+      "outboundIpAddresses": "outboundIpAddresses",
+      "provisioningState": "provisioningState"
     },
     "propertyConstraints": {
       "kind": {

package/dist/okf/types/containerApps.md

@@ -22,4 +22,9 @@ resource_type: Microsoft.App/containerApps
 
 ## Attributes
 
+- `configuration.ingress.fqdn`
 - `id`
+- `latestRevisionFqdn`
+- `latestRevisionName`
+- `outboundIpAddresses`
+- `provisioningState`

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AA0B5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAodzB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AA0B5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aA4dzB,CAAC"}

package/dist/plugin.js

@@ -457,6 +457,12 @@ export const tags = defaultTags([
     },
     /** The noise rules the deep pass applies to both the live and declared trees. */
     deepNormalizationHooks: azureDeepNormalizationHooks,
+    /** Runtime health (#4177): Container Apps. Implementation in ./health.ts. */
+    healthTypes: ["Microsoft.App/containerApps"],
+    async observeHealth(options) {
+        const { observeHealthAzure } = await import("./health.js");
+        return observeHealthAzure(options);
+    },
     async exportResources(options) {
         const { exportResources } = await import("./export-resources.js");
         return exportResources(options);

package/dist/rules/arm-refs.ts

@@ -76,17 +76,19 @@ export function isBracketExpression(value: unknown): boolean {
  *
  * Handles:
  * - [resourceId('Type', 'name')]  -> extracts 'name'
+ * - [resourceId('Type', 'a', 'b')] -> extracts 'a/b'
  * - [reference('name')]           -> extracts 'name'
  * - [reference('name').prop]      -> extracts 'name'
  */
 export function extractRefsFromExpression(expr: string): string[] {
   const refs: string[] = [];
 
-  // Match resourceId('...', 'name') — extract the last quoted argument (the resource name)
-  const resourceIdPattern = /resourceId\s*\([^)]*,\s*'([^']+)'\s*\)/g;
+  // Match resourceId('Type', 'name', ...): the name is every quoted argument
+  // after the type, joined with "/" for a child resource ('vnet', 'subnet').
+  const resourceIdPattern = /resourceId\s*\(\s*'[^']+'((?:\s*,\s*'[^']+')+)\s*\)/g;
   let match: RegExpExecArray | null;
   while ((match = resourceIdPattern.exec(expr)) !== null) {
-    refs.push(match[1]);
+    refs.push([...match[1].matchAll(/'([^']+)'/g)].map((m) => m[1]).join("/"));
   }
 
   // Match reference('name') — extract the name

package/dist/serializer.d.ts

@@ -9,6 +9,7 @@
  * - ARM bracket expression references
  * - parameters, outputs sections
  */
+import type { Declarable } from "@intentius/chant/declarable";
 import type { Serializer } from "@intentius/chant/serializer";
 export declare function apiVersionRegistryCandidates(dir?: string): string[];
 export declare function loadApiVersions(candidates?: string[]): Map<string, string>;
@@ -24,6 +25,12 @@ export declare function resetApiVersionCache(): void;
  */
 export declare function lookupApiVersion(resourceType: string): string | undefined;
 export declare function getApiVersion(resourceType: string): string;
+/**
+ * An attribute of an export. `id` is `resourceId()`, since `reference()`
+ * returns the resource's properties and they have no `id`; anything else
+ * reads `reference()` by the ARM name.
+ */
+export declare function armAttrExpression(entityNames: Map<Declarable, string>, name: string, attr: string): string;
 /**
  * Azure ARM template serializer implementation.
  */

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA8ElG,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAqB,GAAG,MAAM,EAAE,CAKjF;AAED,wBAAgB,eAAe,CAAC,UAAU,GAAE,MAAM,EAAmC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB1G;AAcD,yEAAyE;AACzE,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWzE;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAO1D;AA2TD;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA0C7B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,6BAA6B,CAAC;AAE7E,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA8ElG,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAqB,GAAG,MAAM,EAAE,CAKjF;AAED,wBAAgB,eAAe,CAAC,UAAU,GAAE,MAAM,EAAmC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB1G;AAcD,yEAAyE;AACzE,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWzE;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAO1D;AA6BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAK1G;AAiWD;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA+C7B,CAAC"}

package/dist/serializer.js

@@ -121,20 +121,50 @@ export function getApiVersion(resourceType) {
     console.warn(`azure: no pinned apiVersion for ${resourceType} in the lexicon registry; falling back to 2023-01-01`);
     return "2023-01-01";
 }
+/**
+ * The ARM name of a chant export, as the arguments an ARM function takes
+ * (#4183). A resource's `name` prop is its ARM name, and the export name is
+ * used only when it has none. A literal name is quoted, one argument per
+ * segment of a child's `parent/child` name; a bracket expression such as
+ * `[parameters('n')]` is passed unwrapped.
+ */
+function armNameArgs(entity, exportName) {
+    const props = entity && isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null
+        ? entity.props
+        : undefined;
+    const name = typeof props?.name === "string" ? props.name : exportName;
+    if (name.startsWith("[") && name.endsWith("]"))
+        return { args: name.slice(1, -1), literal: null };
+    return { args: name.split("/").map((seg) => `'${seg}'`).join(", "), literal: name };
+}
+function entityNamed(entityNames, name) {
+    return [...entityNames.entries()].find(([, n]) => n === name)?.[0];
+}
+/** `resourceId(...)` for an export: the type and its ARM name. */
+function armResourceId(entityNames, name) {
+    const entity = entityNamed(entityNames, name);
+    const { args } = armNameArgs(entity, name);
+    return entity ? `resourceId('${entity.entityType}', ${args})` : `resourceId(${args})`;
+}
+/**
+ * An attribute of an export. `id` is `resourceId()`, since `reference()`
+ * returns the resource's properties and they have no `id`; anything else
+ * reads `reference()` by the ARM name.
+ */
+export function armAttrExpression(entityNames, name, attr) {
+    if (attr === "id")
+        return `[${armResourceId(entityNames, name)}]`;
+    const { args, literal } = armNameArgs(entityNamed(entityNames, name), name);
+    const target = literal !== null && !literal.includes("/") ? args : armResourceId(entityNames, name);
+    return `[reference(${target}).${attr}]`;
+}
 /**
  * ARM-specific visitor for the generic serializer walker.
  */
 function armVisitor(entityNames) {
     return {
-        attrRef: (name, attr) => `[reference('${name}').${attr}]`,
-        resourceRef: (name) => {
-            // Look up the resource type from entityNames
-            const entity = [...entityNames.entries()].find(([, n]) => n === name)?.[0];
-            if (entity) {
-                return `[resourceId('${entity.entityType}', '${name}')]`;
-            }
-            return `[resourceId('${name}')]`;
-        },
+        attrRef: (name, attr) => armAttrExpression(entityNames, name, attr),
+        resourceRef: (name) => `[${armResourceId(entityNames, name)}]`,
         propertyDeclarable: (entity, walk) => {
             if (!isResourceDeclarable(entity) || typeof entity.props !== "object" || entity.props === null) {
                 return undefined;
@@ -153,13 +183,38 @@ function armVisitor(entityNames) {
 /**
  * Convert a value to ARM-compatible JSON using the generic walker.
  */
+/** An ARM output for a literal, or for an azure intrinsic's `[...]` expression. */
+function armOutputValue(value) {
+    if (typeof value === "string")
+        return { type: "string", value };
+    if (typeof value === "number" && Number.isInteger(value))
+        return { type: "int", value };
+    if (typeof value === "boolean")
+        return { type: "bool", value };
+    return undefined;
+}
+function isIntrinsicLike(value) {
+    return typeof value === "object" && value !== null && typeof value.toJSON === "function";
+}
+function isCloudFormationShaped(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const keys = Object.keys(value);
+    return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
 function toArmValue(value, entityNames) {
     return walkValue(value, entityNames, armVisitor(entityNames));
 }
 /**
  * Serialize entities into an ARM template object.
  */
-function serializeToTemplate(entities, outputs, ownership) {
+function serializeToTemplate(entities, outputs, ownership, warnings = []) {
     // Resolve the deployment scope from the resource types being emitted
     // (#1545): a template of tenant-only resources (management groups, policy
     // definitions at management-group scope, ...) must carry the matching
@@ -270,6 +325,14 @@ function serializeToTemplate(entities, outputs, ownership) {
                     else if (key === "name") {
                         resource.name = toArmValue(value, entityNames);
                     }
+                    else if (key === "properties" && isPlainObject(value)) {
+                        // The generated types take ARM's own `properties` object, so
+                        // merge it, not nest it (#4183).
+                        for (const [inner, innerValue] of Object.entries(value)) {
+                            if (innerValue !== undefined)
+                                armProperties[inner] = toArmValue(innerValue, entityNames);
+                        }
+                    }
                     else {
                         armProperties[key] = toArmValue(value, entityNames);
                     }
@@ -292,14 +355,7 @@ function serializeToTemplate(entities, outputs, ownership) {
             if (attrs?.DependsOn !== undefined) {
                 const resolved = resolveDependsOn(attrs.DependsOn, entityNames, name);
                 if (resolved.length > 0) {
-                    resource.dependsOn = resolved.map((dep) => {
-                        // Convert to resourceId expression
-                        const depEntity = [...entityNames.entries()].find(([, n]) => n === dep)?.[0];
-                        if (depEntity) {
-                            return `[resourceId('${depEntity.entityType}', '${dep}')]`;
-                        }
-                        return dep;
-                    });
+                    resource.dependsOn = resolved.map((dep) => entityNamed(entityNames, dep) ? `[${armResourceId(entityNames, dep)}]` : dep);
                 }
             }
             template.resources.push(resource);
@@ -358,7 +414,7 @@ function serializeToTemplate(entities, outputs, ownership) {
                 // Find the resource to build the resourceId expression
                 const depResource = template.resources.find((r) => r.name === refName);
                 if (depResource) {
-                    const depExpr = `[resourceId('${depResource.type}', '${refName}')]`;
+                    const depExpr = `[resourceId('${depResource.type}', ${refName.split("/").map((seg) => `'${seg}'`).join(", ")})]`;
                     if (!existing.has(depExpr)) {
                         existing.add(depExpr);
                     }
@@ -376,29 +432,54 @@ function serializeToTemplate(entities, outputs, ownership) {
                 template.outputs = {};
             const stackOutput = entity;
             // `unknown` so isAttrRefLike narrows cleanly across the workspace/published
-            // type boundary. An intrinsic-wrapped output (#517) has no bare ARM
-            // reference form, so skip it here (only aws/CFN emits those).
+            // type boundary.
             const ref = stackOutput.sourceRef;
             if (isAttrRefLike(ref)) {
                 const logicalName = ref.getLogicalName();
                 if (logicalName) {
                     template.outputs[name] = {
                         type: "string",
-                        value: `[reference('${logicalName}').${ref.attribute}]`,
+                        value: armAttrExpression(entityNames, logicalName, ref.attribute),
                     };
                 }
             }
+            else {
+                const value = armOutputValue(isIntrinsicLike(ref) ? ref.toJSON() : ref);
+                if (value)
+                    template.outputs[name] = value;
+                else
+                    warnings.push(`azure: stack output "${name}" is not written: its value has no ARM form.`);
+            }
         }
     }
     // Add LexiconOutputs
     if (outputs && outputs.length > 0) {
         template.outputs = template.outputs ?? {};
         for (const output of outputs) {
-            template.outputs[output.outputName] = {
-                type: "string",
-                value: `[reference('${output.sourceEntity}').${output.sourceAttribute}]`,
-            };
+            if (output.sourceAttribute !== null) {
+                if (output.sourceEntity) {
+                    template.outputs[output.outputName] = {
+                        type: "string",
+                        value: armAttrExpression(entityNames, output.sourceEntity, output.sourceAttribute),
+                    };
+                }
+                else {
+                    warnings.push(`azure: output "${output.outputName}" is not written: its resource has no name in this build.`);
+                }
+                continue;
+            }
+            // A literal or an intrinsic (#4181). It has no source lexicon, so every
+            // lexicon receives it; a CloudFormation-shaped value is aws's to write.
+            const raw = output.getOutputValue();
+            const value = armOutputValue(raw);
+            if (value)
+                template.outputs[output.outputName] = value;
+            else if (!isCloudFormationShaped(raw)) {
+                warnings.push(`azure: output "${output.outputName}" is not written: its value has no ARM form.`);
+            }
         }
+        if (Object.keys(template.outputs).length === 0)
+            delete template.outputs;
     }
     return template;
 }
@@ -447,11 +528,16 @@ export const azureSerializer = {
                 }
             }
         }
-        const template = serializeToTemplate(entities, outputs, context?.ownership);
+        const warnings = [];
+        const template = serializeToTemplate(entities, outputs, context?.ownership, warnings);
         const primary = JSON.stringify(template, null, 2);
-        if (!hasChildProjects) {
+        if (!hasChildProjects && warnings.length === 0) {
             return primary;
         }
-        return { primary, files: allFiles };
+        return {
+            primary,
+            ...(hasChildProjects ? { files: allFiles } : {}),
+            ...(warnings.length > 0 ? { warnings } : {}),
+        };
     },
 };

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAiE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAI9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7E;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AA+GD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,aAWrC,CAAC;AAEH;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,oBAAoB,CAwI1E;AA+CD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAiE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAI9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7E;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAyHD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,aAWrC,CAAC;AAEH;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,oBAAoB,CAwI1E;AA+CD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvD"}

package/dist/spec/parse.js

@@ -104,6 +104,16 @@ const CURATED_ATTRIBUTES = {
         { name: "id", tsType: "string" },
         { name: "provisioningState", tsType: "string" },
     ],
+    // The app's hostname, for DNS in front of it (#4179). Dotted names read a
+    // nested field of reference()'s properties, as AWS's Endpoint.Address does.
+    "Microsoft.App/containerApps": [
+        { name: "id", tsType: "string" },
+        { name: "configuration.ingress.fqdn", tsType: "string" },
+        { name: "latestRevisionFqdn", tsType: "string" },
+        { name: "latestRevisionName", tsType: "string" },
+        { name: "outboundIpAddresses", tsType: "string[]" },
+        { name: "provisioningState", tsType: "string" },
+    ],
 };
 /**
  * Maximum nesting depth of generated property-type interfaces.

package/dist/types/index.d.ts

@@ -4232,7 +4232,12 @@ export declare class containerApps {
     /** Resource tags. */
     tags?: Record<string, unknown>;
   }, attributes?: ArmResourceAttributes);
+  readonly configuration_ingress_fqdn: string;
   readonly id: string;
+  readonly latestRevisionFqdn: string;
+  readonly latestRevisionName: string;
+  readonly outboundIpAddresses: string[];
+  readonly provisioningState: string;
 }
 
 export declare class containerApps_authConfigs {