@intentius/chant-lexicon-azure 0.124.32 → 0.124.34

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.124.32",
+  "version": "0.124.34",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,6 +74,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.32"
+    "@intentius/chant": "^0.124.34"
   }
 }

package/src/attributes.test.ts

@@ -0,0 +1,17 @@
+/**
+ * A Container App's hostname is referenceable (#4179), so DNS in another
+ * lexicon can point at it: `configuration.ingress.fqdn` is read through
+ * `configuration_ingress_fqdn`.
+ */
+
+import { describe, expect, test } from "vitest";
+import { AttrRef } from "@intentius/chant";
+import { containerApps } from "./index";
+
+describe("Container App attributes", () => {
+  test("configuration.ingress.fqdn and latestRevisionFqdn are AttrRefs", () => {
+    const app = new containerApps({ name: "web", location: "eastus" } as never) as unknown as Record<string, unknown>;
+    expect((app.configuration_ingress_fqdn as AttrRef).attribute).toBe("configuration.ingress.fqdn");
+    expect(app.latestRevisionFqdn).toBeInstanceOf(AttrRef);
+  });
+});

package/src/codegen/generate-typescript.ts

@@ -78,7 +78,7 @@ export function generateTypeScriptDeclarations(
       description: p.description,
     }));
     const dtsAttrs: DtsAttribute[] = r.resource.attributes.map((a) => ({
-      name: a.name,
+      name: a.name.replace(/\./g, "_"),
       type: a.tsType,
     }));
 

package/src/codegen/generate.ts

@@ -95,7 +95,7 @@ function generateRuntimeIndex(
     // Build attrs map
     const attrs: Record<string, string> = {};
     for (const a of r.resource.attributes) {
-      attrs[a.name] = a.name;
+      attrs[a.name.replace(/\./g, "_")] = a.name;
     }
 
     resourceEntries.push({ tsName, resourceType: armType, attrs });

package/src/generated/index.d.ts

@@ -4232,7 +4232,12 @@ export declare class containerApps {
     /** Resource tags. */
     tags?: Record<string, unknown>;
   }, attributes?: ArmResourceAttributes);
+  readonly configuration_ingress_fqdn: string;
   readonly id: string;
+  readonly latestRevisionFqdn: string;
+  readonly latestRevisionName: string;
+  readonly outboundIpAddresses: string[];
+  readonly provisioningState: string;
 }
 
 export declare class containerApps_authConfigs {

package/src/generated/index.ts

@@ -314,7 +314,7 @@ export const connections_flows = /* @__PURE__ */ createResource("Microsoft.Azure
 export const connectors = /* @__PURE__ */ createResource("Microsoft.Workloads/connectors", "azure", {"id":"id"});
 export const connectors_acssBackups = /* @__PURE__ */ createResource("Microsoft.Workloads/connectors_acssBackups", "azure", {"id":"id"});
 export const Consumptionbudgets = /* @__PURE__ */ createResource("Microsoft.Consumption/budgets", "azure", {"id":"id"});
-export const containerApps = /* @__PURE__ */ createResource("Microsoft.App/containerApps", "azure", {"id":"id"});
+export const containerApps = /* @__PURE__ */ createResource("Microsoft.App/containerApps", "azure", {"id":"id","configuration_ingress_fqdn":"configuration.ingress.fqdn","latestRevisionFqdn":"latestRevisionFqdn","latestRevisionName":"latestRevisionName","outboundIpAddresses":"outboundIpAddresses","provisioningState":"provisioningState"});
 export const containerApps_authConfigs = /* @__PURE__ */ createResource("Microsoft.App/containerApps_authConfigs", "azure", {"id":"id"});
 export const containerApps_resiliencyPolicies = /* @__PURE__ */ createResource("Microsoft.App/containerApps_resiliencyPolicies", "azure", {"id":"id"});
 export const containerApps_sourcecontrols = /* @__PURE__ */ createResource("Microsoft.App/containerApps_sourcecontrols", "azure", {"id":"id"});

package/src/generated/lexicon-azure.json

@@ -33235,7 +33235,12 @@
     "lexicon": "azure",
     "apiVersion": "2025-02-02-preview",
     "attrs": {
-      "id": "id"
+      "id": "id",
+      "configuration_ingress_fqdn": "configuration.ingress.fqdn",
+      "latestRevisionFqdn": "latestRevisionFqdn",
+      "latestRevisionName": "latestRevisionName",
+      "outboundIpAddresses": "outboundIpAddresses",
+      "provisioningState": "provisioningState"
     },
     "propertyConstraints": {
       "kind": {

package/src/health.test.ts

@@ -0,0 +1,66 @@
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { appRunningStatusEntry, containerAppEntry, observeHealthAzure } from "./health";
+import type { AzHttp } from "./op/activities/az-apply";
+
+const AT = "2026-10-20T21:00:00.000Z";
+const now = () => new Date(AT);
+const entities = new Map([["web", { entityType: "Microsoft.App/containerApps", props: { name: "web-app" } }]]);
+
+describe("azure health (#4177)", () => {
+  let saved: string | undefined;
+  beforeEach(() => {
+    saved = process.env.AZURE_ENDPOINT_URL;
+    process.env.AZURE_ENDPOINT_URL = "http://localhost:4577";
+  });
+  afterEach(() => {
+    if (saved === undefined) delete process.env.AZURE_ENDPOINT_URL;
+    else process.env.AZURE_ENDPOINT_URL = saved;
+  });
+
+  test("judges the active revisions", () => {
+    const rev = (runningState: string, extra: Record<string, unknown> = {}) => ({
+      name: "web-app--r1",
+      properties: { active: true, runningState, replicas: 2, trafficWeight: 100, ...extra },
+    });
+    expect(containerAppEntry([rev("Running")], AT)).toMatchObject({ state: "healthy", detail: "web-app--r1 Running, 2 replica(s), 100% traffic" });
+    expect(containerAppEntry([rev("Running", { healthState: "Unhealthy" })], AT).state).toBe("unhealthy");
+    expect(containerAppEntry([rev("Failed")], AT).state).toBe("unhealthy");
+    expect(containerAppEntry([rev("Processing")], AT).state).toBe("unknown");
+    expect(containerAppEntry([{ name: "old", properties: { active: false, runningState: "Running" } }], AT)).toMatchObject({
+      state: "unhealthy",
+      detail: "no active revision (1 revision(s))",
+    });
+  });
+
+  test("the app's runningStatus answers when revisions cannot be listed", () => {
+    expect(appRunningStatusEntry("Running", AT).state).toBe("healthy");
+    expect(appRunningStatusEntry("Stopped", AT).state).toBe("unhealthy");
+  });
+
+  test("reads the app, then its revisions, at the endpoint override", async () => {
+    const urls: string[] = [];
+    const http: AzHttp = async (_method, url) => {
+      urls.push(url);
+      if (url.includes("/revisions")) {
+        return { status: 200, text: JSON.stringify({ value: [{ name: "web-app--r1", properties: { active: true, runningState: "Running", replicas: 1 } }] }) };
+      }
+      return { status: 200, text: JSON.stringify({ id: "/x", properties: {} }) };
+    };
+    const r = await observeHealthAzure({ environment: "rg", buildOutput: "", entities, http, now });
+    expect(r.entities.web).toMatchObject({ state: "healthy", observedAt: AT });
+    expect(urls[1]).toBe(
+      "http://localhost:4577/subscriptions/00000000-0000-0000-0000-000000000001/resourceGroups/rg/providers/Microsoft.App/containerApps/web-app/revisions?api-version=2024-03-01",
+    );
+  });
+
+  test("a 404 app is absent; an unreadable revisions list with no runningStatus is a hole", async () => {
+    const notFound: AzHttp = async () => ({ status: 404, text: JSON.stringify({ error: { code: "ResourceNotFound", message: "gone" } }) });
+    expect((await observeHealthAzure({ environment: "rg", buildOutput: "", entities, http: notFound })).absent).toEqual(["web"]);
+
+    const noRevisions: AzHttp = async (_m, url) =>
+      url.includes("/revisions") ? { status: 404, text: "" } : { status: 200, text: JSON.stringify({ id: "/x", properties: {} }) };
+    const r = await observeHealthAzure({ environment: "rg", buildOutput: "", entities, http: noRevisions });
+    expect(r.entities).toEqual({});
+    expect(r.unobserved.web?.reason).toBe("read-failed");
+  });
+});

package/src/health.ts

@@ -0,0 +1,162 @@
+/**
+ * Runtime health for Azure (#4177): Container Apps.
+ *
+ * For each declared `Microsoft.App/containerApps`, GET the app (a 404 is
+ * absent), then its revisions, and judge the active ones by their running and
+ * health state. Same transport and endpoint rule as `describe-resources.ts`, so
+ * `AZURE_ENDPOINT_URL` (floci-az) answers.
+ *
+ * When the revisions list cannot be read but the app carries a
+ * `runningStatus` (newer API versions do), that answers instead, and the detail
+ * says so.
+ */
+
+import type { HealthEntry, HealthReadOptions, HealthReadResult, UnobservedEntity } from "@intentius/chant/lexicon";
+import { armResourceReadUrl, AzureReadError, getResource, isNotFound, type AzureReadClientOptions } from "./api/read-client";
+import { classifyArmFailure } from "./describe-resources";
+import type { AzHttp } from "./op/activities/az-apply";
+
+export const AZURE_HEALTH_TYPES = ["Microsoft.App/containerApps"] as const;
+
+/** The Container Apps API version whose revisions carry `runningState` and `healthState`. */
+const CONTAINER_APPS_API_VERSION = "2024-03-01";
+
+export interface AzureHealthOptions extends HealthReadOptions {
+  http?: AzHttp;
+  now?: () => Date;
+}
+
+/** The fields of one revision that decide health. */
+export interface RevisionState {
+  name?: string;
+  properties?: {
+    active?: boolean;
+    runningState?: string;
+    healthState?: string;
+    replicas?: number;
+    trafficWeight?: number;
+    lastActiveTime?: string;
+    createdTime?: string;
+  };
+}
+
+const RUNNING = new Set(["running", "runningatmaxscale"]);
+const DOWN = new Set(["failed", "degraded", "stopped"]);
+
+/**
+ * The active revisions' verdict: unhealthy if none is active or any active one
+ * failed, degraded, stopped or reports `Unhealthy`; healthy if every active one
+ * is running and none is unhealthy; otherwise unknown (still provisioning).
+ */
+export function containerAppEntry(revisions: RevisionState[], observedAt: string): HealthEntry {
+  const type = "Microsoft.App/containerApps";
+  const active = revisions.filter((r) => r.properties?.active === true);
+  if (active.length === 0) {
+    return { type, state: "unhealthy", detail: `no active revision (${revisions.length} revision(s))`, observedAt };
+  }
+  const describe = (r: RevisionState): string => {
+    const p = r.properties ?? {};
+    const bits = [p.runningState ?? "no running state"];
+    if (p.healthState && p.healthState !== "None") bits.push(p.healthState);
+    if (typeof p.replicas === "number") bits.push(`${p.replicas} replica(s)`);
+    if (typeof p.trafficWeight === "number") bits.push(`${p.trafficWeight}% traffic`);
+    return `${r.name ?? "revision"} ${bits.join(", ")}`;
+  };
+  const detail = active.map(describe).join("; ");
+  const running = (r: RevisionState) => RUNNING.has((r.properties?.runningState ?? "").toLowerCase());
+  const down = (r: RevisionState) =>
+    DOWN.has((r.properties?.runningState ?? "").toLowerCase()) || r.properties?.healthState?.toLowerCase() === "unhealthy";
+  const checkedAt = active
+    .map((r) => r.properties?.lastActiveTime ?? r.properties?.createdTime)
+    .filter((t): t is string => typeof t === "string")
+    .sort()
+    .pop();
+  const state = active.some(down) ? "unhealthy" : active.every(running) ? "healthy" : "unknown";
+  return { type, state, detail, observedAt, ...(checkedAt ? { checkedAt } : {}) };
+}
+
+/** An app's own `runningStatus`, for when its revisions cannot be listed. */
+export function appRunningStatusEntry(runningStatus: string, observedAt: string): HealthEntry {
+  const lower = runningStatus.toLowerCase();
+  const state = RUNNING.has(lower) ? "healthy" : DOWN.has(lower) ? "unhealthy" : "unknown";
+  return {
+    type: "Microsoft.App/containerApps",
+    state,
+    detail: `app runningStatus ${runningStatus} (revisions not readable)`,
+    observedAt,
+  };
+}
+
+function hole(err: unknown): UnobservedEntity {
+  const { reason, detail } = classifyArmFailure(err);
+  return { type: "Microsoft.App/containerApps", reason, detail };
+}
+
+async function listRevisions(client: AzureReadClientOptions, name: string): Promise<RevisionState[]> {
+  const http = client.http!;
+  const url = armResourceReadUrl(client, "Microsoft.App/containerApps", `${name}/revisions`, CONTAINER_APPS_API_VERSION);
+  const res = await http("GET", url, undefined, client.signal);
+  if (res.status >= 300) throw new AzureReadError(`revisions read failed with HTTP ${res.status}`, res.status);
+  let body: unknown;
+  try {
+    body = JSON.parse(res.text);
+  } catch {
+    throw new AzureReadError("unparseable revisions list", res.status);
+  }
+  const value = body && typeof body === "object" ? (body as { value?: unknown }).value : undefined;
+  if (!Array.isArray(value)) throw new AzureReadError("unparseable revisions list", res.status);
+  return value as RevisionState[];
+}
+
+const defaultHttp: AzHttp = async (method, url, body, signal) => {
+  const res = await fetch(url, {
+    method,
+    headers: body === undefined ? undefined : { "content-type": "application/json" },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal,
+  });
+  return { status: res.status, text: await res.text() };
+};
+
+export async function observeHealthAzure(options: AzureHealthOptions): Promise<HealthReadResult> {
+  const observedAt = (options.now?.() ?? new Date()).toISOString();
+  const client: AzureReadClientOptions = {
+    resourceGroup: options.environment,
+    ...(process.env.AZURE_ENDPOINT_URL ? { endpoint: process.env.AZURE_ENDPOINT_URL } : {}),
+    ...(process.env.AZURE_SUBSCRIPTION_ID ? { subscriptionId: process.env.AZURE_SUBSCRIPTION_ID } : {}),
+    http: options.http ?? defaultHttp,
+  };
+  const entities: Record<string, HealthEntry> = {};
+  const unobserved: Record<string, UnobservedEntity> = {};
+  const absent: string[] = [];
+
+  await Promise.all(
+    [...options.entities].map(async ([entityName, { entityType, props }]) => {
+      const name = props.name as string | undefined;
+      if (!name) {
+        unobserved[entityName] = { type: entityType, reason: "read-failed", detail: "declared entity has no name to query by" };
+        return;
+      }
+      let app: Awaited<ReturnType<typeof getResource>>;
+      try {
+        app = await getResource(client, entityType, name, CONTAINER_APPS_API_VERSION);
+      } catch (err) {
+        if (isNotFound(err)) absent.push(entityName);
+        else unobserved[entityName] = hole(err);
+        return;
+      }
+      try {
+        entities[entityName] = containerAppEntry(await listRevisions(client, name), observedAt);
+      } catch (err) {
+        const runningStatus = app.properties?.runningStatus;
+        if (typeof runningStatus === "string" && runningStatus.length > 0) {
+          entities[entityName] = appRunningStatusEntry(runningStatus, observedAt);
+        } else {
+          unobserved[entityName] = hole(err);
+        }
+      }
+    }),
+  );
+
+  return { entities, unobserved, absent };
+}

package/src/lint/post-synth/arm-refs.ts

@@ -76,17 +76,19 @@ export function isBracketExpression(value: unknown): boolean {
  *
  * Handles:
  * - [resourceId('Type', 'name')]  -> extracts 'name'
+ * - [resourceId('Type', 'a', 'b')] -> extracts 'a/b'
  * - [reference('name')]           -> extracts 'name'
  * - [reference('name').prop]      -> extracts 'name'
  */
 export function extractRefsFromExpression(expr: string): string[] {
   const refs: string[] = [];
 
-  // Match resourceId('...', 'name') — extract the last quoted argument (the resource name)
-  const resourceIdPattern = /resourceId\s*\([^)]*,\s*'([^']+)'\s*\)/g;
+  // Match resourceId('Type', 'name', ...): the name is every quoted argument
+  // after the type, joined with "/" for a child resource ('vnet', 'subnet').
+  const resourceIdPattern = /resourceId\s*\(\s*'[^']+'((?:\s*,\s*'[^']+')+)\s*\)/g;
   let match: RegExpExecArray | null;
   while ((match = resourceIdPattern.exec(expr)) !== null) {
-    refs.push(match[1]);
+    refs.push([...match[1].matchAll(/'([^']+)'/g)].map((m) => m[1]).join("/"));
   }
 
   // Match reference('name') — extract the name

package/src/lint/post-synth/post-synth.test.ts

@@ -33,7 +33,7 @@ describe("findArmResourceRefs", () => {
     const refs = findArmResourceRefs({
       subnet: "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'myVnet', 'mySubnet')]",
     });
-    expect(refs.has("mySubnet")).toBe(true);
+    expect(refs.has("myVnet/mySubnet")).toBe(true);
   });
 
   test("extracts reference targets", () => {

package/src/plugin.ts

@@ -486,6 +486,14 @@ export const tags = defaultTags([
   /** The noise rules the deep pass applies to both the live and declared trees. */
   deepNormalizationHooks: azureDeepNormalizationHooks,
 
+  /** Runtime health (#4177): Container Apps. Implementation in ./health.ts. */
+  healthTypes: ["Microsoft.App/containerApps"],
+
+  async observeHealth(options) {
+    const { observeHealthAzure } = await import("./health");
+    return observeHealthAzure(options);
+  },
+
   async exportResources(options) {
     const { exportResources } = await import("./export-resources");
     return exportResources(options);

package/src/serializer-names.test.ts

@@ -0,0 +1,83 @@
+/**
+ * References use the ARM name, not the chant export name, and an explicit
+ * `properties` object is merged, not nested (#4183).
+ */
+
+import { describe, expect, it } from "vitest";
+import { AttrRef } from "@intentius/chant";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import { azureSerializer } from "./serializer";
+
+function makeEntity(entityType: string, props: Record<string, unknown> = {}): any {
+  return { [DECLARABLE_MARKER]: true, lexicon: "azure", entityType, kind: "resource", props };
+}
+
+function ref(parent: object, logicalName: string, attribute: string): AttrRef {
+  const r = new AttrRef(parent, attribute);
+  r._setLogicalName(logicalName);
+  return r;
+}
+
+function serialize(entities: Map<string, any>): any {
+  return JSON.parse(azureSerializer.serialize(entities) as string);
+}
+
+describe("azure references by ARM name", () => {
+  it("reads reference() and resourceId() by the name prop, and infers dependsOn from them", () => {
+    const env = makeEntity("Microsoft.App/managedEnvironments", { name: "prod-env", location: "eastus" });
+    const entities = new Map<string, any>([["env", env]]);
+    entities.set("app", makeEntity("Microsoft.App/containerApps", {
+      name: "web",
+      location: "eastus",
+      environmentId: ref(env, "env", "id"),
+      envName: ref(env, "env", "defaultDomain"),
+    }));
+
+    const app = serialize(entities).resources.find((r: any) => r.name === "web");
+    expect(app.properties.environmentId).toBe("[resourceId('Microsoft.App/managedEnvironments', 'prod-env')]");
+    expect(app.properties.envName).toBe("[reference('prod-env').defaultDomain]");
+    expect(app.dependsOn).toEqual(["[resourceId('Microsoft.App/managedEnvironments', 'prod-env')]"]);
+  });
+
+  it("falls back to the export name when there is no name prop", () => {
+    const vnet = makeEntity("Microsoft.Network/virtualNetworks", { location: "eastus" });
+    const entities = new Map<string, any>([["vnet", vnet]]);
+    entities.set("nic", makeEntity("Microsoft.Network/networkInterfaces", { name: "nic", vnetId: ref(vnet, "vnet", "id") }));
+
+    const nic = serialize(entities).resources.find((r: any) => r.name === "nic");
+    expect(nic.properties.vnetId).toBe("[resourceId('Microsoft.Network/virtualNetworks', 'vnet')]");
+  });
+
+  it("splits a child resource's name into resourceId segments", () => {
+    const subnet = makeEntity("Microsoft.Network/virtualNetworks/subnets", { name: "vnet/apps" });
+    const entities = new Map<string, any>([["subnet", subnet]]);
+    entities.set("nic", makeEntity("Microsoft.Network/networkInterfaces", { name: "nic", subnetId: ref(subnet, "subnet", "id") }));
+
+    const nic = serialize(entities).resources.find((r: any) => r.name === "nic");
+    expect(nic.properties.subnetId).toBe("[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]");
+    expect(nic.dependsOn).toEqual(["[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]"]);
+  });
+
+  it("passes a bracket-expression name through unwrapped", () => {
+    const sa = makeEntity("Microsoft.Storage/storageAccounts", { name: "[parameters('storageName')]" });
+    const entities = new Map<string, any>([["sa", sa]]);
+    entities.set("x", makeEntity("Microsoft.Web/sites", { name: "site", blob: ref(sa, "sa", "primaryEndpoints") }));
+
+    const site = serialize(entities).resources.find((r: any) => r.name === "site");
+    expect(site.properties.blob).toBe("[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('storageName'))).primaryEndpoints]");
+  });
+});
+
+describe("azure properties object", () => {
+  it("merges an explicit properties object instead of nesting it", () => {
+    const entities = new Map<string, any>([["app", makeEntity("Microsoft.App/containerApps", {
+      name: "web",
+      location: "eastus",
+      properties: { configuration: { ingress: { external: true, targetPort: 8080 } } },
+    })]]);
+
+    const app = serialize(entities).resources[0];
+    expect(app.properties.properties).toBeUndefined();
+    expect(app.properties.configuration).toEqual({ ingress: { external: true, targetPort: 8080 } });
+  });
+});

package/src/serializer-outputs.test.ts

@@ -0,0 +1,65 @@
+/**
+ * Outputs azure can't write as a reference are written as values or named in
+ * a warning, never as `[reference('').null]` (#4181).
+ */
+
+import { describe, expect, it } from "vitest";
+import { AttrRef } from "@intentius/chant";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import { LexiconOutput } from "@intentius/chant/lexicon-output";
+import { stackOutput } from "@intentius/chant/stack-output";
+import { azureSerializer } from "./serializer";
+import { ResourceIdIntrinsic } from "./intrinsics";
+
+function makeEntity(entityType: string, props: Record<string, unknown> = {}): any {
+  return { [DECLARABLE_MARKER]: true, lexicon: "azure", entityType, kind: "resource", props };
+}
+
+function run(entities: Map<string, any>, outputs: LexiconOutput[]): { template: any; warnings: string[] } {
+  const result = azureSerializer.serialize(entities, outputs);
+  if (typeof result === "string") return { template: JSON.parse(result), warnings: [] };
+  return { template: JSON.parse(result.primary), warnings: result.warnings ?? [] };
+}
+
+describe("azure outputs", () => {
+  it("writes an attribute output by the resource's ARM name", () => {
+    const app = makeEntity("Microsoft.App/containerApps", { name: "web" });
+    const out = new LexiconOutput(new AttrRef(app, "latestRevisionFqdn"), "WebFqdn");
+    out._setSourceEntity("app");
+    const { template, warnings } = run(new Map([["app", app]]), [out]);
+    expect(template.outputs.WebFqdn.value).toBe("[reference('web').latestRevisionFqdn]");
+    expect(warnings).toEqual([]);
+  });
+
+  it("writes literal outputs with their ARM type", () => {
+    const { template } = run(new Map(), [
+      new LexiconOutput("eastus", "Region"),
+      new LexiconOutput(3, "Replicas"),
+      new LexiconOutput(true, "Public"),
+    ]);
+    expect(template.outputs).toEqual({
+      Region: { type: "string", value: "eastus" },
+      Replicas: { type: "int", value: 3 },
+      Public: { type: "bool", value: true },
+    });
+  });
+
+  it("writes an azure intrinsic output as its expression", () => {
+    const { template } = run(new Map(), [new LexiconOutput(new ResourceIdIntrinsic("Microsoft.Storage/storageAccounts", "sa"), "SaId")]);
+    expect(template.outputs.SaId.value).toBe("[resourceId('Microsoft.Storage/storageAccounts', 'sa')]");
+  });
+
+  it("leaves a CloudFormation intrinsic to aws, without a warning", () => {
+    const cfn = { [Symbol.for("chant.intrinsic")]: true, toJSON: () => ({ "Fn::Sub": "x" }) };
+    const out = new LexiconOutput(cfn as never, "Sub");
+    const { template, warnings } = run(new Map(), [out]);
+    expect(template.outputs).toBeUndefined();
+    expect(warnings).toEqual([]);
+  });
+
+  it("writes a string stack output, which the docs show as an ARM expression", () => {
+    const so = stackOutput("[resourceId('Microsoft.Storage/storageAccounts', 'sa')]", { lexicon: "azure" });
+    const { template } = run(new Map<string, any>([["saId", so]]), []);
+    expect(template.outputs.saId.value).toBe("[resourceId('Microsoft.Storage/storageAccounts', 'sa')]");
+  });
+});