@intentius/chant-lexicon-azure 0.124.34 → 0.124.36

package/dist/api/read-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAC;AASxD,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,qFAAqF;AACrF,qBAAa,cAAe,SAAQ,KAAK;IAGrC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IAHxB,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,YAAA,EAIvB;CACF;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhD;AAgBD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,SAAsB,GAC/B,MAAM,CAIR;AAwBD,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAgB/F;AAED,8FAA8F;AAC9F,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,EAC/B,EAAE,EAAE,MAAM,EACV,UAAU,SAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED,sHAAsH;AACtH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,eAAe,CAAC,CAa1B"}
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAC;AASxD,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,qFAAqF;AACrF,qBAAa,cAAe,SAAQ,KAAK;IAGrC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IAHxB,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,YAAA,EAIvB;CACF;AAED,wEAAwE;AACxE,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEhD;AAgBD,sFAAsF;AACtF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,SAAsB,GAC/B,MAAM,CAIR;AAwBD,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAgB/F;AAED,8FAA8F;AAC9F,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,EAC/B,EAAE,EAAE,MAAM,EACV,UAAU,SAAsB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED,sHAAsH;AACtH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,eAAe,CAAC,CAa1B"}

package/dist/api/read-client.js

@@ -18,6 +18,7 @@
  * wants a bearer token. The `az` CLI path remains for a signed read until
  * token acquisition lands here.
  */
+import { armResourcePath } from "../arm-type.js";
 /** Default ARM host, matching the applier's. */
 const DEFAULT_ENDPOINT = "https://management.azure.com";
 /** floci-az's fixed local subscription, matching the applier's. */
@@ -53,7 +54,7 @@ const defaultHttp = async (method, url, body, signal) => {
 export function armResourceReadUrl(options, type, name, apiVersion = DEFAULT_API_VERSION) {
     const base = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
     const subscription = options.subscriptionId ?? DEFAULT_SUBSCRIPTION;
-    return `${base}/subscriptions/${subscription}/resourceGroups/${options.resourceGroup}/providers/${type}/${name}?api-version=${apiVersion}`;
+    return `${base}/subscriptions/${subscription}/resourceGroups/${options.resourceGroup}/providers/${armResourcePath(type, name)}?api-version=${apiVersion}`;
 }
 /**
  * ARM's error envelope is `{ error: { code, message } }`. Reading the code

package/dist/arm-type.d.ts

@@ -0,0 +1,21 @@
+/**
+ * ARM resource types as ARM spells them (#4230).
+ *
+ * The lexicon's entity types come from the ARM schema ids, which join a child
+ * type to its parent with `_` (`Microsoft.Network/virtualNetworks_subnets`).
+ * ARM itself joins them with `/` (`Microsoft.Network/virtualNetworks/subnets`),
+ * in a template's `type`, in `resourceId()` and in the resource URL. Resource
+ * type segments never contain `_`, so every `_` after the namespace is a
+ * child separator.
+ */
+/** `Microsoft.Network/virtualNetworks_subnets` → `Microsoft.Network/virtualNetworks/subnets`. Idempotent. */
+export declare function armType(entityType: string): string;
+/**
+ * The provider-relative path of one resource: each type segment followed by
+ * its name segment, as ARM's `resourceId()` builds it.
+ * `('Microsoft.Network/virtualNetworks/subnets', 'vnet/apps')` →
+ * `Microsoft.Network/virtualNetworks/vnet/subnets/apps`. A name with fewer
+ * segments than the type has kinds is joined as given.
+ */
+export declare function armResourcePath(type: string, name: string): string;
+//# sourceMappingURL=arm-type.d.ts.map

package/dist/arm-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arm-type.d.ts","sourceRoot":"","sources":["../src/arm-type.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,6GAA6G;AAC7G,wBAAgB,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAKlE"}

package/dist/arm-type.js

@@ -0,0 +1,31 @@
+/**
+ * ARM resource types as ARM spells them (#4230).
+ *
+ * The lexicon's entity types come from the ARM schema ids, which join a child
+ * type to its parent with `_` (`Microsoft.Network/virtualNetworks_subnets`).
+ * ARM itself joins them with `/` (`Microsoft.Network/virtualNetworks/subnets`),
+ * in a template's `type`, in `resourceId()` and in the resource URL. Resource
+ * type segments never contain `_`, so every `_` after the namespace is a
+ * child separator.
+ */
+/** `Microsoft.Network/virtualNetworks_subnets` → `Microsoft.Network/virtualNetworks/subnets`. Idempotent. */
+export function armType(entityType) {
+    const slash = entityType.indexOf("/");
+    if (slash < 0)
+        return entityType;
+    return entityType.slice(0, slash + 1) + entityType.slice(slash + 1).replace(/_/g, "/");
+}
+/**
+ * The provider-relative path of one resource: each type segment followed by
+ * its name segment, as ARM's `resourceId()` builds it.
+ * `('Microsoft.Network/virtualNetworks/subnets', 'vnet/apps')` →
+ * `Microsoft.Network/virtualNetworks/vnet/subnets/apps`. A name with fewer
+ * segments than the type has kinds is joined as given.
+ */
+export function armResourcePath(type, name) {
+    const [namespace, ...kinds] = armType(type).split("/");
+    const names = name.split("/");
+    if (kinds.length <= 1 || names.length !== kinds.length)
+        return `${armType(type)}/${name}`;
+    return [namespace, ...kinds.flatMap((kind, i) => [kind, names[i]])].join("/");
+}

package/dist/deep-observe.d.ts

@@ -79,6 +79,15 @@ export declare const AZURE_SERVER_COMPUTED_NAMES: ReadonlySet<string>;
  * additive and needs no contract change.
  */
 export declare const AZURE_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
+/**
+ * The canonical key for one entry of `identity.userAssignedIdentities`
+ * (#4231): `<type>/<name>` lowercased, from either spelling. Source keys the
+ * map by `[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities',
+ * 'appId')]`; ARM answers with the evaluated id, `/subscriptions/.../providers/
+ * Microsoft.ManagedIdentity/userAssignedIdentities/appId`, in whatever case it
+ * stored. A key in neither form is left as it is.
+ */
+export declare function userAssignedIdentityKey(key: string): string;
 /**
  * The azure lexicon's noise rules. Three classes, same as AWS: server-
  * populated fields (by name, unconditional), controller-injected boilerplate

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AA+DlC;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CASpD,CAAC;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI1E,CAAC;AA+DF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAyEzC,CAAC;AAIF,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,qBAAqB,CAAC,CAkEhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AA+DlC;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CASpD,CAAC;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI1E,CAAC;AA+DF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM3D;AAyBD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBA2EzC,CAAC;AAIF,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,qBAAqB,CAAC,CAkEhC"}

package/dist/deep-observe.js

@@ -203,6 +203,47 @@ function lastSegment(pattern) {
     const dot = withoutIndex.lastIndexOf(".");
     return dot === -1 ? withoutIndex : withoutIndex.slice(dot + 1);
 }
+/**
+ * The canonical key for one entry of `identity.userAssignedIdentities`
+ * (#4231): `<type>/<name>` lowercased, from either spelling. Source keys the
+ * map by `[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities',
+ * 'appId')]`; ARM answers with the evaluated id, `/subscriptions/.../providers/
+ * Microsoft.ManagedIdentity/userAssignedIdentities/appId`, in whatever case it
+ * stored. A key in neither form is left as it is.
+ */
+export function userAssignedIdentityKey(key) {
+    const expr = /^\[\s*resourceId\(\s*'([^']+)'\s*,\s*'([^']+)'\s*\)\s*\]$/.exec(key);
+    if (expr)
+        return `${expr[1]}/${expr[2]}`.toLowerCase();
+    const at = key.toLowerCase().lastIndexOf("/providers/");
+    if (at !== -1 && key.startsWith("/subscriptions/"))
+        return key.slice(at + "/providers/".length).toLowerCase();
+    return key;
+}
+/**
+ * Rekey `identity.userAssignedIdentities` by {@link userAssignedIdentityKey},
+ * on a copy, and drop the `principalId` and `clientId` ARM fills in on each
+ * entry. Nobody declares them, and pruning them later would leave the live
+ * entry empty and gone, where source declares `{}`.
+ */
+function rekeyUserAssignedIdentities(tree) {
+    const identity = tree.identity;
+    if (!identity || typeof identity !== "object" || Array.isArray(identity))
+        return tree;
+    const assigned = identity.userAssignedIdentities;
+    if (!assigned || typeof assigned !== "object" || Array.isArray(assigned))
+        return tree;
+    const rekeyed = {};
+    for (const [k, v] of Object.entries(assigned)) {
+        let entry = v;
+        if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+            const { principalId: _p, clientId: _c, ...rest } = entry;
+            entry = rest;
+        }
+        rekeyed[userAssignedIdentityKey(k)] = entry;
+    }
+    return { ...tree, identity: { ...identity, userAssignedIdentities: rekeyed } };
+}
 /**
  * The azure lexicon's noise rules. Three classes, same as AWS: server-
  * populated fields (by name, unconditional), controller-injected boilerplate
@@ -213,6 +254,7 @@ function lastSegment(pattern) {
  * since it is a plain object; only the *default empty map* needs a rule here).
  */
 export const azureDeepNormalizationHooks = {
+    prepare: (tree) => rekeyUserAssignedIdentities(tree),
     prune(node) {
         const name = lastSegment(node.pattern);
         if (AZURE_READ_ONLY_NAMES.has(name) || AZURE_UNCONDITIONAL_PRUNE_NAMES.has(name))

package/dist/graph-edges.d.ts

@@ -0,0 +1,21 @@
+/**
+ * References written as ARM expressions, as graph edges (#4232).
+ *
+ * `chant graph` draws an edge for every `AttrRef` it finds in props, but an
+ * Azure reference is often an expression instead: `reference(resourceId(...))
+ * .customerId` and `listKeys(...)` for a value the resource has no attribute
+ * for, or a `resourceId(...)` used as an object key, which is how
+ * `identity.userAssignedIdentities` names an identity. The serializer already
+ * reads these to write `dependsOn` (./serializer.ts), with
+ * `findArmResourceRefs` (./lint/post-synth/arm-refs.ts). This module runs the
+ * same extraction over each prop as the template writes it and reports each
+ * reference to a declared resource through the plugin's `graphEdges` hook.
+ *
+ * A reference matches by resource name, never by type, as the serializer's
+ * inference does. A name nothing in the project declares is left out: it is
+ * an existing resource the template reads, not a dangling reference.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { LexiconGraphEdges } from "@intentius/chant/graph-ir";
+export declare function azureGraphEdges(entities: ReadonlyMap<string, Declarable>): LexiconGraphEdges | undefined;
+//# sourceMappingURL=graph-edges.d.ts.map

package/dist/graph-edges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-edges.d.ts","sourceRoot":"","sources":["../src/graph-edges.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAyB,MAAM,2BAA2B,CAAC;AAQ1F,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,iBAAiB,GAAG,SAAS,CA2CxG"}

package/dist/graph-edges.js

@@ -0,0 +1,71 @@
+/**
+ * References written as ARM expressions, as graph edges (#4232).
+ *
+ * `chant graph` draws an edge for every `AttrRef` it finds in props, but an
+ * Azure reference is often an expression instead: `reference(resourceId(...))
+ * .customerId` and `listKeys(...)` for a value the resource has no attribute
+ * for, or a `resourceId(...)` used as an object key, which is how
+ * `identity.userAssignedIdentities` names an identity. The serializer already
+ * reads these to write `dependsOn` (./serializer.ts), with
+ * `findArmResourceRefs` (./lint/post-synth/arm-refs.ts). This module runs the
+ * same extraction over each prop as the template writes it and reports each
+ * reference to a declared resource through the plugin's `graphEdges` hook.
+ *
+ * A reference matches by resource name, never by type, as the serializer's
+ * inference does. A name nothing in the project declares is left out: it is
+ * an existing resource the template reads, not a dangling reference.
+ */
+import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import { findArmResourceRefs } from "./lint/post-synth/arm-refs.js";
+import { armResourceName, toArmValue } from "./serializer.js";
+function isAzureResource(entity) {
+    return entity.lexicon === "azure" && isResourceDeclarable(entity) && !isPropertyDeclarable(entity);
+}
+export function azureGraphEdges(entities) {
+    const entityNames = new Map();
+    for (const [key, entity] of entities)
+        entityNames.set(entity, key);
+    // Template name -> entity key, for the resources whose name is a literal.
+    const byArmName = new Map();
+    for (const [key, entity] of entities) {
+        if (!isAzureResource(entity))
+            continue;
+        const name = armResourceName(entity, key, entityNames);
+        if (typeof name === "string")
+            byArmName.set(name, key);
+    }
+    if (byArmName.size === 0)
+        return undefined;
+    const references = [];
+    const seen = new Set();
+    const add = (from, to, viaAttr) => {
+        if (!to || to === from)
+            return;
+        const id = `${from}\0${to}\0${viaAttr}`;
+        if (seen.has(id))
+            return;
+        seen.add(id);
+        references.push({ from, to, kind: "ref", viaAttr });
+    };
+    for (const [key, entity] of entities) {
+        if (!isAzureResource(entity))
+            continue;
+        const props = entity.props;
+        if (props && typeof props === "object") {
+            for (const [attr, value] of Object.entries(props)) {
+                if (value === undefined)
+                    continue;
+                for (const ref of findArmResourceRefs(toArmValue(value, entityNames))) {
+                    add(key, byArmName.get(ref), attr);
+                }
+            }
+        }
+        // A child resource named "vnet/subnet" depends on "vnet", as the
+        // serializer infers for dependsOn.
+        const name = armResourceName(entity, key, entityNames);
+        if (typeof name === "string" && name.includes("/")) {
+            add(key, byArmName.get(name.split("/")[0]), "name");
+        }
+    }
+    return references.length > 0 ? { references } : undefined;
+}

package/dist/integrity.json

@@ -1,13 +1,13 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "b7cb2339ce19b5990cef0993cd7beddc1d038585d6578f379d7a7eadb5f868a7",
+    "manifest.json": "36de6ef8e05614017db514e3079f85c0ee351a10d531295139153e90c28e7f16",
     "meta.json": "d2521221ed616d882ded4296f0071685bd74e4b645d55dabc9685733c37dc419",
     "types/index.d.ts": "29631032bda9533849178968290e65d72250eab0b8bab424f2d9ef9b4e8546a4",
     "rules/hardcoded-location.ts": "0b895449c8c94066e81721c46be24249231029fe13b471477456df5c4e45b8bf",
     "rules/nsg-wildcard.ts": "8f9d44833ba364778c05731f84c20f00734bb0d40d9fd0d91645965d18a258ae",
     "rules/storage-https.ts": "d340ba970bd9b35304bd7d288a9e99610a7677e6c56af4846305a98d4df0fbbc",
-    "rules/arm-refs.ts": "1ff54e29511d5b0572586d64d7c5ca476a13f401f14f89b4d601b01aa6dde891",
+    "rules/arm-refs.ts": "56521a730d566538cebd21037b7a291f4cdb909fa0d7213c80cac2633f154501",
     "rules/azr010.ts": "c61da411a3b325d49f2f790030f11aa4d518a671a23ff3d13be5206e2ddfedab",
     "rules/azr011.ts": "81b05ecaaf6e90a8afc692cd203d28eddf6126a3d7d9d4d4955e4aa6f2c7fa4c",
     "rules/azr012.ts": "e59ddbab64c0bddd2d65bd5cb66e976f858d86216825a18837653d14224a321e",
@@ -37,5 +37,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "039009b3a310fec3985cbd427c59397fa4b2cd76797302c53c1a7d1e1d8e1e77"
+  "composite": "afff685e577b82053fbad1e626d8078471c1deb87047216fc0cfd7a7166d6eaa"
 }

package/dist/lint/post-synth/arm-refs.d.ts

@@ -43,6 +43,8 @@ export declare function parseArmTemplate(output: string | {
  * - [reference('myStorage')]
  * - [reference('myStorage').primaryEndpoints.blob]
  *
+ * Object keys are read as well as values.
+ *
  * Returns the set of resource names found in these references.
  */
 export declare function findArmResourceRefs(value: unknown): Set<string>;

package/dist/lint/post-synth/arm-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arm-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/arm-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,GAAG,IAAI,CAWzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBhE"}
+{"version":3,"file":"arm-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/arm-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,GAAG,IAAI,CAWzF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBhE"}

package/dist/lint/post-synth/arm-refs.js

@@ -32,6 +32,8 @@ export function parseArmTemplate(output) {
  * - [reference('myStorage')]
  * - [reference('myStorage').primaryEndpoints.blob]
  *
+ * Object keys are read as well as values.
+ *
  * Returns the set of resource names found in these references.
  */
 export function findArmResourceRefs(value) {
@@ -89,7 +91,10 @@ function walkArmValue(value, refs) {
     }
     if (typeof value === "object") {
         const obj = value;
-        for (const val of Object.values(obj)) {
+        for (const [key, val] of Object.entries(obj)) {
+            // A key can be an expression too: a user-assigned identity is named by
+            // its resource ID as the key of identity.userAssignedIdentities.
+            walkArmValue(key, refs);
             walkArmValue(val, refs);
         }
     }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.124.34",
+  "version": "0.124.36",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/op/activities/az-apply.d.ts

@@ -9,6 +9,11 @@ export interface ArmResource {
     sku?: unknown;
     kind?: unknown;
     tags?: Record<string, string>;
+    identity?: unknown;
+    zones?: unknown;
+    plan?: unknown;
+    extendedLocation?: unknown;
+    managedBy?: unknown;
     dependsOn?: unknown;
 }
 /** Injectable HTTP client — mirrors the GCP applier so tests avoid the network. */
@@ -31,9 +36,24 @@ export interface ArmEvalCtx {
     base: string;
     signal?: AbortSignal;
 }
+/** The ARM resource id of a resource in the context's group. */
+export declare function armResourceIdOf(ctx: Pick<ArmEvalCtx, "subscriptionId" | "resourceGroup">, type: string, name: string): string;
+/**
+ * Record an applied resource's response so `reference()` resolves it by name
+ * and by resource id (#4243). Ids are case-insensitive in ARM, so they are
+ * stored lowercased, under both the id chant derives and the one the
+ * response reports.
+ */
+export declare function rememberDeployed(ctx: ArmEvalCtx, type: string, name: string, body: unknown): void;
+/** An applied resource by the name or the resource id a `reference()` names. */
+export declare function lookupDeployed(ctx: ArmEvalCtx, ref: string): unknown;
 /** Evaluate an ARM expression string (`"[...]"`); a plain string is returned as-is. */
 export declare function evalArmString(s: string, ctx: ArmEvalCtx): Promise<unknown>;
-/** Recursively evaluate every string in a value against the ARM context. */
+/**
+ * Recursively evaluate every string in a value against the ARM context,
+ * object keys included: ARM evaluates a property name too, and
+ * `identity.userAssignedIdentities` is keyed by `[resourceId(...)]` (#4231).
+ */
 export declare function evalArm(value: unknown, ctx: ArmEvalCtx): Promise<unknown>;
 /** Resource names this resource references via `resourceId('type','name')` / `reference('name')`. Pure. */
 export declare function armDependencies(resource: ArmResource, names: Set<string>): string[];
@@ -45,7 +65,7 @@ export declare function armDependencies(resource: ArmResource, names: Set<string
 export declare function orderArmResources(resources: ArmResource[]): ArmResource[];
 /** The ARM resource-ID PUT URL for a resource (name expression evaluated). */
 export declare function armResourceUrl(resource: ArmResource, ctx: ArmEvalCtx): Promise<string>;
-/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. */
+/** The ARM resource PUT body: `location` and {@link ARM_BODY_FIELDS}, expressions evaluated. */
 export declare function armResourceBody(resource: ArmResource, ctx: ArmEvalCtx): Promise<Record<string, unknown>>;
 export interface AzApplyArgs {
     /** Path to a built ARM template (`deploymentTemplate.json`). */

package/dist/op/activities/az-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAMhC,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc/C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED,4EAA4E;AAC5E,wBAAsB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAgID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAenF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAqBzE;AAID,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ9G;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE;qDACiD;IACjD,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CA+CD;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGrF;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,MAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASlI;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAM3D;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;CAC/B,GAAG,WAAW,CAqBd;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAKD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,KAAK,GAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAa,GAClD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CA6CD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAqB/E"}
+{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAMhC,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc/C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7H;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAKjG;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAmID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAenF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAqBzE;AAID,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AASD,gGAAgG;AAChG,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAO9G;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE;qDACiD;IACjD,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CA+CD;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGrF;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,MAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASlI;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAM3D;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;CAC/B,GAAG,WAAW,CAqBd;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAKD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,KAAK,GAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAa,GAClD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CA6CD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAqB/E"}

package/dist/op/activities/az-apply.js

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { armResourcePath } from "../../arm-type.js";
 import { createHash } from "node:crypto";
 import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
 import { AZURE_TAG_OWNERSHIP_KEYS } from "../../ownership.js";
@@ -17,6 +18,27 @@ const defaultHttp = async (method, url, body, signal) => {
     });
     return { status: res.status, text: await res.text() };
 };
+/** The ARM resource id of a resource in the context's group. */
+export function armResourceIdOf(ctx, type, name) {
+    return `/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${armResourcePath(type, name)}`;
+}
+/**
+ * Record an applied resource's response so `reference()` resolves it by name
+ * and by resource id (#4243). Ids are case-insensitive in ARM, so they are
+ * stored lowercased, under both the id chant derives and the one the
+ * response reports.
+ */
+export function rememberDeployed(ctx, type, name, body) {
+    ctx.deployed.set(name, body);
+    ctx.deployed.set(armResourceIdOf(ctx, type, name).toLowerCase(), body);
+    const id = body?.id;
+    if (typeof id === "string")
+        ctx.deployed.set(id.toLowerCase(), body);
+}
+/** An applied resource by the name or the resource id a `reference()` names. */
+export function lookupDeployed(ctx, ref) {
+    return ctx.deployed.get(ref) ?? (ref.startsWith("/") ? ctx.deployed.get(ref.toLowerCase()) : undefined);
+}
 /** Evaluate an ARM expression string (`"[...]"`); a plain string is returned as-is. */
 export async function evalArmString(s, ctx) {
     if (!(s.startsWith("[") && s.endsWith("]")))
@@ -25,7 +47,11 @@ export async function evalArmString(s, ctx) {
         return s.slice(1); // escaped literal "["
     return new ArmExpr(s.slice(1, -1), ctx).parse();
 }
-/** Recursively evaluate every string in a value against the ARM context. */
+/**
+ * Recursively evaluate every string in a value against the ARM context,
+ * object keys included: ARM evaluates a property name too, and
+ * `identity.userAssignedIdentities` is keyed by `[resourceId(...)]` (#4231).
+ */
 export async function evalArm(value, ctx) {
     if (typeof value === "string")
         return evalArmString(value, ctx);
@@ -34,7 +60,7 @@ export async function evalArm(value, ctx) {
     if (value && typeof value === "object") {
         const out = {};
         for (const [k, v] of Object.entries(value))
-            out[k] = await evalArm(v, ctx);
+            out[String(await evalArmString(k, ctx))] = await evalArm(v, ctx);
         return out;
     }
     return value;
@@ -108,10 +134,14 @@ class ArmExpr {
                 return { subscriptionId: this.ctx.subscriptionId, id: `/subscriptions/${this.ctx.subscriptionId}` };
             case "resourceId":
                 // resourceId('Microsoft.X/y', 'name'[, 'child']) → the resource-id path.
-                return `/subscriptions/${this.ctx.subscriptionId}/resourceGroups/${this.ctx.resourceGroup}/providers/${args.map(String).join("/")}`;
+                return armResourceIdOf(this.ctx, String(args[0]), args.slice(1).map(String).join("/"));
             case "reference": {
-                // reference('name') → the runtime `properties` of an already-applied resource.
-                const dep = this.ctx.deployed.get(String(args[0]));
+                // reference('name' | resourceId(...)[, apiVersion[, 'Full']]) → the
+                // runtime `properties` of an already-applied resource, or its whole
+                // body with 'Full' (#4243).
+                const dep = lookupDeployed(this.ctx, String(args[0]));
+                if (String(args[2] ?? "").toLowerCase() === "full")
+                    return dep;
                 return dep?.properties ?? dep;
             }
             case "listKeys": {
@@ -224,21 +254,23 @@ export function orderArmResources(resources) {
 /** The ARM resource-ID PUT URL for a resource (name expression evaluated). */
 export async function armResourceUrl(resource, ctx) {
     const name = await evalArmString(resource.name, ctx);
-    return `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${resource.type}/${name}?api-version=${resource.apiVersion}`;
+    return `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${armResourcePath(resource.type, String(name))}?api-version=${resource.apiVersion}`;
 }
-/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. */
+/**
+ * The top-level ARM resource fields a PUT takes beside `location` (#4231). A
+ * field missing here is dropped from the body, which is how a declared
+ * `identity` came back absent.
+ */
+const ARM_BODY_FIELDS = ["properties", "sku", "kind", "tags", "identity", "zones", "plan", "extendedLocation", "managedBy"];
+/** The ARM resource PUT body: `location` and {@link ARM_BODY_FIELDS}, expressions evaluated. */
 export async function armResourceBody(resource, ctx) {
     const body = {};
     if (resource.location)
         body.location = await evalArmString(resource.location, ctx);
-    if (resource.properties !== undefined)
-        body.properties = await evalArm(resource.properties, ctx);
-    if (resource.sku !== undefined)
-        body.sku = await evalArm(resource.sku, ctx);
-    if (resource.kind !== undefined)
-        body.kind = await evalArm(resource.kind, ctx);
-    if (resource.tags !== undefined)
-        body.tags = await evalArm(resource.tags, ctx);
+    for (const field of ARM_BODY_FIELDS) {
+        if (resource[field] !== undefined)
+            body[field] = await evalArm(resource[field], ctx);
+    }
     return body;
 }
 /**
@@ -277,7 +309,7 @@ export async function azApply(args, signal, http = defaultHttp) {
         }
         // Capture the applied resource so later reference()/dependents resolve.
         try {
-            ctx.deployed.set(name, JSON.parse(res.text));
+            rememberDeployed(ctx, resource.type, name, JSON.parse(res.text));
         }
         catch {
             // non-JSON response — reference() to this resource resolves to undefined
@@ -366,7 +398,7 @@ export async function listGroupResources(ctx, http = defaultHttp, signal) {
 }
 /** Idempotently delete one ARM resource by type/name/apiVersion. A 404 means it is already gone. */
 export async function deleteArmResource(type, name, apiVersion, ctx, http = defaultHttp, signal) {
-    const url = `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${type}/${name}?api-version=${apiVersion}`;
+    const url = `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${armResourcePath(type, name)}?api-version=${apiVersion}`;
     const res = await http("DELETE", url, undefined, signal);
     if (res.status === 404)
         return { type, name, deleted: false };

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AA0B5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aA4dzB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AA2B5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aA8dzB,CAAC"}

package/dist/plugin.js

@@ -9,6 +9,7 @@ import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { moduleSourceDir } from "@intentius/chant/module-source";
 import { azureSerializer } from "./serializer.js";
+import { azureGraphEdges } from "./graph-edges.js";
 import { hardcodedLocationRule } from "./lint/rules/hardcoded-location.js";
 import { storageHttpsRule } from "./lint/rules/storage-https.js";
 import { nsgWildcardRule } from "./lint/rules/nsg-wildcard.js";
@@ -30,6 +31,8 @@ export const azurePlugin = {
     emulator: FLOCI_AZ_EMULATOR,
     auditCatalog: () => azureAuditCatalog,
     serializer: azureSerializer,
+    // References written as ARM expressions (resourceId, reference, listKeys) as graph edges (#4232).
+    graphEdges: (entities) => azureGraphEdges(entities),
     lintRules() {
         return [hardcodedLocationRule, storageHttpsRule, nsgWildcardRule];
     },

package/dist/rules/arm-refs.ts

@@ -56,6 +56,8 @@ export function parseArmTemplate(output: string | { primary: string }): ArmTempl
  * - [reference('myStorage')]
  * - [reference('myStorage').primaryEndpoints.blob]
  *
+ * Object keys are read as well as values.
+ *
  * Returns the set of resource names found in these references.
  */
 export function findArmResourceRefs(value: unknown): Set<string> {
@@ -121,7 +123,10 @@ function walkArmValue(value: unknown, refs: Set<string>): void {
 
   if (typeof value === "object") {
     const obj = value as Record<string, unknown>;
-    for (const val of Object.values(obj)) {
+    for (const [key, val] of Object.entries(obj)) {
+      // A key can be an expression too: a user-assigned identity is named by
+      // its resource ID as the key of identity.userAssignedIdentities.
+      walkArmValue(key, refs);
       walkArmValue(val, refs);
     }
   }

package/dist/serializer.d.ts

@@ -31,6 +31,15 @@ export declare function getApiVersion(resourceType: string): string;
  * reads `reference()` by the ARM name.
  */
 export declare function armAttrExpression(entityNames: Map<Declarable, string>, name: string, attr: string): string;
+/** A prop value as the template writes it: references become bracket expressions. */
+export declare function toArmValue(value: unknown, entityNames: Map<Declarable, string>): unknown;
+/**
+ * The name a resource takes in the template: its `name` prop, or the entity
+ * key when it sets none. `findArmResourceRefs` reports references by this
+ * name, so the dependsOn inference below and the graph edges
+ * (./graph-edges.ts) both resolve a reference through it.
+ */
+export declare function armResourceName(entity: Declarable, key: string, entityNames: Map<Declarable, string>): unknown;
 /**
  * Azure ARM template serializer implementation.
  */

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,6BAA6B,CAAC;AAE7E,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA8ElG,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAqB,GAAG,MAAM,EAAE,CAKjF;AAED,wBAAgB,eAAe,CAAC,UAAU,GAAE,MAAM,EAAmC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB1G;AAcD,yEAAyE;AACzE,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWzE;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAO1D;AA6BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAK1G;AAiWD;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA+C7B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,6BAA6B,CAAC;AAE7E,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA8ElG,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAqB,GAAG,MAAM,EAAE,CAKjF;AAED,wBAAgB,eAAe,CAAC,UAAU,GAAE,MAAM,EAAmC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB1G;AAcD,yEAAyE;AACzE,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWzE;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAO1D;AA6BD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAK1G;AAoDD,qFAAqF;AACrF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,OAAO,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,OAAO,CAK9G;AA2SD;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA+C7B,CAAC"}