@intentius/chant-lexicon-azure 0.124.34 → 0.124.36

package/dist/serializer.js

@@ -9,6 +9,7 @@
  * - ARM bracket expression references
  * - parameters, outputs sections
  */
+import { armType } from "./arm-type.js";
 import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
 import { ownershipEntries } from "@intentius/chant/ownership";
 import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership.js";
@@ -144,7 +145,7 @@ function entityNamed(entityNames, name) {
 function armResourceId(entityNames, name) {
     const entity = entityNamed(entityNames, name);
     const { args } = armNameArgs(entity, name);
-    return entity ? `resourceId('${entity.entityType}', ${args})` : `resourceId(${args})`;
+    return entity ? `resourceId('${armType(entity.entityType)}', ${args})` : `resourceId(${args})`;
 }
 /**
  * An attribute of an export. `id` is `resourceId()`, since `reference()`
@@ -208,9 +209,22 @@ function isPlainObject(value) {
     const proto = Object.getPrototypeOf(value);
     return proto === Object.prototype || proto === null;
 }
-function toArmValue(value, entityNames) {
+/** A prop value as the template writes it: references become bracket expressions. */
+export function toArmValue(value, entityNames) {
     return walkValue(value, entityNames, armVisitor(entityNames));
 }
+/**
+ * The name a resource takes in the template: its `name` prop, or the entity
+ * key when it sets none. `findArmResourceRefs` reports references by this
+ * name, so the dependsOn inference below and the graph edges
+ * (./graph-edges.ts) both resolve a reference through it.
+ */
+export function armResourceName(entity, key, entityNames) {
+    const props = isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null
+        ? entity.props
+        : undefined;
+    return props?.name !== undefined ? toArmValue(props.name, entityNames) : key;
+}
 /**
  * Serialize entities into an ARM template object.
  */
@@ -237,7 +251,7 @@ function serializeToTemplate(entities, outputs, ownership, warnings = []) {
             emittedTypes.push("Microsoft.Resources/deployments");
         }
         else if (!isPropertyDeclarable(entity)) {
-            emittedTypes.push(entity.entityType);
+            emittedTypes.push(armType(entity.entityType));
         }
     }
     const templateScope = pinnedScope ?? resolveTemplateScope(emittedTypes);
@@ -307,9 +321,9 @@ function serializeToTemplate(entities, outputs, ownership, warnings = []) {
                 : undefined;
             const apiVersion = (typeof attrs0?.apiVersion === "string") ? attrs0.apiVersion : getApiVersion(resourceType);
             const resource = {
-                type: resourceType,
+                type: armType(resourceType),
                 apiVersion,
-                name: name,
+                name: armResourceName(entity, name, entityNames),
             };
             // Extract all props
             if (isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null) {
@@ -323,7 +337,7 @@ function serializeToTemplate(entities, outputs, ownership, warnings = []) {
                         resource[key] = toArmValue(value, entityNames);
                     }
                     else if (key === "name") {
-                        resource.name = toArmValue(value, entityNames);
+                        // Set above by armResourceName.
                     }
                     else if (key === "properties" && isPlainObject(value)) {
                         // The generated types take ARM's own `properties` object, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.124.34",
+  "version": "0.124.36",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,6 +74,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.34"
+    "@intentius/chant": "^0.124.36"
   }
 }

package/src/api/read-client.ts

@@ -19,6 +19,7 @@
  * token acquisition lands here.
  */
 
+import { armResourcePath } from "../arm-type";
 import { type AzHttp } from "../op/activities/az-apply";
 
 /** Default ARM host, matching the applier's. */
@@ -78,7 +79,7 @@ export function armResourceReadUrl(
 ): string {
   const base = (options.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
   const subscription = options.subscriptionId ?? DEFAULT_SUBSCRIPTION;
-  return `${base}/subscriptions/${subscription}/resourceGroups/${options.resourceGroup}/providers/${type}/${name}?api-version=${apiVersion}`;
+  return `${base}/subscriptions/${subscription}/resourceGroups/${options.resourceGroup}/providers/${armResourcePath(type, name)}?api-version=${apiVersion}`;
 }
 
 /**

package/src/arm-type.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, test } from "vitest";
+import { armResourcePath, armType } from "./arm-type";
+import { azureSerializer } from "./serializer";
+import { armResourceReadUrl } from "./api/read-client";
+import { armResourceUrl, evalArmString, type ArmEvalCtx } from "./op/activities/az-apply";
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+import { AttrRef } from "@intentius/chant";
+
+describe("ARM child types (#4230)", () => {
+  test("armType joins child types with /", () => {
+    expect(armType("Microsoft.Network/virtualNetworks_subnets")).toBe("Microsoft.Network/virtualNetworks/subnets");
+    expect(armType("Microsoft.Storage/storageAccounts_blobServices_containers")).toBe("Microsoft.Storage/storageAccounts/blobServices/containers");
+    expect(armType("Microsoft.Storage/storageAccounts")).toBe("Microsoft.Storage/storageAccounts");
+    expect(armType("Microsoft.Network/virtualNetworks/subnets")).toBe("Microsoft.Network/virtualNetworks/subnets");
+  });
+
+  test("armResourcePath interleaves type and name segments", () => {
+    expect(armResourcePath("Microsoft.Network/virtualNetworks_subnets", "vnet/apps")).toBe("Microsoft.Network/virtualNetworks/vnet/subnets/apps");
+    expect(armResourcePath("Microsoft.Storage/storageAccounts", "st1")).toBe("Microsoft.Storage/storageAccounts/st1");
+  });
+
+  test("a Subnet serializes type, resourceId and dependsOn with /", () => {
+    const entity = (entityType: string, props: Record<string, unknown>): Declarable =>
+      ({ [DECLARABLE_MARKER]: true, lexicon: "azure", entityType, kind: "resource", props }) as unknown as Declarable;
+    const subnet = entity("Microsoft.Network/virtualNetworks_subnets", { name: "vnet/apps", addressPrefix: "10.0.1.0/24" });
+    const subnetId = new AttrRef(subnet, "id");
+    subnetId._setLogicalName("apps");
+    const nic = entity("Microsoft.Network/networkInterfaces", { name: "nic1", subnetId });
+    const entities = new Map<string, Declarable>([["apps", subnet], ["nic", nic]]);
+    const template = JSON.parse(azureSerializer.serialize(entities) as string);
+    const [s, n] = template.resources;
+    expect(s.type).toBe("Microsoft.Network/virtualNetworks/subnets");
+    expect(JSON.stringify(template)).not.toContain("virtualNetworks_subnets");
+    expect(n.properties.subnetId).toBe("[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]");
+    expect(n.dependsOn).toContain("[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]");
+  });
+
+  test("apply and read address a child resource by its ARM path", async () => {
+    const ctx = { base: "http://x", subscriptionId: "sub-1", resourceGroup: "rg", location: "eastus", deployed: new Map() } as unknown as ArmEvalCtx;
+    const want = "http://x/subscriptions/sub-1/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/apps?api-version=2024-01-01";
+    expect(await armResourceUrl({ type: "Microsoft.Network/virtualNetworks/subnets", apiVersion: "2024-01-01", name: "vnet/apps" }, ctx)).toBe(want);
+    expect(armResourceReadUrl({ endpoint: "http://x", subscriptionId: "sub-1", resourceGroup: "rg" }, "Microsoft.Network/virtualNetworks_subnets", "vnet/apps", "2024-01-01")).toBe(want);
+    expect(await evalArmString("[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]", ctx)).toBe(
+      "/subscriptions/sub-1/resourceGroups/rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/apps",
+    );
+  });
+});

package/src/arm-type.ts

@@ -0,0 +1,31 @@
+/**
+ * ARM resource types as ARM spells them (#4230).
+ *
+ * The lexicon's entity types come from the ARM schema ids, which join a child
+ * type to its parent with `_` (`Microsoft.Network/virtualNetworks_subnets`).
+ * ARM itself joins them with `/` (`Microsoft.Network/virtualNetworks/subnets`),
+ * in a template's `type`, in `resourceId()` and in the resource URL. Resource
+ * type segments never contain `_`, so every `_` after the namespace is a
+ * child separator.
+ */
+
+/** `Microsoft.Network/virtualNetworks_subnets` → `Microsoft.Network/virtualNetworks/subnets`. Idempotent. */
+export function armType(entityType: string): string {
+  const slash = entityType.indexOf("/");
+  if (slash < 0) return entityType;
+  return entityType.slice(0, slash + 1) + entityType.slice(slash + 1).replace(/_/g, "/");
+}
+
+/**
+ * The provider-relative path of one resource: each type segment followed by
+ * its name segment, as ARM's `resourceId()` builds it.
+ * `('Microsoft.Network/virtualNetworks/subnets', 'vnet/apps')` →
+ * `Microsoft.Network/virtualNetworks/vnet/subnets/apps`. A name with fewer
+ * segments than the type has kinds is joined as given.
+ */
+export function armResourcePath(type: string, name: string): string {
+  const [namespace, ...kinds] = armType(type).split("/");
+  const names = name.split("/");
+  if (kinds.length <= 1 || names.length !== kinds.length) return `${armType(type)}/${name}`;
+  return [namespace, ...kinds.flatMap((kind, i) => [kind, names[i]])].join("/");
+}

package/src/deep-observe.test.ts

@@ -18,7 +18,7 @@ const stubArmFetch = (response: { status: number; text: string }): void => {
 };
 
 const { azurePlugin } = await import("./plugin");
-const { observeResourcesDeepAzure, azureDeepNormalizationHooks } = await import("./deep-observe");
+const { observeResourcesDeepAzure, azureDeepNormalizationHooks, userAssignedIdentityKey } = await import("./deep-observe");
 const { deepDiffForLexicon } = await import("@intentius/chant/lifecycle/deep-observe");
 const { normalizeDeepObservation, normalizeDeepProperties, UNRESOLVED } = await import("@intentius/chant/deep-observation");
 
@@ -599,3 +599,58 @@ describe("end to end: declared + mutated live + baseline (#1086)", () => {
     ).toBe(true);
   });
 });
+
+describe("user-assigned identities (#4231)", () => {
+  const identityId = (name: string) =>
+    `/subscriptions/sub/resourceGroups/Prod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${name}`;
+  const declared = entities({
+    web: {
+      entityType: "Microsoft.App/containerApps",
+      props: {
+        name: "web",
+        location: "eastus",
+        identity: {
+          type: "UserAssigned",
+          userAssignedIdentities: { "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'appId')]": {} },
+        },
+      },
+    },
+  });
+  const liveWith = (name: string) =>
+    stubArmFetch(ok({
+      id: "/subscriptions/sub/resourceGroups/prod/providers/Microsoft.App/containerApps/web",
+      name: "web",
+      location: "eastus",
+      identity: {
+        type: "UserAssigned",
+        principalId: "p0",
+        tenantId: "t0",
+        userAssignedIdentities: { [identityId(name)]: { principalId: "p1", clientId: "c1" } },
+      },
+      properties: { provisioningState: "Succeeded" },
+    }));
+
+  test("both spellings of an identity's key are one key", () => {
+    expect(userAssignedIdentityKey("[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'appId')]")).toBe(
+      "microsoft.managedidentity/userassignedidentities/appid",
+    );
+    expect(userAssignedIdentityKey(identityId("appId"))).toBe("microsoft.managedidentity/userassignedidentities/appid");
+    expect(userAssignedIdentityKey("plain")).toBe("plain");
+  });
+
+  test("an applied identity is not drift", async () => {
+    liveWith("appId");
+    const result = await deepDiffForLexicon(azurePlugin, { environment: "prod", buildOutput: "", entities: declared });
+    expect(result.drifted).toEqual([]);
+    expect(result.unclaimed).toEqual([]);
+    expect(result.unchanged).toEqual(["web"]);
+  });
+
+  test("a different identity attached live is drift", async () => {
+    liveWith("otherId");
+    const result = await deepDiffForLexicon(azurePlugin, { environment: "prod", buildOutput: "", entities: declared });
+    expect(result.drifted.map((d) => d.changes.map((c) => `${c.kind} ${c.path}`))).toEqual([
+      ["absent identity.userAssignedIdentities.microsoft.managedidentity/userassignedidentities/appid"],
+    ]);
+  });
+});

package/src/deep-observe.ts

@@ -240,6 +240,45 @@ function lastSegment(pattern: string): string {
   return dot === -1 ? withoutIndex : withoutIndex.slice(dot + 1);
 }
 
+/**
+ * The canonical key for one entry of `identity.userAssignedIdentities`
+ * (#4231): `<type>/<name>` lowercased, from either spelling. Source keys the
+ * map by `[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities',
+ * 'appId')]`; ARM answers with the evaluated id, `/subscriptions/.../providers/
+ * Microsoft.ManagedIdentity/userAssignedIdentities/appId`, in whatever case it
+ * stored. A key in neither form is left as it is.
+ */
+export function userAssignedIdentityKey(key: string): string {
+  const expr = /^\[\s*resourceId\(\s*'([^']+)'\s*,\s*'([^']+)'\s*\)\s*\]$/.exec(key);
+  if (expr) return `${expr[1]}/${expr[2]}`.toLowerCase();
+  const at = key.toLowerCase().lastIndexOf("/providers/");
+  if (at !== -1 && key.startsWith("/subscriptions/")) return key.slice(at + "/providers/".length).toLowerCase();
+  return key;
+}
+
+/**
+ * Rekey `identity.userAssignedIdentities` by {@link userAssignedIdentityKey},
+ * on a copy, and drop the `principalId` and `clientId` ARM fills in on each
+ * entry. Nobody declares them, and pruning them later would leave the live
+ * entry empty and gone, where source declares `{}`.
+ */
+function rekeyUserAssignedIdentities(tree: Record<string, unknown>): Record<string, unknown> {
+  const identity = tree.identity;
+  if (!identity || typeof identity !== "object" || Array.isArray(identity)) return tree;
+  const assigned = (identity as Record<string, unknown>).userAssignedIdentities;
+  if (!assigned || typeof assigned !== "object" || Array.isArray(assigned)) return tree;
+  const rekeyed: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(assigned)) {
+    let entry = v;
+    if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+      const { principalId: _p, clientId: _c, ...rest } = entry as Record<string, unknown>;
+      entry = rest;
+    }
+    rekeyed[userAssignedIdentityKey(k)] = entry;
+  }
+  return { ...tree, identity: { ...(identity as Record<string, unknown>), userAssignedIdentities: rekeyed } };
+}
+
 /**
  * The azure lexicon's noise rules. Three classes, same as AWS: server-
  * populated fields (by name, unconditional), controller-injected boilerplate
@@ -250,6 +289,8 @@ function lastSegment(pattern: string): string {
  * since it is a plain object; only the *default empty map* needs a rule here).
  */
 export const azureDeepNormalizationHooks: DeepNormalizationHooks = {
+  prepare: (tree) => rekeyUserAssignedIdentities(tree),
+
   prune(node: DeepNode): boolean {
     const name = lastSegment(node.pattern);
     if (AZURE_READ_ONLY_NAMES.has(name) || AZURE_UNCONDITIONAL_PRUNE_NAMES.has(name)) return true;

package/src/graph-edges.test.ts

@@ -0,0 +1,94 @@
+import { describe, it, expect } from "vitest";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import { azureGraphEdges } from "./graph-edges";
+import { azureSerializer } from "./serializer";
+import { ListKeys, Reference, ResourceId } from "./intrinsics";
+
+function makeEntity(entityType: string, props: Record<string, unknown> = {}): any {
+  return { [DECLARABLE_MARKER]: true, lexicon: "azure", entityType, kind: "resource", props };
+}
+
+/** behold's three-cloud Azure member, cut down to the two references in #4232. */
+function threeCloud(): Map<string, any> {
+  const entities = new Map<string, any>();
+  entities.set("logs", makeEntity("Microsoft.OperationalInsights/workspaces", { name: "logs", location: "eastus" }));
+  entities.set("appIdentity", makeEntity("Microsoft.ManagedIdentity/userAssignedIdentities", { name: "app-id", location: "eastus" }));
+  entities.set("env", makeEntity("Microsoft.App/managedEnvironments", {
+    name: "env",
+    location: "eastus",
+    appLogsConfiguration: {
+      destination: "log-analytics",
+      logAnalyticsConfiguration: {
+        customerId: "[reference(resourceId('Microsoft.OperationalInsights/workspaces', 'logs')).customerId]",
+        sharedKey: ListKeys(ResourceId("Microsoft.OperationalInsights/workspaces", "logs"), "2022-10-01"),
+      },
+    },
+  }));
+  entities.set("app", makeEntity("Microsoft.App/containerApps", {
+    name: "web",
+    location: "eastus",
+    identity: {
+      type: "UserAssigned",
+      userAssignedIdentities: {
+        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'app-id')]": {},
+      },
+    },
+    managedEnvironmentId: Reference("env"),
+  }));
+  return entities;
+}
+
+describe("azureGraphEdges (#4232)", () => {
+  it("draws env -> logs from reference(resourceId(...)) and listKeys(...)", () => {
+    const refs = azureGraphEdges(threeCloud())!.references;
+    expect(refs).toContainEqual({ from: "env", to: "logs", kind: "ref", viaAttr: "appLogsConfiguration" });
+    expect(refs.filter((r) => r.from === "env" && r.to === "logs")).toHaveLength(1);
+  });
+
+  it("draws app -> identity from a resourceId(...) object key, by the identity's ARM name", () => {
+    const refs = azureGraphEdges(threeCloud())!.references;
+    expect(refs).toContainEqual({ from: "app", to: "appIdentity", kind: "ref", viaAttr: "identity" });
+    expect(refs).toContainEqual({ from: "app", to: "env", kind: "ref", viaAttr: "managedEnvironmentId" });
+  });
+
+  it("agrees with the dependsOn the serializer writes", () => {
+    const entities = threeCloud();
+    const template = JSON.parse(azureSerializer.serialize(entities) as string);
+    const keyOfName = new Map<string, string>([["logs", "logs"], ["app-id", "appIdentity"], ["env", "env"], ["web", "app"]]);
+    const fromTemplate = new Set<string>();
+    for (const r of template.resources) {
+      for (const dep of r.dependsOn ?? []) {
+        const name = /'([^']+)'\)\]$/.exec(dep)![1];
+        fromTemplate.add(`${keyOfName.get(r.name)}->${keyOfName.get(name)}`);
+      }
+    }
+    const fromGraph = new Set(azureGraphEdges(entities)!.references.map((r) => `${r.from}->${r.to}`));
+    expect(fromGraph).toEqual(fromTemplate);
+    expect(fromGraph).toEqual(new Set(["env->logs", "app->appIdentity", "app->env"]));
+  });
+
+  it("matches a child resource by name whichever way its type is spelled, and links it to its parent", () => {
+    const entities = new Map<string, any>();
+    entities.set("vnet", makeEntity("Microsoft.Network/virtualNetworks", { name: "vnet", location: "eastus" }));
+    entities.set("apps", makeEntity("Microsoft.Network/virtualNetworks_subnets", { name: "vnet/apps" }));
+    entities.set("nic", makeEntity("Microsoft.Network/networkInterfaces", {
+      name: "nic",
+      location: "eastus",
+      ipConfigurations: [{ name: "ip", properties: { subnet: { id: "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')]" } } }],
+    }));
+    const refs = azureGraphEdges(entities)!.references;
+    expect(refs).toContainEqual({ from: "nic", to: "apps", kind: "ref", viaAttr: "ipConfigurations" });
+    expect(refs).toContainEqual({ from: "apps", to: "vnet", kind: "ref", viaAttr: "name" });
+  });
+
+  it("leaves out a name nothing declares, and returns nothing without azure resources", () => {
+    const entities = new Map<string, any>();
+    entities.set("app", makeEntity("Microsoft.Web/sites", {
+      name: "site",
+      location: "eastus",
+      serverFarmId: "[resourceId('Microsoft.Web/serverfarms', 'existing-plan')]",
+    }));
+    expect(azureGraphEdges(entities)).toBeUndefined();
+    expect(azureGraphEdges(new Map())).toBeUndefined();
+  });
+});

package/src/graph-edges.ts

@@ -0,0 +1,72 @@
+/**
+ * References written as ARM expressions, as graph edges (#4232).
+ *
+ * `chant graph` draws an edge for every `AttrRef` it finds in props, but an
+ * Azure reference is often an expression instead: `reference(resourceId(...))
+ * .customerId` and `listKeys(...)` for a value the resource has no attribute
+ * for, or a `resourceId(...)` used as an object key, which is how
+ * `identity.userAssignedIdentities` names an identity. The serializer already
+ * reads these to write `dependsOn` (./serializer.ts), with
+ * `findArmResourceRefs` (./lint/post-synth/arm-refs.ts). This module runs the
+ * same extraction over each prop as the template writes it and reports each
+ * reference to a declared resource through the plugin's `graphEdges` hook.
+ *
+ * A reference matches by resource name, never by type, as the serializer's
+ * inference does. A name nothing in the project declares is left out: it is
+ * an existing resource the template reads, not a dangling reference.
+ */
+
+import type { Declarable } from "@intentius/chant/declarable";
+import { isPropertyDeclarable, isResourceDeclarable } from "@intentius/chant/declarable";
+import type { LexiconGraphEdges, LexiconGraphReference } from "@intentius/chant/graph-ir";
+import { findArmResourceRefs } from "./lint/post-synth/arm-refs";
+import { armResourceName, toArmValue } from "./serializer";
+
+function isAzureResource(entity: Declarable): boolean {
+  return entity.lexicon === "azure" && isResourceDeclarable(entity) && !isPropertyDeclarable(entity);
+}
+
+export function azureGraphEdges(entities: ReadonlyMap<string, Declarable>): LexiconGraphEdges | undefined {
+  const entityNames = new Map<Declarable, string>();
+  for (const [key, entity] of entities) entityNames.set(entity, key);
+
+  // Template name -> entity key, for the resources whose name is a literal.
+  const byArmName = new Map<string, string>();
+  for (const [key, entity] of entities) {
+    if (!isAzureResource(entity)) continue;
+    const name = armResourceName(entity, key, entityNames);
+    if (typeof name === "string") byArmName.set(name, key);
+  }
+  if (byArmName.size === 0) return undefined;
+
+  const references: LexiconGraphReference[] = [];
+  const seen = new Set<string>();
+  const add = (from: string, to: string | undefined, viaAttr: string): void => {
+    if (!to || to === from) return;
+    const id = `${from}\0${to}\0${viaAttr}`;
+    if (seen.has(id)) return;
+    seen.add(id);
+    references.push({ from, to, kind: "ref", viaAttr });
+  };
+
+  for (const [key, entity] of entities) {
+    if (!isAzureResource(entity)) continue;
+    const props = (entity as { props?: unknown }).props;
+    if (props && typeof props === "object") {
+      for (const [attr, value] of Object.entries(props as Record<string, unknown>)) {
+        if (value === undefined) continue;
+        for (const ref of findArmResourceRefs(toArmValue(value, entityNames))) {
+          add(key, byArmName.get(ref), attr);
+        }
+      }
+    }
+    // A child resource named "vnet/subnet" depends on "vnet", as the
+    // serializer infers for dependsOn.
+    const name = armResourceName(entity, key, entityNames);
+    if (typeof name === "string" && name.includes("/")) {
+      add(key, byArmName.get(name.split("/")[0]), "name");
+    }
+  }
+
+  return references.length > 0 ? { references } : undefined;
+}

package/src/lint/post-synth/arm-refs.ts

@@ -56,6 +56,8 @@ export function parseArmTemplate(output: string | { primary: string }): ArmTempl
  * - [reference('myStorage')]
  * - [reference('myStorage').primaryEndpoints.blob]
  *
+ * Object keys are read as well as values.
+ *
  * Returns the set of resource names found in these references.
  */
 export function findArmResourceRefs(value: unknown): Set<string> {
@@ -121,7 +123,10 @@ function walkArmValue(value: unknown, refs: Set<string>): void {
 
   if (typeof value === "object") {
     const obj = value as Record<string, unknown>;
-    for (const val of Object.values(obj)) {
+    for (const [key, val] of Object.entries(obj)) {
+      // A key can be an expression too: a user-assigned identity is named by
+      // its resource ID as the key of identity.userAssignedIdentities.
+      walkArmValue(key, refs);
       walkArmValue(val, refs);
     }
   }

package/src/op/activities/az-apply.test.ts

@@ -20,6 +20,7 @@ import {
   type ArmResource,
   type AzHttp,
   providerApiVersion,
+  rememberDeployed,
 } from "./az-apply";
 import { lookupApiVersion } from "../../serializer";
 
@@ -69,6 +70,54 @@ describe("evalArmString — reference() (#707)", () => {
   });
 });
 
+describe("evalArmString — reference() by resource id (#4243)", () => {
+  test("reference(resourceId(...)).customerId resolves the resource applied by name", async () => {
+    const c = ctx();
+    rememberDeployed(c, "Microsoft.OperationalInsights/workspaces", "logs", { properties: { customerId: "cust-1" } });
+    expect(await evalArmString("[reference(resourceId('Microsoft.OperationalInsights/workspaces', 'logs')).customerId]", c)).toBe("cust-1");
+    expect(await evalArmString("[reference('logs').customerId]", c)).toBe("cust-1");
+  });
+
+  test("a child type, a full id in another case, and 'Full'", async () => {
+    const c = ctx();
+    rememberDeployed(c, "Microsoft.Network/virtualNetworks/subnets", "vnet/apps", {
+      id: "/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/apps",
+      properties: { addressPrefix: "10.0.1.0/24" },
+    });
+    expect(await evalArmString("[reference(resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps')).addressPrefix]", c)).toBe("10.0.1.0/24");
+    expect(
+      await evalArmString("[reference('/SUBSCRIPTIONS/sub-1/resourceGroups/chant-rg/providers/Microsoft.Network/virtualNetworks/vnet/subnets/apps').addressPrefix]", c),
+    ).toBe("10.0.1.0/24");
+    expect(await evalArmString("[reference(resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'apps'), '2023-04-01', 'Full').properties.addressPrefix]", c)).toBe("10.0.1.0/24");
+  });
+
+  test("azApply: a later resource reads an earlier one through reference(resourceId(...))", async () => {
+    const path = `/tmp/chant-4243-${process.pid}.json`;
+    writeFileSync(path, JSON.stringify({
+      resources: [
+        { type: "Microsoft.OperationalInsights/workspaces", apiVersion: "2022-10-01", name: "logs", location: "eastus", properties: {} },
+        {
+          type: "Microsoft.App/managedEnvironments", apiVersion: "2024-03-01", name: "env", location: "eastus",
+          dependsOn: ["[resourceId('Microsoft.OperationalInsights/workspaces', 'logs')]"],
+          properties: { appLogsConfiguration: { logAnalyticsConfiguration: { customerId: "[reference(resourceId('Microsoft.OperationalInsights/workspaces', 'logs')).customerId]" } } },
+        },
+      ],
+    }));
+    const bodies: Record<string, unknown> = {};
+    const http: AzHttp = async (method, url, body) => {
+      if (method === "PUT" && url.includes("/workspaces/logs")) return { status: 200, text: JSON.stringify({ properties: { customerId: "cust-1" } }) };
+      if (method === "PUT" && url.includes("/managedEnvironments/env")) bodies.env = body;
+      return { status: 200, text: "{}" };
+    };
+    try {
+      await azApply({ templatePath: path, resourceGroup: "chant-rg", subscriptionId: "sub-1", endpoint: "http://x" }, undefined, http);
+    } finally {
+      unlinkSync(path);
+    }
+    expect((bodies.env as { properties: { appLogsConfiguration: { logAnalyticsConfiguration: { customerId: string } } } }).properties.appLogsConfiguration.logAnalyticsConfiguration.customerId).toBe("cust-1");
+  });
+});
+
 describe("evalArmString — listKeys() (#707)", () => {
   test("listKeys(resourceId(...), v).keys[0].value → POSTs the key action and indexes", async () => {
     const calls: string[] = [];
@@ -149,6 +198,38 @@ describe("armResourceUrl / armResourceBody (#707)", () => {
       tags: { "managed-by": "chant" },
     });
   });
+
+  test("body keeps identity, zones, plan, extendedLocation and managedBy, keys evaluated (#4231)", async () => {
+    const app: ArmResource = {
+      type: "Microsoft.App/containerApps",
+      apiVersion: "2024-03-01",
+      name: "web",
+      location: "[resourceGroup().location]",
+      identity: {
+        type: "UserAssigned",
+        userAssignedIdentities: { "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'appId')]": {} },
+      },
+      zones: ["1"],
+      plan: { name: "p1", publisher: "pub", product: "prod" },
+      extendedLocation: { type: "EdgeZone", name: "edge1" },
+      managedBy: "[resourceId('Microsoft.Web/sites', 'owner')]",
+      properties: {},
+    };
+    expect(await armResourceBody(app, ctx())).toEqual({
+      location: "eastus",
+      properties: {},
+      identity: {
+        type: "UserAssigned",
+        userAssignedIdentities: {
+          "/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/appId": {},
+        },
+      },
+      zones: ["1"],
+      plan: { name: "p1", publisher: "pub", product: "prod" },
+      extendedLocation: { type: "EdgeZone", name: "edge1" },
+      managedBy: "/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.Web/sites/owner",
+    });
+  });
 });
 
 describe("azApply flow (#707)", () => {