@intentius/chant-lexicon-azure 0.124.39 → 0.124.40

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGxG,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EACtE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EACzE,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,mBAAmB,EACtC,sBAAsB,EAAE,oBAAoB,EAC5C,2CAA2C,EAAE,4BAA4B,GAC1E,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,qBAAqB,EAAE,sBAAsB,EAC7C,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,GACxD,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGxG,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EACtE,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EACzE,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,mBAAmB,EACtC,sBAAsB,EAAE,oBAAoB,EAC5C,2CAA2C,EAAE,4BAA4B,GAC1E,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,qBAAqB,EAAE,sBAAsB,EAC7C,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,GACxD,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -15,6 +15,9 @@ export { defaultTags } from "./default-tags.js";
 export { deploymentScope, isDeploymentScope } from "./deploy-scopes.js";
 export { azureSerializer } from "./serializer.js";
 export { azurePlugin } from "./plugin.js";
+// Core's capability-plugin loader scans this package's exports and loads
+// `azureCapabilityPlugin` when a project's chant.config lists this lexicon (#4273).
+export { azureCapabilityPlugin } from "./components/capability-plugin.js";
 export { Parameter } from "./parameter.js";
 // Deep observation (#1086): the `az resource show` reader and the noise
 // rules it shares with core's normalization pass.

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "6a7ba60e1ad5cc1b94809c91f7dab1293ceec2074f2600f4b8ce4ea81a242421",
+    "manifest.json": "bc610c4143712ac195d56822a922054f5f94b9251a30403488a71c273bae7278",
     "meta.json": "d2521221ed616d882ded4296f0071685bd74e4b645d55dabc9685733c37dc419",
     "types/index.d.ts": "29631032bda9533849178968290e65d72250eab0b8bab424f2d9ef9b4e8546a4",
     "rules/hardcoded-location.ts": "0b895449c8c94066e81721c46be24249231029fe13b471477456df5c4e45b8bf",
@@ -37,5 +37,5 @@
     "skills/chant-azure-patterns.md": "2d8cb8bbeda73b695856cec4ddaf5b3a0efce76e4ee6e3cf14b90ca69dee5757",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "2dba446de8873706991b76fe0621dcb83200ee6771fdbe1dd4334ac10ecddfb0"
+  "composite": "f5d39f472b9337b9f6729b1a6adf719e59ad3dada43de344bdf112c2f0b3b409"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.124.39",
+  "version": "0.124.40",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.124.39",
+  "version": "0.124.40",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -39,6 +39,11 @@
       "types": "./dist/*.d.ts",
       "default": "./dist/*.js"
     },
+    "./components": {
+      "development": "./src/components/index.ts",
+      "types": "./dist/components/index.d.ts",
+      "default": "./dist/components/index.js"
+    },
     "./detect": {
       "development": "./src/detect.ts",
       "types": "./dist/detect.d.ts",
@@ -74,6 +79,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.39"
+    "@intentius/chant": "^0.124.40"
   }
 }

package/src/components/arm-deploy-floci.e2e.test.ts

@@ -0,0 +1,80 @@
+/**
+ * `arm-deploy`'s plan and apply against floci-az (#4273), over `fetch`. Set
+ * CHANT_FLOCI_AZ_ENDPOINT to a running floci-az, for example
+ * `docker run -d --name chant-floci-az-e2e -p 4577:4577 floci/floci-az:0.10.0`
+ * and `CHANT_FLOCI_AZ_ENDPOINT=http://localhost:4577`. Skipped without it.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { azDelete } from "../op/activities/az-apply";
+import { ArmDeployPlanMovedError, createArmDeployCapability } from "./arm-deploy";
+
+const endpoint = process.env.CHANT_FLOCI_AZ_ENDPOINT;
+
+describe.skipIf(!endpoint)("arm-deploy plan against floci-az (#4273)", () => {
+  const resourceGroup = `chant-arm-plan-${process.pid}`;
+  const ctx = { env: "local", component: resourceGroup };
+  const saved = { ...process.env };
+  let dir: string;
+  let template: string;
+  const account = (accessTier: string) => ({
+    type: "Microsoft.Storage/storageAccounts",
+    apiVersion: "2023-01-01",
+    name: `chantplan${process.pid}`,
+    location: "[resourceGroup().location]",
+    sku: { name: "Standard_LRS" },
+    kind: "StorageV2",
+    properties: { accessTier },
+  });
+  const write = (accessTier: string): void =>
+    writeFileSync(
+      template,
+      JSON.stringify({
+        resources: [account(accessTier)],
+        outputs: { group: { type: "string", value: "[resourceGroup().name]" } },
+      }),
+    );
+
+  beforeAll(() => {
+    process.env.AZURE_ENDPOINT_URL = endpoint;
+    dir = mkdtempSync(join(tmpdir(), "arm-plan-floci-az-"));
+    template = join(dir, "deploymentTemplate.json");
+  });
+
+  afterAll(async () => {
+    try {
+      await azDelete({ templatePath: template, resourceGroup, endpoint });
+    } catch { /* never created */ }
+    process.env = saved;
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("plans a create, applies it, plans no change, plans an update and refuses a plan the template moved past", async () => {
+    const capability = createArmDeployCapability();
+    const input = { template, resourceGroup };
+
+    write("Hot");
+    const created = await capability.plan!(ctx, input);
+    expect(created.changeSet!.entries.map((e) => e.action)).toEqual(["create"]);
+    const first = await capability.run({ ...ctx, plans: { [resourceGroup]: created.artifact } }, input);
+    expect(first.applied).toHaveLength(1);
+    expect(first.outputs).toEqual({ group: resourceGroup });
+
+    const same = await capability.plan!(ctx, input);
+    expect(same.changeSet!.entries.map((e) => e.action)).toEqual(["no-op"]);
+
+    write("Cool");
+    const updated = await capability.plan!(ctx, input);
+    expect(updated.changeSet!.entries.map((e) => [e.action, e.attributes])).toEqual([
+      ["update", [{ path: "accessTier", before: "Hot", after: "Cool" }]],
+    ]);
+
+    // The template moves after the plan: run refuses and changes nothing.
+    write("Hot");
+    await expect(capability.run({ ...ctx, plans: { [resourceGroup]: updated.artifact } }, input)).rejects.toBeInstanceOf(ArmDeployPlanMovedError);
+    expect((await capability.plan!(ctx, input)).changeSet!.entries.map((e) => e.action)).toEqual(["no-op"]);
+  }, 120_000);
+});

package/src/components/arm-deploy.test.ts

@@ -0,0 +1,256 @@
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { isPlanMovedError, type DeployContext } from "@intentius/chant/components/capability";
+import { isCapabilityPlugin } from "@intentius/chant/components/capability-plugin";
+import { deployUnits } from "@intentius/chant/components/deploy-units";
+import type { AzHttp } from "../op/activities/az-apply";
+import { ArmDeployPlanMovedError, createArmDeployCapability, type ArmDeployInput } from "./arm-deploy";
+import { azureCapabilityPlugin } from "./capability-plugin";
+
+const ENDPOINT = "http://floci-az.test";
+
+/**
+ * An in-memory ARM resource group behind the `AzHttp` seam: PUT stores a
+ * resource the way ARM answers (id, leaf name, type, provisioningState),
+ * GET reads it or answers 404, the group listing lists it and DELETE removes it.
+ */
+function fakeArm(options: { dropTags?: boolean; fail?: (method: string, url: string) => number | undefined } = {}) {
+  const store = new Map<string, Record<string, unknown>>();
+  const calls: Array<{ method: string; url: string }> = [];
+  const groups = new Set<string>();
+  const http: AzHttp = async (method, url, body) => {
+    calls.push({ method, url });
+    const failed = options.fail?.(method, url);
+    if (failed) return { status: failed, text: JSON.stringify({ error: { code: "AuthorizationFailed", message: "denied" } }) };
+    const path = new URL(url).pathname;
+    const key = path.toLowerCase();
+    if (/\/resourcegroups\/[^/]+$/.test(key)) {
+      if (method === "PUT") groups.add(key);
+      return { status: 200, text: "{}" };
+    }
+    if (key.endsWith("/resources")) {
+      const prefix = key.slice(0, -"/resources".length);
+      if (!groups.has(prefix)) return { status: 404, text: JSON.stringify({ error: { code: "ResourceGroupNotFound" } }) };
+      return { status: 200, text: JSON.stringify({ value: [...store.entries()].filter(([k]) => k.startsWith(prefix)).map(([, v]) => v) }) };
+    }
+    if (method === "PUT") {
+      const b = body as Record<string, unknown>;
+      const m = /\/providers\/([^/]+\/[^/]+)\/([^/]+)$/.exec(path)!;
+      const stored = {
+        id: path,
+        name: m[2],
+        type: m[1],
+        ...b,
+        ...(options.dropTags ? { tags: {} } : {}),
+        properties: { ...((b.properties as Record<string, unknown>) ?? {}), provisioningState: "Succeeded" },
+      };
+      store.set(key, stored);
+      return { status: 200, text: JSON.stringify(stored) };
+    }
+    if (method === "DELETE") return { status: store.delete(key) ? 200 : 404, text: "" };
+    const found = store.get(key);
+    return found ? { status: 200, text: JSON.stringify(found) } : { status: 404, text: JSON.stringify({ error: { code: "ResourceNotFound" } }) };
+  };
+  return { http, calls, store };
+}
+
+const storage = (accessTier: string) => ({
+  type: "Microsoft.Storage/storageAccounts",
+  apiVersion: "2023-01-01",
+  name: "chantst1",
+  location: "[resourceGroup().location]",
+  sku: { name: "Standard_LRS" },
+  kind: "StorageV2",
+  properties: { accessTier },
+});
+
+const site = {
+  type: "Microsoft.Web/sites",
+  apiVersion: "2023-01-01",
+  name: "chantsite1",
+  location: "eastus",
+  properties: {
+    serverFarmId: "[resourceId('Microsoft.Web/serverfarms', 'plan1')]",
+    storageKey: "[listKeys(resourceId('Microsoft.Storage/storageAccounts', 'chantst1'), '2023-01-01').keys[0].value]",
+  },
+};
+
+describe("arm-deploy (#4273)", () => {
+  let dir: string;
+  let template: string;
+  const ctx: DeployContext = { env: "local", component: "app" };
+  const saved = { ...process.env };
+  const write = (resources: unknown[], outputs?: Record<string, unknown>): void =>
+    writeFileSync(template, JSON.stringify({ resources, ...(outputs ? { outputs } : {}) }));
+  const input = (over: Partial<ArmDeployInput> = {}): ArmDeployInput => ({ template, resourceGroup: "chant-rg", endpoint: ENDPOINT, ...over });
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "arm-deploy-"));
+    template = join(dir, "deploymentTemplate.json");
+  });
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+    process.env = { ...saved };
+  });
+
+  test("plans a create, applies it through azApply, then plans no change and reads the outputs", async () => {
+    const arm = fakeArm();
+    const cap = createArmDeployCapability({ http: arm.http });
+    write([storage("Hot")], {
+      tier: { type: "string", value: "[reference('chantst1').accessTier]" },
+      group: { type: "string", value: "[resourceGroup().name]" },
+    });
+
+    const created = await cap.plan!(ctx, input());
+    expect(created.member).toBe("chant-rg");
+    expect(created.changeSet!.member).toMatchObject({ member: "chant-rg", lexicon: "azure", planner: "chant", status: "planned", holes: [] });
+    const [entry] = created.changeSet!.entries;
+    expect(entry).toMatchObject({ address: "Microsoft.Storage/storageAccounts/chantst1", action: "create", lexicon: "azure" });
+    expect(entry.attributes).toContainEqual({ path: "accessTier", after: "Hot" });
+    expect(entry.attributes).toContainEqual({ path: "location", after: "eastus" });
+    // The output reading the new account is known only after apply; the static one now.
+    expect(created.outputs).toEqual({ known: { group: "chant-rg" }, unknown: ["tier"] });
+    // Planning made no write.
+    expect(arm.calls.filter((c) => c.method !== "GET")).toEqual([]);
+
+    const applied = await cap.run({ ...ctx, plans: { "chant-rg": created.artifact } }, input());
+    expect(applied.applied).toEqual([{ type: "Microsoft.Storage/storageAccounts", name: "chantst1" }]);
+    expect(applied.outputs).toEqual({ tier: "Hot", group: "chant-rg" });
+
+    const same = await cap.plan!(ctx, input());
+    expect(same.changeSet!.entries.map((e) => e.action)).toEqual(["no-op"]);
+    expect(same.outputs).toEqual({ known: { tier: "Hot", group: "chant-rg" }, unknown: [] });
+    await expect(cap.outputs!(ctx, input())).resolves.toEqual({ tier: "Hot", group: "chant-rg" });
+  });
+
+  test("plans an update with each changed path before and after", async () => {
+    const arm = fakeArm();
+    const cap = createArmDeployCapability({ http: arm.http });
+    write([storage("Hot")]);
+    await cap.run(ctx, input());
+
+    write([storage("Cool")]);
+    const updated = await cap.plan!(ctx, input());
+    const [entry] = updated.changeSet!.entries;
+    expect(entry).toMatchObject({ action: "update", disruption: "in-place" });
+    expect(entry.id).toContain("/storageAccounts/chantst1");
+    expect(entry.attributes).toEqual([{ path: "accessTier", before: "Hot", after: "Cool" }]);
+  });
+
+  test("refuses to apply when the template moved after the plan, and changes nothing", async () => {
+    const arm = fakeArm();
+    const cap = createArmDeployCapability({ http: arm.http });
+    write([storage("Hot")]);
+    const planned = await cap.plan!(ctx, input());
+    write([storage("Cool")]);
+    const run = cap.run({ ...ctx, plans: { "chant-rg": planned.artifact } }, input());
+    await expect(run).rejects.toBeInstanceOf(ArmDeployPlanMovedError);
+    await expect(run).rejects.toSatisfy(isPlanMovedError);
+    expect(arm.calls.filter((c) => c.method === "PUT")).toEqual([]);
+  });
+
+  test("ownership tags the applier stamps are not a change, even where the emulator drops them", async () => {
+    for (const dropTags of [false, true]) {
+      const arm = fakeArm({ dropTags });
+      const cap = createArmDeployCapability({ http: arm.http });
+      write([storage("Hot")]);
+      await cap.run(ctx, input());
+      const again = await cap.plan!(ctx, input());
+      expect(again.changeSet!.entries.map((e) => e.action)).toEqual(["no-op"]);
+    }
+  });
+
+  test("a value read from runtime state is unknown, and the plan never calls listKeys", async () => {
+    const arm = fakeArm();
+    const cap = createArmDeployCapability({ http: arm.http });
+    write([site]);
+    const planned = await cap.plan!(ctx, input());
+    const [entry] = planned.changeSet!.entries;
+    expect(entry.attributes).toContainEqual({ path: "serverFarmId", after: "/subscriptions/00000000-0000-0000-0000-000000000001/resourceGroups/chant-rg/providers/Microsoft.Web/serverfarms/plan1" });
+    expect(entry.attributes).toContainEqual({ path: "storageKey", unknown: true });
+    expect(arm.calls.some((c) => c.url.includes("listKeys"))).toBe(false);
+  });
+
+  test("with prune, a chant-owned resource the template dropped is a delete and a foreign one is left alone", async () => {
+    const arm = fakeArm();
+    const cap = createArmDeployCapability({ http: arm.http });
+    write([storage("Hot"), { ...storage("Hot"), name: "chantst2" }]);
+    await cap.run(ctx, input());
+    await arm.http("PUT", `${ENDPOINT}/subscriptions/00000000-0000-0000-0000-000000000001/resourceGroups/chant-rg/providers/Microsoft.Storage/storageAccounts/foreign1?api-version=2023-01-01`, { location: "eastus" });
+
+    write([storage("Hot")]);
+    const kept = await cap.plan!(ctx, input());
+    expect(kept.changeSet!.entries.map((e) => e.action)).toEqual(["no-op"]);
+    const pruning = await cap.plan!(ctx, input({ prune: true }));
+    expect(pruning.changeSet!.entries.map((e) => [e.name, e.action, e.disruption])).toEqual([
+      ["chantst1", "no-op", undefined],
+      ["chantst2", "delete", "destroy"],
+    ]);
+    expect(pruning.planDigest).not.toBe(kept.planDigest);
+
+    const applied = await cap.run({ ...ctx, plans: { "chant-rg": pruning.artifact } }, input({ prune: true }));
+    expect(applied.pruned).toEqual([{ type: "Microsoft.Storage/storageAccounts", name: "chantst2", deleted: true }]);
+  });
+
+  test("a resource it cannot read is a hole, and the plan hands run nothing to hold it to", async () => {
+    const arm = fakeArm({ fail: (method) => (method === "GET" ? 403 : undefined) });
+    const cap = createArmDeployCapability({ http: arm.http });
+    write([storage("Hot")]);
+    const planned = await cap.plan!(ctx, input());
+    expect(planned.changeSet!.entries).toEqual([]);
+    expect(planned.changeSet!.member.holes).toEqual([
+      { address: "Microsoft.Storage/storageAccounts/chantst1", type: "Microsoft.Storage/storageAccounts", reason: expect.stringMatching(/^no-credentials/) },
+    ]);
+    expect(planned.artifact).toBeUndefined();
+  });
+
+  test("a subscription ARM does not know is a hole, not a create of every resource", async () => {
+    const http: AzHttp = async () => ({ status: 404, text: JSON.stringify({ error: { code: "SubscriptionNotFound", message: "no such subscription" } }) });
+    const cap = createArmDeployCapability({ http });
+    write([storage("Hot")]);
+    const planned = await cap.plan!(ctx, input());
+    expect(planned.changeSet!.entries).toEqual([]);
+    expect(planned.changeSet!.member.holes).toHaveLength(1);
+    expect(planned.artifact).toBeUndefined();
+  });
+
+  test("inputs from an upstream not applied yet leave a hole and read nothing", async () => {
+    const arm = fakeArm();
+    const cap = createArmDeployCapability({ http: arm.http });
+    write([storage("Hot")]);
+    const planned = await cap.plan!({ ...ctx, unresolvedInputs: ["network"] }, input());
+    expect(planned.changeSet!.member.holes).toEqual([
+      { address: "chant-rg", type: "Microsoft.Resources/resourceGroups", reason: "inputs from network; re-checked on apply" },
+    ]);
+    expect(arm.calls).toEqual([]);
+  });
+
+  test("honours AZURE_ENDPOINT_URL and AZURE_SUBSCRIPTION_ID, and defaults the group to the component", async () => {
+    process.env.AZURE_ENDPOINT_URL = "http://localhost:4577/";
+    process.env.AZURE_SUBSCRIPTION_ID = "sub-test";
+    const arm = fakeArm();
+    const cap = createArmDeployCapability({ http: arm.http });
+    write([storage("Hot")]);
+    const planned = await cap.plan!(ctx, { template });
+    expect(planned.member).toBe("app");
+    expect(arm.calls[0].url).toBe(
+      "http://localhost:4577/subscriptions/sub-test/resourceGroups/app/providers/Microsoft.Storage/storageAccounts/chantst1?api-version=2023-01-01",
+    );
+  });
+});
+
+describe("azureCapabilityPlugin (#4273)", () => {
+  test("satisfies the CapabilityPlugin contract and registers arm-deploy with plan and outputs", () => {
+    expect(isCapabilityPlugin(azureCapabilityPlugin)).toBe(true);
+    const [cap] = azureCapabilityPlugin.capabilities();
+    expect(cap.kind).toBe("arm-deploy");
+    expect(typeof cap.plan).toBe("function");
+    expect(typeof cap.outputs).toBe("function");
+  });
+
+  test("an arm-deploy step's unit is its resource group", () => {
+    expect(deployUnits([{ steps: [{ kind: "arm-deploy", template: "t.json", resourceGroup: "rg1" }] }])).toEqual([{ unit: "rg1", lexicon: "azure" }]);
+  });
+});