@intentius/chant-lexicon-azure 0.13.1 → 0.15.0

package/dist/import/live-export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAInF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,KAAK,CAAC,EAAE,OAAO,GACd,gBAAgB,CAoBlB"}
+{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKnF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,KAAK,CAAC,EAAE,OAAO,GACd,gBAAgB,CAoBlB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "793862af34a8c2954d61ff1da1a6caf941668e3d711181c7351259dc0aeb7cc4",
+    "manifest.json": "3b3b9ea67bcddf7d194ad6885c0ef2b41fe820dcc229b36f0593aee5b3227606",
     "meta.json": "4b9c0be734f8b4a5fbba3136e14aaa1ea73ff0ee93f2aa480db83e476ce727b5",
     "types/index.d.ts": "d62c0fd7947ddf04a9126cc8bf44a9f4437f21cf8647fc812c022398f2c00d57",
     "rules/hardcoded-location.ts": "a9b1d1cec93f2ca9c5206641f53fc9621cefcfd2c00b3ab89c194b30a75fa949",
@@ -33,5 +33,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "f9612c8f78965b3ae6183938b01707abf8a3c8c07fb4b8e4d5d8285fb6ecc233"
+  "composite": "18a72855f694f2b11534c8dafffcd84b8fa040f8e9fc47285135488a7c357639"
 }

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The azure lexicon's `chant audit` catalog — metadata for the AZR* ARM
+ * post-synth rules. Contributed via `azurePlugin.auditCatalog()` (#687).
+ */
+import { type RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const azureAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAI1F,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAqBtD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/op/activities/az-apply.d.ts

@@ -0,0 +1,62 @@
+/** Context for evaluating the ARM template expressions chant emits. */
+export interface ArmContext {
+    subscriptionId: string;
+    resourceGroup: string;
+    location: string;
+}
+/** One ARM resource from a `deploymentTemplate.json` `resources[]`. */
+export interface ArmResource {
+    type: string;
+    apiVersion: string;
+    name: string;
+    location?: string;
+    properties?: unknown;
+    sku?: unknown;
+    kind?: unknown;
+    tags?: Record<string, string>;
+}
+/**
+ * Evaluate an ARM template expression string (`"[...]"`). Supports the functions
+ * chant's serializer emits: `concat`, `uniqueString`, `resourceGroup()` (`.id` /
+ * `.location`), `subscription()` (`.subscriptionId`), and string literals. A
+ * non-expression string is returned unchanged. Pure.
+ */
+export declare function evalArmString(s: string, ctx: ArmContext): string;
+/** Recursively evaluate every string in a value against the ARM context. Pure. */
+export declare function evalArm(value: unknown, ctx: ArmContext): unknown;
+/** Injectable HTTP client — mirrors the GCP applier so tests avoid the network. */
+export type AzHttp = (method: string, url: string, body?: unknown, signal?: AbortSignal) => Promise<{
+    status: number;
+    text: string;
+}>;
+/** The ARM resource-ID PUT URL for a resource under a resource group. Pure. */
+export declare function armResourceUrl(resource: ArmResource, ctx: ArmContext, base: string): string;
+/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. Pure. */
+export declare function armResourceBody(resource: ArmResource, ctx: ArmContext): Record<string, unknown>;
+export interface AzApplyArgs {
+    /** Path to a built ARM template (`deploymentTemplate.json`). */
+    templatePath: string;
+    /** Resource group to deploy into. */
+    resourceGroup: string;
+    /** Region for the resource group and `resourceGroup().location`. Default: `eastus`. */
+    location?: string;
+    /** ARM endpoint override (e.g. floci-az `http://localhost:4577`). Default: real Azure. */
+    endpoint?: string;
+    /** Subscription id. Default: floci-az's local subscription. */
+    subscriptionId?: string;
+}
+/**
+ * The native Azure applier — read a built ARM template and PUT each resource
+ * directly to the ARM resource-CRUD API, resolving ARM expressions first. This
+ * is the direct-apply path (the Azure twin of `gcpApply`): it targets floci-az's
+ * ARM resource endpoints — which `az deployment` cannot, since floci-az has no
+ * `Microsoft.Resources/deployments` provider — or real Azure by endpoint override.
+ * The resource group is ensured first. `http` is injectable for tests.
+ */
+export declare function azApply(args: AzApplyArgs, signal?: AbortSignal, http?: AzHttp): Promise<{
+    applied: Array<{
+        type: string;
+        name: string;
+    }>;
+}>;
+//# sourceMappingURL=az-apply.d.ts.map

package/dist/op/activities/az-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAQA,uEAAuE;AACvE,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAKhE;AAED,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAShE;AA4FD,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAY/C,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,kGAAkG;AAClG,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ/F;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CA6B7D"}

package/dist/op/activities/azure.d.ts

@@ -0,0 +1,37 @@
+export interface AzGroupEnsureArgs {
+    /** Resource group name — the same value passed as `env` to a `arm` `nativeApply`. */
+    resourceGroup: string;
+    /** Azure region for the group. Default: `eastus`. */
+    location?: string;
+}
+export interface AzGroupDeleteArgs {
+    /** Resource group to delete. */
+    resourceGroup: string;
+}
+/**
+ * Build the `az group create` command. `az group create` is idempotent — a group
+ * that already exists is returned unchanged — so no existence check is needed.
+ * Pure — exported for testing.
+ */
+export declare function azGroupEnsureCommand(resourceGroup: string, location: string): string;
+/** Build the `az group delete` command (non-blocking). Pure — exported for testing. */
+export declare function azGroupDeleteCommand(resourceGroup: string): string;
+/**
+ * Ensure an Azure resource group exists before an ARM deployment.
+ *
+ * `az deployment group create` (the `arm` target of `nativeApply`) fails if its
+ * resource group is absent — unlike CloudFormation, which creates its own stack.
+ * Run this before the apply. Uses fastIdempotent profile — 5m timeout.
+ *
+ * This targets real Azure (via the logged-in `az` context). Local emulation
+ * against floci-az awaits an upstream `Microsoft.Resources/deployments` provider
+ * (see #705); when that lands, an endpoint/custom-cloud override slots in here.
+ */
+export declare function azGroupEnsure(args: AzGroupEnsureArgs, signal?: AbortSignal): Promise<void>;
+/**
+ * Delete an Azure resource group and everything in it (non-blocking). A no-op
+ * success when the group is already gone. Uses fastIdempotent profile — 5m
+ * timeout (`--no-wait` returns immediately).
+ */
+export declare function azGroupDelete(args: AzGroupDeleteArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=azure.d.ts.map

package/dist/op/activities/azure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure.d.ts","sourceRoot":"","sources":["../../../src/op/activities/azure.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhG"}

package/dist/op/activities/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Azure Op activities — resolved by the core activity registry when a project's
+ * `chant.config.ts` lists the `azure` lexicon. Contributes the resource-group
+ * lifecycle (`azGroupEnsure`/`azGroupDelete`) that an ARM `nativeApply` needs.
+ */
+export { azGroupEnsure, azGroupDelete, azGroupEnsureCommand, azGroupDeleteCommand } from "./azure.js";
+export type { AzGroupEnsureArgs, AzGroupDeleteArgs } from "./azure.js";
+export { azApply, evalArm, evalArmString, armResourceUrl, armResourceBody } from "./az-apply.js";
+export type { AzApplyArgs, ArmContext, ArmResource, AzHttp } from "./az-apply.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEpE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9F,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC"}

package/dist/ownership.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The azure lexicon's ownership tag convention. Azure tag keys forbid `/`, so
+ * chant's markers use a hyphenated `chant-<name>` form (distinct from the
+ * label-based convention core keeps for k8s/gcp, and from AWS's `chant:<name>`).
+ * Core owns the generic stamp/detect logic (@intentius/chant/ownership); this is
+ * the azure-specific key naming it stamps.
+ */
+import type { ChannelKeys } from "@intentius/chant/ownership";
+/** Azure tag keys for chant's ownership markers. */
+export declare const AZURE_TAG_OWNERSHIP_KEYS: ChannelKeys;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,oDAAoD;AACpD,eAAO,MAAM,wBAAwB,EAAE,WAItC,CAAC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AAqB5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAsazB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AAsB5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAuazB,CAAC"}

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA+YlG;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA0C7B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAgZlG;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA0C7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -44,6 +44,11 @@
       "types": "./dist/detect.d.ts",
       "default": "./src/detect.ts"
     },
+    "./op/activities": {
+      "development": "./src/op/activities/index.ts",
+      "types": "./dist/op/activities/index.d.ts",
+      "default": "./src/op/activities/index.ts"
+    },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
@@ -69,6 +74,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.13.1"
+    "@intentius/chant": "^0.15.0"
   }
 }

package/src/import/live-export.ts

@@ -1,5 +1,6 @@
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
 import { hasOwnershipMarker } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "../ownership";
 import { ArmParser } from "./parser";
 
 /**
@@ -35,7 +36,7 @@ export function parseExportedTemplate(
       if (selector?.name !== undefined && r.logicalId !== selector.name) return false;
       if (owned) {
         const tags = (r.properties as { tags?: Record<string, unknown> }).tags;
-        if (!hasOwnershipMarker(tags, "azure-tag")) return false;
+        if (!hasOwnershipMarker(tags, AZURE_TAG_OWNERSHIP_KEYS)) return false;
       }
       return true;
     }),

package/src/lint/audit-catalog.ts

@@ -0,0 +1,30 @@
+/**
+ * The azure lexicon's `chant audit` catalog — metadata for the AZR* ARM
+ * post-synth rules. Contributed via `azurePlugin.auditCatalog()` (#687).
+ */
+import { auditRule, type RuleMeta, type Authority } from "@intentius/chant/audit/catalog";
+
+const AZ_SEC: Authority = { name: "Microsoft Cloud Security Benchmark", url: "https://learn.microsoft.com/en-us/security/benchmark/azure/" };
+
+export const azureAuditCatalog: Record<string, RuleMeta> = {
+  AZR010: auditRule("AZR010", "report-only", "guidance", "Redundant dependsOn", "Remove dependsOn already implied by reference()/resourceId().", { category: "best-practice" }),
+  AZR011: auditRule("AZR011", "merge-worthy", "guidance", "Missing or invalid apiVersion", "Set a valid YYYY-MM-DD apiVersion on every resource.", { category: "correctness" }),
+  AZR012: auditRule("AZR012", "report-only", "guidance", "Deprecated API version", "Move to a current apiVersion.", { category: "best-practice" }),
+  AZR013: auditRule("AZR013", "merge-worthy", "guidance", "Resource missing location", "Add the required location property.", { category: "correctness" }),
+  AZR014: auditRule("AZR014", "merge-worthy", "guidance", "Storage account allows public blob access", "Set allowBlobPublicAccess to false.", { authority: [AZ_SEC] }),
+  AZR015: auditRule("AZR015", "merge-worthy", "guidance", "Storage account missing encryption", "Enable encryption services for data at rest.", { authority: [AZ_SEC] }),
+  AZR016: auditRule("AZR016", "report-only", "guidance", "Key Vault soft-delete not enabled", "Enable soft-delete.", { category: "best-practice" }),
+  AZR017: auditRule("AZR017", "report-only", "guidance", "Key Vault purge protection not enabled", "Enable purge protection.", { category: "best-practice" }),
+  AZR018: auditRule("AZR018", "report-only", "guidance", "SQL Server missing auditing", "Enable auditing for compliance and threat detection.", { category: "best-practice" }),
+  AZR019: auditRule("AZR019", "merge-worthy", "guidance", "SQL database missing TDE", "Enable Transparent Data Encryption.", { authority: [AZ_SEC] }),
+  AZR020: auditRule("AZR020", "report-only", "guidance", "App Service missing managed identity", "Enable a system- or user-assigned identity.", { category: "best-practice" }),
+  AZR021: auditRule("AZR021", "merge-worthy", "guidance", "App Service not HTTPS-only", "Set httpsOnly to true.", { authority: [AZ_SEC] }),
+  AZR022: auditRule("AZR022", "merge-worthy", "guidance", "App Service min TLS below 1.2", "Set minTlsVersion to 1.2+.", { authority: [AZ_SEC] }),
+  AZR023: auditRule("AZR023", "report-only", "guidance", "VM not using a managed disk", "Use a managed disk.", { category: "best-practice" }),
+  AZR024: auditRule("AZR024", "report-only", "guidance", "VM missing boot diagnostics", "Enable boot diagnostics.", { category: "best-practice" }),
+  AZR025: auditRule("AZR025", "report-only", "guidance", "AKS cluster missing RBAC", "Enable Kubernetes RBAC.", { category: "best-practice" }),
+  AZR026: auditRule("AZR026", "report-only", "guidance", "AKS cluster missing network policy", "Configure a networkPolicy.", { category: "best-practice" }),
+  AZR027: auditRule("AZR027", "merge-worthy", "guidance", "Container Registry admin user enabled", "Disable the admin user; use Azure AD / service principals.", { authority: [AZ_SEC] }),
+  AZR028: auditRule("AZR028", "report-only", "guidance", "Network interface missing NSG", "Associate an NSG to control traffic.", { category: "best-practice" }),
+  AZR029: auditRule("AZR029", "merge-worthy", "guidance", "Managed disk missing encryption", "Enable encryption for data at rest.", { authority: [AZ_SEC] }),
+};

package/src/op/activities/az-apply.test.ts

@@ -0,0 +1,115 @@
+import { describe, test, expect } from "vitest";
+import {
+  evalArmString,
+  evalArm,
+  armResourceUrl,
+  armResourceBody,
+  azApply,
+  type ArmContext,
+  type ArmResource,
+  type AzHttp,
+} from "./az-apply";
+
+const CTX: ArmContext = {
+  subscriptionId: "sub-1",
+  resourceGroup: "chant-rg",
+  location: "eastus",
+};
+
+describe("evalArmString (#706)", () => {
+  test("resourceGroup().location / .id", () => {
+    expect(evalArmString("[resourceGroup().location]", CTX)).toBe("eastus");
+    expect(evalArmString("[resourceGroup().id]", CTX)).toBe("/subscriptions/sub-1/resourceGroups/chant-rg");
+  });
+
+  test("subscription().subscriptionId", () => {
+    expect(evalArmString("[subscription().subscriptionId]", CTX)).toBe("sub-1");
+  });
+
+  test("concat with a literal and a nested function", () => {
+    const v = evalArmString("[concat('store', uniqueString(resourceGroup().id))]", CTX);
+    expect(v.startsWith("store")).toBe(true);
+    expect(v).toHaveLength("store".length + 13); // uniqueString → 13 chars
+  });
+
+  test("uniqueString is deterministic for the same inputs", () => {
+    const a = evalArmString("[uniqueString(resourceGroup().id)]", CTX);
+    const b = evalArmString("[uniqueString(resourceGroup().id)]", CTX);
+    expect(a).toBe(b);
+  });
+
+  test("non-expression strings pass through; [[ is an escaped literal", () => {
+    expect(evalArmString("plain-name", CTX)).toBe("plain-name");
+    expect(evalArmString("[[literal]", CTX)).toBe("[literal]");
+  });
+
+  test("evalArm recurses into objects and arrays", () => {
+    expect(evalArm({ a: "[resourceGroup().location]", b: ["[subscription().subscriptionId]", 1] }, CTX)).toEqual({
+      a: "eastus",
+      b: ["sub-1", 1],
+    });
+  });
+});
+
+const STORAGE: ArmResource = {
+  type: "Microsoft.Storage/storageAccounts",
+  apiVersion: "2025-06-01",
+  name: "chantstore1",
+  location: "[resourceGroup().location]",
+  sku: { name: "Standard_LRS" },
+  kind: "StorageV2",
+  properties: { minimumTlsVersion: "TLS1_2" },
+  tags: { "managed-by": "chant" },
+};
+
+describe("armResourceUrl / armResourceBody (#706)", () => {
+  test("URL is the resource-id PUT path with api-version", () => {
+    expect(armResourceUrl(STORAGE, CTX, "http://x")).toBe(
+      "http://x/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.Storage/storageAccounts/chantstore1?api-version=2025-06-01",
+    );
+  });
+
+  test("body evaluates location, keeps sku/kind/tags/properties", () => {
+    expect(armResourceBody(STORAGE, CTX)).toEqual({
+      location: "eastus",
+      sku: { name: "Standard_LRS" },
+      kind: "StorageV2",
+      properties: { minimumTlsVersion: "TLS1_2" },
+      tags: { "managed-by": "chant" },
+    });
+  });
+});
+
+describe("azApply flow (#706)", () => {
+  test("ensures the resource group, then PUTs each resource", async () => {
+    const calls: Array<{ method: string; url: string }> = [];
+    const http: AzHttp = async (method, url) => {
+      calls.push({ method, url });
+      return { status: 200, text: "{}" };
+    };
+    // Stub the template read via a data: path — azApply reads a file, so drive it
+    // through the pure pieces instead by asserting the call sequence a real run makes.
+    // Here we exercise the HTTP contract with a hand-built template file.
+    const fs = await import("node:fs");
+    const tmp = `/tmp/chant-arm-${process.pid}.json`;
+    fs.writeFileSync(tmp, JSON.stringify({ resources: [STORAGE] }));
+    const res = await azApply({ templatePath: tmp, resourceGroup: "chant-rg", location: "eastus", endpoint: "http://x", subscriptionId: "sub-1" }, undefined, http);
+    fs.unlinkSync(tmp);
+    expect(res.applied).toEqual([{ type: "Microsoft.Storage/storageAccounts", name: "chantstore1" }]);
+    expect(calls[0].method).toBe("PUT");
+    expect(calls[0].url).toContain("/resourceGroups/chant-rg?api-version=");
+    expect(calls[1].url).toContain("/providers/Microsoft.Storage/storageAccounts/chantstore1?api-version=2025-06-01");
+  });
+
+  test("surfaces a resource apply failure (RG ok, resource PUT fails)", async () => {
+    const fs = await import("node:fs");
+    const tmp = `/tmp/chant-arm-fail-${process.pid}.json`;
+    fs.writeFileSync(tmp, JSON.stringify({ resources: [STORAGE] }));
+    const http: AzHttp = async (_method, url) =>
+      url.includes("/providers/") ? { status: 400, text: "denied" } : { status: 200, text: "" };
+    await expect(
+      azApply({ templatePath: tmp, resourceGroup: "rg", endpoint: "http://x" }, undefined, http),
+    ).rejects.toThrow(/Microsoft.Storage\/storageAccounts chantstore1 apply failed \(400\)/);
+    fs.unlinkSync(tmp);
+  });
+});

package/src/op/activities/az-apply.ts

@@ -0,0 +1,234 @@
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { safeHeartbeat } from "@intentius/chant/op";
+
+// The floci-az default local subscription (from its ARM management-plane mock).
+const DEFAULT_SUBSCRIPTION = "00000000-0000-0000-0000-000000000001";
+const DEFAULT_ENDPOINT = "https://management.azure.com";
+
+/** Context for evaluating the ARM template expressions chant emits. */
+export interface ArmContext {
+  subscriptionId: string;
+  resourceGroup: string;
+  location: string;
+}
+
+/** One ARM resource from a `deploymentTemplate.json` `resources[]`. */
+export interface ArmResource {
+  type: string;
+  apiVersion: string;
+  name: string;
+  location?: string;
+  properties?: unknown;
+  sku?: unknown;
+  kind?: unknown;
+  tags?: Record<string, string>;
+}
+
+// ── ARM expression evaluation (the subset chant emits) ────────────────────────
+
+/**
+ * Evaluate an ARM template expression string (`"[...]"`). Supports the functions
+ * chant's serializer emits: `concat`, `uniqueString`, `resourceGroup()` (`.id` /
+ * `.location`), `subscription()` (`.subscriptionId`), and string literals. A
+ * non-expression string is returned unchanged. Pure.
+ */
+export function evalArmString(s: string, ctx: ArmContext): string {
+  if (!(s.startsWith("[") && s.endsWith("]"))) return s;
+  // "[[" is an escaped literal "[".
+  if (s.startsWith("[[")) return s.slice(1);
+  return String(new ArmExpr(s.slice(1, -1), ctx).parse());
+}
+
+/** Recursively evaluate every string in a value against the ARM context. Pure. */
+export function evalArm(value: unknown, ctx: ArmContext): unknown {
+  if (typeof value === "string") return evalArmString(value, ctx);
+  if (Array.isArray(value)) return value.map((v) => evalArm(v, ctx));
+  if (value && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value)) out[k] = evalArm(v, ctx);
+    return out;
+  }
+  return value;
+}
+
+/** Minimal recursive-descent evaluator for the ARM function subset. */
+class ArmExpr {
+  private i = 0;
+  constructor(private readonly src: string, private readonly ctx: ArmContext) {}
+
+  parse(): unknown {
+    const v = this.expr();
+    return v;
+  }
+
+  private expr(): unknown {
+    this.ws();
+    let v: unknown;
+    if (this.src[this.i] === "'") {
+      v = this.stringLiteral();
+    } else {
+      v = this.call();
+    }
+    // Property access: resourceGroup().location, subscription().subscriptionId
+    while (this.peek() === ".") {
+      this.i++;
+      const prop = this.ident();
+      v = (v as Record<string, unknown>)?.[prop];
+    }
+    return v;
+  }
+
+  private call(): unknown {
+    const name = this.ident();
+    this.ws();
+    const args: unknown[] = [];
+    if (this.peek() === "(") {
+      this.i++;
+      this.ws();
+      if (this.peek() !== ")") {
+        args.push(this.expr());
+        this.ws();
+        while (this.peek() === ",") {
+          this.i++;
+          args.push(this.expr());
+          this.ws();
+        }
+      }
+      if (this.peek() === ")") this.i++;
+    }
+    return this.applyFn(name, args);
+  }
+
+  private applyFn(name: string, args: unknown[]): unknown {
+    switch (name) {
+      case "concat":
+        return args.map(String).join("");
+      case "uniqueString":
+        return createHash("sha256").update(args.map(String).join("-")).digest("hex").slice(0, 13);
+      case "resourceGroup":
+        return { location: this.ctx.location, id: `/subscriptions/${this.ctx.subscriptionId}/resourceGroups/${this.ctx.resourceGroup}`, name: this.ctx.resourceGroup };
+      case "subscription":
+        return { subscriptionId: this.ctx.subscriptionId, id: `/subscriptions/${this.ctx.subscriptionId}` };
+      default:
+        throw new Error(`unsupported ARM function: ${name}`);
+    }
+  }
+
+  private stringLiteral(): string {
+    this.i++; // opening '
+    let out = "";
+    while (this.i < this.src.length && this.src[this.i] !== "'") out += this.src[this.i++];
+    this.i++; // closing '
+    return out;
+  }
+
+  private ident(): string {
+    this.ws();
+    let out = "";
+    while (this.i < this.src.length && /[A-Za-z0-9_]/.test(this.src[this.i])) out += this.src[this.i++];
+    return out;
+  }
+
+  private ws(): void {
+    while (this.i < this.src.length && /\s/.test(this.src[this.i])) this.i++;
+  }
+
+  private peek(): string {
+    this.ws();
+    return this.src[this.i];
+  }
+}
+
+// ── HTTP + apply ──────────────────────────────────────────────────────────────
+
+/** Injectable HTTP client — mirrors the GCP applier so tests avoid the network. */
+export type AzHttp = (
+  method: string,
+  url: string,
+  body?: unknown,
+  signal?: AbortSignal,
+) => Promise<{ status: number; text: string }>;
+
+const defaultHttp: AzHttp = async (method, url, body, signal) => {
+  const res = await fetch(url, {
+    method,
+    headers: body === undefined ? undefined : { "content-type": "application/json" },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal,
+  });
+  return { status: res.status, text: await res.text() };
+};
+
+/** The ARM resource-ID PUT URL for a resource under a resource group. Pure. */
+export function armResourceUrl(resource: ArmResource, ctx: ArmContext, base: string): string {
+  const name = evalArmString(resource.name, ctx);
+  return `${base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${resource.type}/${name}?api-version=${resource.apiVersion}`;
+}
+
+/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. Pure. */
+export function armResourceBody(resource: ArmResource, ctx: ArmContext): Record<string, unknown> {
+  const body: Record<string, unknown> = {};
+  if (resource.location) body.location = evalArmString(resource.location, ctx);
+  if (resource.properties !== undefined) body.properties = evalArm(resource.properties, ctx);
+  if (resource.sku !== undefined) body.sku = evalArm(resource.sku, ctx);
+  if (resource.kind !== undefined) body.kind = resource.kind;
+  if (resource.tags !== undefined) body.tags = resource.tags;
+  return body;
+}
+
+export interface AzApplyArgs {
+  /** Path to a built ARM template (`deploymentTemplate.json`). */
+  templatePath: string;
+  /** Resource group to deploy into. */
+  resourceGroup: string;
+  /** Region for the resource group and `resourceGroup().location`. Default: `eastus`. */
+  location?: string;
+  /** ARM endpoint override (e.g. floci-az `http://localhost:4577`). Default: real Azure. */
+  endpoint?: string;
+  /** Subscription id. Default: floci-az's local subscription. */
+  subscriptionId?: string;
+}
+
+/**
+ * The native Azure applier — read a built ARM template and PUT each resource
+ * directly to the ARM resource-CRUD API, resolving ARM expressions first. This
+ * is the direct-apply path (the Azure twin of `gcpApply`): it targets floci-az's
+ * ARM resource endpoints — which `az deployment` cannot, since floci-az has no
+ * `Microsoft.Resources/deployments` provider — or real Azure by endpoint override.
+ * The resource group is ensured first. `http` is injectable for tests.
+ */
+export async function azApply(
+  args: AzApplyArgs,
+  signal?: AbortSignal,
+  http: AzHttp = defaultHttp,
+): Promise<{ applied: Array<{ type: string; name: string }> }> {
+  const base = (args.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
+  const ctx: ArmContext = {
+    subscriptionId: args.subscriptionId ?? DEFAULT_SUBSCRIPTION,
+    resourceGroup: args.resourceGroup,
+    location: args.location ?? "eastus",
+  };
+
+  // Ensure the resource group exists (ARM rejects resource PUTs without it).
+  await http(
+    "PUT",
+    `${base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}?api-version=2021-04-01`,
+    { location: ctx.location },
+    signal,
+  );
+
+  const template = JSON.parse(readFileSync(args.templatePath, "utf8")) as { resources?: ArmResource[] };
+  const applied: Array<{ type: string; name: string }> = [];
+  for (const resource of template.resources ?? []) {
+    const name = evalArmString(resource.name, ctx);
+    safeHeartbeat({ step: "azApply", type: resource.type, name });
+    const res = await http("PUT", armResourceUrl(resource, ctx, base), armResourceBody(resource, ctx), signal);
+    if (res.status >= 300) {
+      throw new Error(`${resource.type} ${name} apply failed (${res.status}): ${res.text}`);
+    }
+    console.log(`applied: ${resource.type}/${name} (${base})`);
+    applied.push({ type: resource.type, name });
+  }
+  return { applied };
+}

package/src/op/activities/azure.test.ts

@@ -0,0 +1,22 @@
+import { describe, test, expect } from "vitest";
+import { azGroupEnsureCommand, azGroupDeleteCommand } from "./azure";
+
+describe("azGroupEnsureCommand (#707)", () => {
+  test("creates the resource group in the given location, quietly", () => {
+    expect(azGroupEnsureCommand("chant-rg", "eastus")).toBe(
+      "az group create --name chant-rg --location eastus --output none",
+    );
+  });
+
+  test("honors a non-default location", () => {
+    expect(azGroupEnsureCommand("rg", "westeurope")).toContain("--location westeurope");
+  });
+});
+
+describe("azGroupDeleteCommand (#707)", () => {
+  test("force-deletes the group without blocking", () => {
+    expect(azGroupDeleteCommand("chant-rg")).toBe(
+      "az group delete --name chant-rg --yes --no-wait",
+    );
+  });
+});

package/src/op/activities/azure.ts

@@ -0,0 +1,66 @@
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+
+const execAsync = promisify(exec);
+
+const DEFAULT_LOCATION = "eastus";
+
+export interface AzGroupEnsureArgs {
+  /** Resource group name — the same value passed as `env` to a `arm` `nativeApply`. */
+  resourceGroup: string;
+  /** Azure region for the group. Default: `eastus`. */
+  location?: string;
+}
+
+export interface AzGroupDeleteArgs {
+  /** Resource group to delete. */
+  resourceGroup: string;
+}
+
+/**
+ * Build the `az group create` command. `az group create` is idempotent — a group
+ * that already exists is returned unchanged — so no existence check is needed.
+ * Pure — exported for testing.
+ */
+export function azGroupEnsureCommand(resourceGroup: string, location: string): string {
+  return `az group create --name ${resourceGroup} --location ${location} --output none`;
+}
+
+/** Build the `az group delete` command (non-blocking). Pure — exported for testing. */
+export function azGroupDeleteCommand(resourceGroup: string): string {
+  return `az group delete --name ${resourceGroup} --yes --no-wait`;
+}
+
+/**
+ * Ensure an Azure resource group exists before an ARM deployment.
+ *
+ * `az deployment group create` (the `arm` target of `nativeApply`) fails if its
+ * resource group is absent — unlike CloudFormation, which creates its own stack.
+ * Run this before the apply. Uses fastIdempotent profile — 5m timeout.
+ *
+ * This targets real Azure (via the logged-in `az` context). Local emulation
+ * against floci-az awaits an upstream `Microsoft.Resources/deployments` provider
+ * (see #705); when that lands, an endpoint/custom-cloud override slots in here.
+ */
+export async function azGroupEnsure(args: AzGroupEnsureArgs, signal?: AbortSignal): Promise<void> {
+  const location = args.location ?? DEFAULT_LOCATION;
+  const { stdout, stderr } = await execAsync(
+    azGroupEnsureCommand(args.resourceGroup, location),
+    { signal },
+  );
+  if (stdout) console.log(stdout);
+  if (stderr) console.error(stderr);
+}
+
+/**
+ * Delete an Azure resource group and everything in it (non-blocking). A no-op
+ * success when the group is already gone. Uses fastIdempotent profile — 5m
+ * timeout (`--no-wait` returns immediately).
+ */
+export async function azGroupDelete(args: AzGroupDeleteArgs, signal?: AbortSignal): Promise<void> {
+  try {
+    await execAsync(azGroupDeleteCommand(args.resourceGroup), { signal });
+  } catch {
+    // Group already absent — treat as success.
+  }
+}

package/src/op/activities/index.ts

@@ -0,0 +1,10 @@
+/**
+ * Azure Op activities — resolved by the core activity registry when a project's
+ * `chant.config.ts` lists the `azure` lexicon. Contributes the resource-group
+ * lifecycle (`azGroupEnsure`/`azGroupDelete`) that an ARM `nativeApply` needs.
+ */
+export { azGroupEnsure, azGroupDelete, azGroupEnsureCommand, azGroupDeleteCommand } from "./azure";
+export type { AzGroupEnsureArgs, AzGroupDeleteArgs } from "./azure";
+
+export { azApply, evalArm, evalArmString, armResourceUrl, armResourceBody } from "./az-apply";
+export type { AzApplyArgs, ArmContext, ArmResource, AzHttp } from "./az-apply";

package/src/ownership.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, test } from "vitest";
+import { ownershipEntries } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership";
+
+describe("AZURE_TAG_OWNERSHIP_KEYS", () => {
+  test("uses Azure hyphen-form tag keys (no slash, which Azure forbids)", () => {
+    expect(AZURE_TAG_OWNERSHIP_KEYS).toEqual({
+      managedBy: "chant-managed-by",
+      stack: "chant-stack",
+      env: "chant-env",
+    });
+    expect(Object.values(AZURE_TAG_OWNERSHIP_KEYS).some((k) => k.includes("/"))).toBe(false);
+  });
+
+  test("stamps the hyphen keys via the core ownershipEntries helper", () => {
+    const e = ownershipEntries(AZURE_TAG_OWNERSHIP_KEYS, { stack: "billing", env: "stg" });
+    expect(e).toEqual({ "chant-managed-by": "chant", "chant-stack": "billing", "chant-env": "stg" });
+  });
+});

package/src/ownership.ts

@@ -0,0 +1,16 @@
+/**
+ * The azure lexicon's ownership tag convention. Azure tag keys forbid `/`, so
+ * chant's markers use a hyphenated `chant-<name>` form (distinct from the
+ * label-based convention core keeps for k8s/gcp, and from AWS's `chant:<name>`).
+ * Core owns the generic stamp/detect logic (@intentius/chant/ownership); this is
+ * the azure-specific key naming it stamps.
+ */
+
+import type { ChannelKeys } from "@intentius/chant/ownership";
+
+/** Azure tag keys for chant's ownership markers. */
+export const AZURE_TAG_OWNERSHIP_KEYS: ChannelKeys = {
+  managedBy: "chant-managed-by",
+  stack: "chant-stack",
+  env: "chant-env",
+};

package/src/plugin.ts

@@ -6,6 +6,7 @@ import type { TypeScriptGenerator } from "@intentius/chant/import/generator";
 import type { CompletionContext, CompletionItem, HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
 import type { McpToolContribution, McpResourceContribution } from "@intentius/chant/mcp/types";
 import { postSynthChecks as postSynthCheckList } from "./lint/post-synth";
+import { azureAuditCatalog } from "./lint/audit-catalog";
 import { createSkillsLoader } from "@intentius/chant/lexicon-plugin-helpers";
 import { readFileSync, readdirSync, existsSync } from "fs";
 import { join, dirname } from "path";
@@ -27,6 +28,7 @@ import { azureHover } from "./lsp/hover";
  */
 export const azurePlugin: LexiconPlugin = {
   name: "azure",
+  auditCatalog: () => azureAuditCatalog,
   serializer: azureSerializer,
 
   lintRules(): LintRule[] {

package/src/serializer.ts

@@ -14,6 +14,7 @@ import type { Declarable, CoreParameter } from "@intentius/chant/declarable";
 import { isPropertyDeclarable } from "@intentius/chant/declarable";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
 import { ownershipEntries, type OwnershipMarker } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
@@ -191,7 +192,7 @@ function serializeToTemplate(
   // first so user default tags (and explicit per-resource tags) win.
   const defaultTagEntries: TagEntry[] = [];
   if (ownership) {
-    for (const [key, value] of Object.entries(ownershipEntries("azure-tag", ownership))) {
+    for (const [key, value] of Object.entries(ownershipEntries(AZURE_TAG_OWNERSHIP_KEYS, ownership))) {
       defaultTagEntries.push({ key, value });
     }
   }