@intentius/chant-lexicon-azure 0.13.1 → 0.15.1

package/dist/import/live-export.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAInF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,KAAK,CAAC,EAAE,OAAO,GACd,gBAAgB,CAoBlB"}
+{"version":3,"file":"live-export.d.ts","sourceRoot":"","sources":["../../src/import/live-export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKnF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,OAAO,EACrB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,KAAK,CAAC,EAAE,OAAO,GACd,gBAAgB,CAoBlB"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "793862af34a8c2954d61ff1da1a6caf941668e3d711181c7351259dc0aeb7cc4",
+    "manifest.json": "c71f8c6d91577879032b9b5f2c0947e2671a9b3de1b482e835765e4d50cfd61a",
     "meta.json": "4b9c0be734f8b4a5fbba3136e14aaa1ea73ff0ee93f2aa480db83e476ce727b5",
     "types/index.d.ts": "d62c0fd7947ddf04a9126cc8bf44a9f4437f21cf8647fc812c022398f2c00d57",
     "rules/hardcoded-location.ts": "a9b1d1cec93f2ca9c5206641f53fc9621cefcfd2c00b3ab89c194b30a75fa949",
@@ -33,5 +33,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "f9612c8f78965b3ae6183938b01707abf8a3c8c07fb4b8e4d5d8285fb6ecc233"
+  "composite": "80f4f69fdccb61156444408efef97a404f529b3346e6ec8287a9a5f80320b713"
 }

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The azure lexicon's `chant audit` catalog — metadata for the AZR* ARM
+ * post-synth rules. Contributed via `azurePlugin.auditCatalog()` (#687).
+ */
+import { type RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const azureAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAI1F,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAqBtD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.13.1",
+  "version": "0.15.1",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/op/activities/az-apply.d.ts

@@ -0,0 +1,130 @@
+/** One ARM resource from a `deploymentTemplate.json` `resources[]`. */
+export interface ArmResource {
+    type: string;
+    apiVersion: string;
+    name: string;
+    location?: string;
+    properties?: unknown;
+    sku?: unknown;
+    kind?: unknown;
+    tags?: Record<string, string>;
+    dependsOn?: unknown;
+}
+/** Injectable HTTP client — mirrors the GCP applier so tests avoid the network. */
+export type AzHttp = (method: string, url: string, body?: unknown, signal?: AbortSignal) => Promise<{
+    status: number;
+    text: string;
+}>;
+/**
+ * Context for evaluating ARM template expressions. `deployed` holds the response
+ * bodies of resources already applied this run (keyed by evaluated name) so
+ * `reference()` resolves; `http`/`base` let `listKeys()` call the resource's
+ * key action.
+ */
+export interface ArmEvalCtx {
+    subscriptionId: string;
+    resourceGroup: string;
+    location: string;
+    deployed: Map<string, unknown>;
+    http: AzHttp;
+    base: string;
+    signal?: AbortSignal;
+}
+/** Evaluate an ARM expression string (`"[...]"`); a plain string is returned as-is. */
+export declare function evalArmString(s: string, ctx: ArmEvalCtx): Promise<unknown>;
+/** Recursively evaluate every string in a value against the ARM context. */
+export declare function evalArm(value: unknown, ctx: ArmEvalCtx): Promise<unknown>;
+/** Resource names this resource references via `resourceId('type','name')` / `reference('name')`. Pure. */
+export declare function armDependencies(resource: ArmResource, names: Set<string>): string[];
+/**
+ * Topologically order ARM resources so a referenced resource is applied before
+ * the resource that references it. Names that are expressions are ordered as-is
+ * (they don't match a literal reference). Throws on a cycle. Pure.
+ */
+export declare function orderArmResources(resources: ArmResource[]): ArmResource[];
+/** The ARM resource-ID PUT URL for a resource (name expression evaluated). */
+export declare function armResourceUrl(resource: ArmResource, ctx: ArmEvalCtx): Promise<string>;
+/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. */
+export declare function armResourceBody(resource: ArmResource, ctx: ArmEvalCtx): Promise<Record<string, unknown>>;
+export interface AzApplyArgs {
+    /** Path to a built ARM template (`deploymentTemplate.json`). */
+    templatePath: string;
+    /** Resource group to deploy into. */
+    resourceGroup: string;
+    /** Region for the resource group and `resourceGroup().location`. Default: `eastus`. */
+    location?: string;
+    /** ARM endpoint override (e.g. floci-az `http://localhost:4577`). Default: real Azure. */
+    endpoint?: string;
+    /** Subscription id. Default: floci-az's local subscription. */
+    subscriptionId?: string;
+    /**
+     * Delete chant-owned resources of a templated type that are no longer in the
+     * template (owned-only prune). Destructive — off by default. Foreign
+     * (non-chant) resources are never touched.
+     */
+    prune?: boolean;
+}
+/**
+ * The native Azure applier — read a built ARM template and PUT each resource
+ * directly to the ARM resource-CRUD API, in dependency order, resolving ARM
+ * expressions (including `reference()`/`listKeys()` against resources applied
+ * earlier this run). The Azure twin of `gcpApply`: it targets floci-az (which
+ * `az deployment` can't, floci-az having no deployments provider) or real Azure
+ * by endpoint override; the resource group is ensured first.
+ */
+export declare function azApply(args: AzApplyArgs, signal?: AbortSignal, http?: AzHttp): Promise<{
+    applied: Array<{
+        type: string;
+        name: string;
+    }>;
+    pruned: Array<{
+        type: string;
+        name: string;
+        deleted: boolean;
+    }>;
+}>;
+/** The ownership tag azApply stamps on every resource it applies. */
+export declare function chantOwnershipTags(): Record<string, string>;
+/** Whether a resource's tags mark it chant-owned. */
+export declare function isChantOwned(tags: Record<string, string> | null | undefined): boolean;
+/** One resource from the ARM resource-group listing. */
+export interface ArmListItem {
+    id: string;
+    name: string;
+    type: string;
+    tags?: Record<string, string>;
+}
+/** List the resources in the group via the ARM resource-list endpoint. */
+export declare function listGroupResources(ctx: ArmEvalCtx, http?: AzHttp, signal?: AbortSignal): Promise<ArmListItem[]>;
+/** Idempotently delete one ARM resource by type/name/apiVersion. A 404 means it is already gone. */
+export declare function deleteArmResource(type: string, name: string, apiVersion: string, ctx: ArmEvalCtx, http?: AzHttp, signal?: AbortSignal): Promise<{
+    type: string;
+    name: string;
+    deleted: boolean;
+}>;
+/**
+ * Owned-only prune: for each resource type present in the template, delete the
+ * chant-owned live resources of that type whose (evaluated) name is not in the
+ * template. Scoped to templated types — like the GCP applier — so a type chant
+ * isn't managing this run is left alone, and the type's `apiVersion` is taken
+ * from the template. Foreign (non-chant) resources are never touched.
+ */
+export declare function pruneArmOrphans(desired: ArmResource[], ctx: ArmEvalCtx, http?: AzHttp, signal?: AbortSignal): Promise<Array<{
+    type: string;
+    name: string;
+    deleted: boolean;
+}>>;
+/**
+ * The inverse of {@link azApply} — read a built ARM template and delete the
+ * resources it declares, in reverse dependency order (a referrer goes before the
+ * resource it references). Idempotent: already-absent resources are a no-op. The
+ * Azure twin of `gcpDelete`; `http` is injectable for tests.
+ */
+export declare function azDelete(args: AzApplyArgs, signal?: AbortSignal, http?: AzHttp): Promise<{
+    deleted: Array<{
+        type: string;
+        name: string;
+        deleted: boolean;
+    }>;
+}>;
+//# sourceMappingURL=az-apply.d.ts.map

package/dist/op/activities/az-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAQA,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc/C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED,4EAA4E;AAC5E,wBAAsB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAgID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAenF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAqBzE;AAID,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ9G;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CA8C9H;AAYD,qEAAqE;AACrE,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE3D;AAED,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErF;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,MAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASlI;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAM3D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAmBlE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAsB/E"}

package/dist/op/activities/azure.d.ts

@@ -0,0 +1,37 @@
+export interface AzGroupEnsureArgs {
+    /** Resource group name — the same value passed as `env` to a `arm` `nativeApply`. */
+    resourceGroup: string;
+    /** Azure region for the group. Default: `eastus`. */
+    location?: string;
+}
+export interface AzGroupDeleteArgs {
+    /** Resource group to delete. */
+    resourceGroup: string;
+}
+/**
+ * Build the `az group create` command. `az group create` is idempotent — a group
+ * that already exists is returned unchanged — so no existence check is needed.
+ * Pure — exported for testing.
+ */
+export declare function azGroupEnsureCommand(resourceGroup: string, location: string): string;
+/** Build the `az group delete` command (non-blocking). Pure — exported for testing. */
+export declare function azGroupDeleteCommand(resourceGroup: string): string;
+/**
+ * Ensure an Azure resource group exists before an ARM deployment.
+ *
+ * `az deployment group create` (the `arm` target of `nativeApply`) fails if its
+ * resource group is absent — unlike CloudFormation, which creates its own stack.
+ * Run this before the apply. Uses fastIdempotent profile — 5m timeout.
+ *
+ * This targets real Azure (via the logged-in `az` context). Local emulation
+ * against floci-az awaits an upstream `Microsoft.Resources/deployments` provider
+ * (see #705); when that lands, an endpoint/custom-cloud override slots in here.
+ */
+export declare function azGroupEnsure(args: AzGroupEnsureArgs, signal?: AbortSignal): Promise<void>;
+/**
+ * Delete an Azure resource group and everything in it (non-blocking). A no-op
+ * success when the group is already gone. Uses fastIdempotent profile — 5m
+ * timeout (`--no-wait` returns immediately).
+ */
+export declare function azGroupDelete(args: AzGroupDeleteArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=azure.d.ts.map

package/dist/op/activities/azure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure.d.ts","sourceRoot":"","sources":["../../../src/op/activities/azure.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpF;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhG;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhG"}

package/dist/op/activities/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Azure Op activities — resolved by the core activity registry when a project's
+ * `chant.config.ts` lists the `azure` lexicon. Contributes the resource-group
+ * lifecycle (`azGroupEnsure`/`azGroupDelete`) that an ARM `nativeApply` needs.
+ */
+export { azGroupEnsure, azGroupDelete, azGroupEnsureCommand, azGroupDeleteCommand } from "./azure.js";
+export type { AzGroupEnsureArgs, AzGroupDeleteArgs } from "./azure.js";
+export { azApply, azDelete, pruneArmOrphans, deleteArmResource, listGroupResources, chantOwnershipTags, isChantOwned, evalArm, evalArmString, armResourceUrl, armResourceBody, armDependencies, orderArmResources, } from "./az-apply.js";
+export type { AzApplyArgs, ArmEvalCtx, ArmResource, ArmListItem, AzHttp } from "./az-apply.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEpE,OAAO,EACL,OAAO,EACP,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC"}

package/dist/ownership.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The azure lexicon's ownership tag convention. Azure tag keys forbid `/`, so
+ * chant's markers use a hyphenated `chant-<name>` form (distinct from the
+ * label-based convention core keeps for k8s/gcp, and from AWS's `chant:<name>`).
+ * Core owns the generic stamp/detect logic (@intentius/chant/ownership); this is
+ * the azure-specific key naming it stamps.
+ */
+import type { ChannelKeys } from "@intentius/chant/ownership";
+/** Azure tag keys for chant's ownership markers. */
+export declare const AZURE_TAG_OWNERSHIP_KEYS: ChannelKeys;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,oDAAoD;AACpD,eAAO,MAAM,wBAAwB,EAAE,WAItC,CAAC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AAqB5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAsazB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AAsB5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAuazB,CAAC"}

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA+YlG;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA0C7B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAgZlG;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA0C7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.13.1",
+  "version": "0.15.1",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -44,6 +44,11 @@
       "types": "./dist/detect.d.ts",
       "default": "./src/detect.ts"
     },
+    "./op/activities": {
+      "development": "./src/op/activities/index.ts",
+      "types": "./dist/op/activities/index.d.ts",
+      "default": "./src/op/activities/index.ts"
+    },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
@@ -69,6 +74,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.13.1"
+    "@intentius/chant": "^0.15.1"
   }
 }

package/src/import/live-export.ts

@@ -1,5 +1,6 @@
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
 import { hasOwnershipMarker } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "../ownership";
 import { ArmParser } from "./parser";
 
 /**
@@ -35,7 +36,7 @@ export function parseExportedTemplate(
       if (selector?.name !== undefined && r.logicalId !== selector.name) return false;
       if (owned) {
         const tags = (r.properties as { tags?: Record<string, unknown> }).tags;
-        if (!hasOwnershipMarker(tags, "azure-tag")) return false;
+        if (!hasOwnershipMarker(tags, AZURE_TAG_OWNERSHIP_KEYS)) return false;
       }
       return true;
     }),

package/src/lint/audit-catalog.ts

@@ -0,0 +1,30 @@
+/**
+ * The azure lexicon's `chant audit` catalog — metadata for the AZR* ARM
+ * post-synth rules. Contributed via `azurePlugin.auditCatalog()` (#687).
+ */
+import { auditRule, type RuleMeta, type Authority } from "@intentius/chant/audit/catalog";
+
+const AZ_SEC: Authority = { name: "Microsoft Cloud Security Benchmark", url: "https://learn.microsoft.com/en-us/security/benchmark/azure/" };
+
+export const azureAuditCatalog: Record<string, RuleMeta> = {
+  AZR010: auditRule("AZR010", "report-only", "guidance", "Redundant dependsOn", "Remove dependsOn already implied by reference()/resourceId().", { category: "best-practice" }),
+  AZR011: auditRule("AZR011", "merge-worthy", "guidance", "Missing or invalid apiVersion", "Set a valid YYYY-MM-DD apiVersion on every resource.", { category: "correctness" }),
+  AZR012: auditRule("AZR012", "report-only", "guidance", "Deprecated API version", "Move to a current apiVersion.", { category: "best-practice" }),
+  AZR013: auditRule("AZR013", "merge-worthy", "guidance", "Resource missing location", "Add the required location property.", { category: "correctness" }),
+  AZR014: auditRule("AZR014", "merge-worthy", "guidance", "Storage account allows public blob access", "Set allowBlobPublicAccess to false.", { authority: [AZ_SEC] }),
+  AZR015: auditRule("AZR015", "merge-worthy", "guidance", "Storage account missing encryption", "Enable encryption services for data at rest.", { authority: [AZ_SEC] }),
+  AZR016: auditRule("AZR016", "report-only", "guidance", "Key Vault soft-delete not enabled", "Enable soft-delete.", { category: "best-practice" }),
+  AZR017: auditRule("AZR017", "report-only", "guidance", "Key Vault purge protection not enabled", "Enable purge protection.", { category: "best-practice" }),
+  AZR018: auditRule("AZR018", "report-only", "guidance", "SQL Server missing auditing", "Enable auditing for compliance and threat detection.", { category: "best-practice" }),
+  AZR019: auditRule("AZR019", "merge-worthy", "guidance", "SQL database missing TDE", "Enable Transparent Data Encryption.", { authority: [AZ_SEC] }),
+  AZR020: auditRule("AZR020", "report-only", "guidance", "App Service missing managed identity", "Enable a system- or user-assigned identity.", { category: "best-practice" }),
+  AZR021: auditRule("AZR021", "merge-worthy", "guidance", "App Service not HTTPS-only", "Set httpsOnly to true.", { authority: [AZ_SEC] }),
+  AZR022: auditRule("AZR022", "merge-worthy", "guidance", "App Service min TLS below 1.2", "Set minTlsVersion to 1.2+.", { authority: [AZ_SEC] }),
+  AZR023: auditRule("AZR023", "report-only", "guidance", "VM not using a managed disk", "Use a managed disk.", { category: "best-practice" }),
+  AZR024: auditRule("AZR024", "report-only", "guidance", "VM missing boot diagnostics", "Enable boot diagnostics.", { category: "best-practice" }),
+  AZR025: auditRule("AZR025", "report-only", "guidance", "AKS cluster missing RBAC", "Enable Kubernetes RBAC.", { category: "best-practice" }),
+  AZR026: auditRule("AZR026", "report-only", "guidance", "AKS cluster missing network policy", "Configure a networkPolicy.", { category: "best-practice" }),
+  AZR027: auditRule("AZR027", "merge-worthy", "guidance", "Container Registry admin user enabled", "Disable the admin user; use Azure AD / service principals.", { authority: [AZ_SEC] }),
+  AZR028: auditRule("AZR028", "report-only", "guidance", "Network interface missing NSG", "Associate an NSG to control traffic.", { category: "best-practice" }),
+  AZR029: auditRule("AZR029", "merge-worthy", "guidance", "Managed disk missing encryption", "Enable encryption for data at rest.", { authority: [AZ_SEC] }),
+};