@intentius/chant-lexicon-azure 0.13.1 → 0.15.1

package/src/op/activities/az-apply.ts

@@ -0,0 +1,468 @@
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { safeHeartbeat } from "@intentius/chant/op";
+
+// The floci-az default local subscription (from its ARM management-plane mock).
+const DEFAULT_SUBSCRIPTION = "00000000-0000-0000-0000-000000000001";
+const DEFAULT_ENDPOINT = "https://management.azure.com";
+
+/** One ARM resource from a `deploymentTemplate.json` `resources[]`. */
+export interface ArmResource {
+  type: string;
+  apiVersion: string;
+  name: string;
+  location?: string;
+  properties?: unknown;
+  sku?: unknown;
+  kind?: unknown;
+  tags?: Record<string, string>;
+  dependsOn?: unknown;
+}
+
+/** Injectable HTTP client — mirrors the GCP applier so tests avoid the network. */
+export type AzHttp = (
+  method: string,
+  url: string,
+  body?: unknown,
+  signal?: AbortSignal,
+) => Promise<{ status: number; text: string }>;
+
+const defaultHttp: AzHttp = async (method, url, body, signal) => {
+  const res = await fetch(url, {
+    method,
+    headers: body === undefined ? undefined : { "content-type": "application/json" },
+    body: body === undefined ? undefined : JSON.stringify(body),
+    signal,
+  });
+  return { status: res.status, text: await res.text() };
+};
+
+// ── ARM expression evaluation ─────────────────────────────────────────────────
+
+/**
+ * Context for evaluating ARM template expressions. `deployed` holds the response
+ * bodies of resources already applied this run (keyed by evaluated name) so
+ * `reference()` resolves; `http`/`base` let `listKeys()` call the resource's
+ * key action.
+ */
+export interface ArmEvalCtx {
+  subscriptionId: string;
+  resourceGroup: string;
+  location: string;
+  deployed: Map<string, unknown>;
+  http: AzHttp;
+  base: string;
+  signal?: AbortSignal;
+}
+
+/** Evaluate an ARM expression string (`"[...]"`); a plain string is returned as-is. */
+export async function evalArmString(s: string, ctx: ArmEvalCtx): Promise<unknown> {
+  if (!(s.startsWith("[") && s.endsWith("]"))) return s;
+  if (s.startsWith("[[")) return s.slice(1); // escaped literal "["
+  return new ArmExpr(s.slice(1, -1), ctx).parse();
+}
+
+/** Recursively evaluate every string in a value against the ARM context. */
+export async function evalArm(value: unknown, ctx: ArmEvalCtx): Promise<unknown> {
+  if (typeof value === "string") return evalArmString(value, ctx);
+  if (Array.isArray(value)) return Promise.all(value.map((v) => evalArm(v, ctx)));
+  if (value && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value)) out[k] = await evalArm(v, ctx);
+    return out;
+  }
+  return value;
+}
+
+/**
+ * Recursive-descent evaluator for the ARM function subset chant emits:
+ * `concat`, `uniqueString`, `resourceGroup()`, `subscription()`, `resourceId`,
+ * `reference` (runtime state of an applied resource), and `listKeys` (async key
+ * action), with `.prop` and `[index]` access.
+ */
+class ArmExpr {
+  private i = 0;
+  constructor(private readonly src: string, private readonly ctx: ArmEvalCtx) {}
+
+  async parse(): Promise<unknown> {
+    return this.access(await this.atom());
+  }
+
+  private async atom(): Promise<unknown> {
+    this.ws();
+    return this.src[this.i] === "'" ? this.stringLiteral() : this.call();
+  }
+
+  /** Postfix `.prop` / `[index]` access. */
+  private async access(v: unknown): Promise<unknown> {
+    for (;;) {
+      const c = this.peek();
+      if (c === ".") {
+        this.i++;
+        v = (v as Record<string, unknown> | undefined)?.[this.ident()];
+      } else if (c === "[") {
+        this.i++;
+        v = (v as unknown[] | undefined)?.[this.indexNumber()];
+      } else {
+        return v;
+      }
+    }
+  }
+
+  private async call(): Promise<unknown> {
+    const name = this.ident();
+    this.ws();
+    const args: unknown[] = [];
+    if (this.peek() === "(") {
+      this.i++;
+      this.ws();
+      if (this.peek() !== ")") {
+        args.push(await this.parse());
+        this.ws();
+        while (this.peek() === ",") {
+          this.i++;
+          args.push(await this.parse());
+          this.ws();
+        }
+      }
+      if (this.peek() === ")") this.i++;
+    }
+    return this.applyFn(name, args);
+  }
+
+  private async applyFn(name: string, args: unknown[]): Promise<unknown> {
+    switch (name) {
+      case "concat":
+        return args.map(String).join("");
+      case "uniqueString":
+        return createHash("sha256").update(args.map(String).join("-")).digest("hex").slice(0, 13);
+      case "resourceGroup":
+        return { location: this.ctx.location, id: `/subscriptions/${this.ctx.subscriptionId}/resourceGroups/${this.ctx.resourceGroup}`, name: this.ctx.resourceGroup };
+      case "subscription":
+        return { subscriptionId: this.ctx.subscriptionId, id: `/subscriptions/${this.ctx.subscriptionId}` };
+      case "resourceId":
+        // resourceId('Microsoft.X/y', 'name'[, 'child']) → the resource-id path.
+        return `/subscriptions/${this.ctx.subscriptionId}/resourceGroups/${this.ctx.resourceGroup}/providers/${args.map(String).join("/")}`;
+      case "reference": {
+        // reference('name') → the runtime `properties` of an already-applied resource.
+        const dep = this.ctx.deployed.get(String(args[0]));
+        return (dep as { properties?: unknown } | undefined)?.properties ?? dep;
+      }
+      case "listKeys": {
+        // listKeys(resourceId, apiVersion) → POST the resource's key action.
+        const resId = String(args[0]);
+        const apiVersion = String(args[1] ?? "2023-01-01");
+        const res = await this.ctx.http("POST", `${this.ctx.base}${resId}/listKeys?api-version=${apiVersion}`, {}, this.ctx.signal);
+        try {
+          return JSON.parse(res.text);
+        } catch {
+          return {};
+        }
+      }
+      default:
+        throw new Error(`unsupported ARM function: ${name}`);
+    }
+  }
+
+  private stringLiteral(): string {
+    this.i++; // opening '
+    let out = "";
+    while (this.i < this.src.length && this.src[this.i] !== "'") out += this.src[this.i++];
+    this.i++; // closing '
+    return out;
+  }
+
+  private ident(): string {
+    this.ws();
+    let out = "";
+    while (this.i < this.src.length && /[A-Za-z0-9_]/.test(this.src[this.i])) out += this.src[this.i++];
+    return out;
+  }
+
+  private indexNumber(): number {
+    this.ws();
+    let n = "";
+    while (this.i < this.src.length && /[0-9]/.test(this.src[this.i])) n += this.src[this.i++];
+    this.ws();
+    if (this.peek() === "]") this.i++;
+    return parseInt(n, 10);
+  }
+
+  private ws(): void {
+    while (this.i < this.src.length && /\s/.test(this.src[this.i])) this.i++;
+  }
+
+  private peek(): string {
+    this.ws();
+    return this.src[this.i];
+  }
+}
+
+// ── Dependency ordering ───────────────────────────────────────────────────────
+
+/** Resource names this resource references via `resourceId('type','name')` / `reference('name')`. Pure. */
+export function armDependencies(resource: ArmResource, names: Set<string>): string[] {
+  const deps = new Set<string>();
+  const scan = (v: unknown): void => {
+    if (typeof v === "string") {
+      for (const m of v.matchAll(/resourceId\(\s*'[^']*'\s*,\s*'([^']*)'/g)) if (names.has(m[1])) deps.add(m[1]);
+      for (const m of v.matchAll(/reference\(\s*'([^']*)'/g)) if (names.has(m[1])) deps.add(m[1]);
+    } else if (Array.isArray(v)) {
+      v.forEach(scan);
+    } else if (v && typeof v === "object") {
+      Object.values(v).forEach(scan);
+    }
+  };
+  scan(resource);
+  deps.delete(resource.name);
+  return [...deps];
+}
+
+/**
+ * Topologically order ARM resources so a referenced resource is applied before
+ * the resource that references it. Names that are expressions are ordered as-is
+ * (they don't match a literal reference). Throws on a cycle. Pure.
+ */
+export function orderArmResources(resources: ArmResource[]): ArmResource[] {
+  const byName = new Map<string, ArmResource>();
+  for (const r of resources) byName.set(r.name, r);
+  const names = new Set(resources.map((r) => r.name));
+  const ordered: ArmResource[] = [];
+  const done = new Set<ArmResource>();
+  const active = new Set<ArmResource>();
+  const visit = (r: ArmResource): void => {
+    if (done.has(r)) return;
+    if (active.has(r)) throw new Error(`ARM reference cycle involving ${r.name}`);
+    active.add(r);
+    for (const dep of armDependencies(r, names)) {
+      const target = byName.get(dep);
+      if (target && target !== r) visit(target);
+    }
+    active.delete(r);
+    done.add(r);
+    ordered.push(r);
+  };
+  for (const r of resources) visit(r);
+  return ordered;
+}
+
+// ── URL + body + apply ────────────────────────────────────────────────────────
+
+/** The ARM resource-ID PUT URL for a resource (name expression evaluated). */
+export async function armResourceUrl(resource: ArmResource, ctx: ArmEvalCtx): Promise<string> {
+  const name = await evalArmString(resource.name, ctx);
+  return `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${resource.type}/${name}?api-version=${resource.apiVersion}`;
+}
+
+/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. */
+export async function armResourceBody(resource: ArmResource, ctx: ArmEvalCtx): Promise<Record<string, unknown>> {
+  const body: Record<string, unknown> = {};
+  if (resource.location) body.location = await evalArmString(resource.location, ctx);
+  if (resource.properties !== undefined) body.properties = await evalArm(resource.properties, ctx);
+  if (resource.sku !== undefined) body.sku = await evalArm(resource.sku, ctx);
+  if (resource.kind !== undefined) body.kind = await evalArm(resource.kind, ctx);
+  if (resource.tags !== undefined) body.tags = await evalArm(resource.tags, ctx);
+  return body;
+}
+
+export interface AzApplyArgs {
+  /** Path to a built ARM template (`deploymentTemplate.json`). */
+  templatePath: string;
+  /** Resource group to deploy into. */
+  resourceGroup: string;
+  /** Region for the resource group and `resourceGroup().location`. Default: `eastus`. */
+  location?: string;
+  /** ARM endpoint override (e.g. floci-az `http://localhost:4577`). Default: real Azure. */
+  endpoint?: string;
+  /** Subscription id. Default: floci-az's local subscription. */
+  subscriptionId?: string;
+  /**
+   * Delete chant-owned resources of a templated type that are no longer in the
+   * template (owned-only prune). Destructive — off by default. Foreign
+   * (non-chant) resources are never touched.
+   */
+  prune?: boolean;
+}
+
+/**
+ * The native Azure applier — read a built ARM template and PUT each resource
+ * directly to the ARM resource-CRUD API, in dependency order, resolving ARM
+ * expressions (including `reference()`/`listKeys()` against resources applied
+ * earlier this run). The Azure twin of `gcpApply`: it targets floci-az (which
+ * `az deployment` can't, floci-az having no deployments provider) or real Azure
+ * by endpoint override; the resource group is ensured first.
+ */
+export async function azApply(
+  args: AzApplyArgs,
+  signal?: AbortSignal,
+  http: AzHttp = defaultHttp,
+): Promise<{ applied: Array<{ type: string; name: string }>; pruned: Array<{ type: string; name: string; deleted: boolean }> }> {
+  const base = (args.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
+  const ctx: ArmEvalCtx = {
+    subscriptionId: args.subscriptionId ?? DEFAULT_SUBSCRIPTION,
+    resourceGroup: args.resourceGroup,
+    location: args.location ?? "eastus",
+    deployed: new Map(),
+    http,
+    base,
+    signal,
+  };
+
+  // Ensure the resource group exists (ARM rejects resource PUTs without it).
+  await http(
+    "PUT",
+    `${base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}?api-version=2021-04-01`,
+    { location: ctx.location },
+    signal,
+  );
+
+  const template = JSON.parse(readFileSync(args.templatePath, "utf8")) as { resources?: ArmResource[] };
+  const resources = template.resources ?? [];
+  const applied: Array<{ type: string; name: string }> = [];
+  for (const resource of orderArmResources(resources)) {
+    const name = String(await evalArmString(resource.name, ctx));
+    safeHeartbeat({ step: "azApply", type: resource.type, name });
+    // Stamp chant ownership so a later prune can tell chant-managed resources
+    // apart from foreign ones in the same group.
+    const body = await armResourceBody(resource, ctx);
+    body.tags = { ...((body.tags as Record<string, string> | undefined) ?? {}), ...chantOwnershipTags() };
+    const res = await http("PUT", await armResourceUrl(resource, ctx), body, signal);
+    if (res.status >= 300) {
+      throw new Error(`${resource.type} ${name} apply failed (${res.status}): ${res.text}`);
+    }
+    // Capture the applied resource so later reference()/dependents resolve.
+    try {
+      ctx.deployed.set(name, JSON.parse(res.text));
+    } catch {
+      // non-JSON response — reference() to this resource resolves to undefined
+    }
+    console.log(`applied: ${resource.type}/${name} (${base})`);
+    applied.push({ type: resource.type, name });
+  }
+
+  const pruned = args.prune ? await pruneArmOrphans(resources, ctx, http, signal) : [];
+  return { applied, pruned };
+}
+
+// ── Ownership + prune + delete ────────────────────────────────────────────────
+
+// chant stamps this tag on every resource it applies; prune only ever deletes
+// resources carrying it, so a foreign resource sharing the group is never
+// touched. Real Azure persists resource tags; note that floci-az currently drops
+// them, so owned-only prune only takes effect against real Azure (the delete
+// mechanics themselves work against either — see azDelete).
+const OWNERSHIP_TAG_KEY = "managed-by";
+const OWNERSHIP_TAG_VALUE = "chant";
+
+/** The ownership tag azApply stamps on every resource it applies. */
+export function chantOwnershipTags(): Record<string, string> {
+  return { [OWNERSHIP_TAG_KEY]: OWNERSHIP_TAG_VALUE };
+}
+
+/** Whether a resource's tags mark it chant-owned. */
+export function isChantOwned(tags: Record<string, string> | null | undefined): boolean {
+  return tags?.[OWNERSHIP_TAG_KEY] === OWNERSHIP_TAG_VALUE;
+}
+
+/** One resource from the ARM resource-group listing. */
+export interface ArmListItem {
+  id: string;
+  name: string;
+  type: string;
+  tags?: Record<string, string>;
+}
+
+/** List the resources in the group via the ARM resource-list endpoint. */
+export async function listGroupResources(ctx: ArmEvalCtx, http: AzHttp = defaultHttp, signal?: AbortSignal): Promise<ArmListItem[]> {
+  const url = `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/resources?api-version=2021-04-01`;
+  const res = await http("GET", url, undefined, signal);
+  if (res.status >= 300) return [];
+  try {
+    return ((JSON.parse(res.text) as { value?: ArmListItem[] }).value ?? []).filter((r) => r?.type && r?.name);
+  } catch {
+    return [];
+  }
+}
+
+/** Idempotently delete one ARM resource by type/name/apiVersion. A 404 means it is already gone. */
+export async function deleteArmResource(
+  type: string,
+  name: string,
+  apiVersion: string,
+  ctx: ArmEvalCtx,
+  http: AzHttp = defaultHttp,
+  signal?: AbortSignal,
+): Promise<{ type: string; name: string; deleted: boolean }> {
+  const url = `${ctx.base}/subscriptions/${ctx.subscriptionId}/resourceGroups/${ctx.resourceGroup}/providers/${type}/${name}?api-version=${apiVersion}`;
+  const res = await http("DELETE", url, undefined, signal);
+  if (res.status === 404) return { type, name, deleted: false };
+  if (res.status >= 300) throw new Error(`${type} ${name} delete failed (${res.status}): ${res.text}`);
+  return { type, name, deleted: true };
+}
+
+/**
+ * Owned-only prune: for each resource type present in the template, delete the
+ * chant-owned live resources of that type whose (evaluated) name is not in the
+ * template. Scoped to templated types — like the GCP applier — so a type chant
+ * isn't managing this run is left alone, and the type's `apiVersion` is taken
+ * from the template. Foreign (non-chant) resources are never touched.
+ */
+export async function pruneArmOrphans(
+  desired: ArmResource[],
+  ctx: ArmEvalCtx,
+  http: AzHttp = defaultHttp,
+  signal?: AbortSignal,
+): Promise<Array<{ type: string; name: string; deleted: boolean }>> {
+  const byType = new Map<string, { keep: Set<string>; apiVersion: string }>();
+  for (const r of desired) {
+    const name = String(await evalArmString(r.name, ctx));
+    const entry = byType.get(r.type) ?? { keep: new Set<string>(), apiVersion: r.apiVersion };
+    entry.keep.add(name);
+    byType.set(r.type, entry);
+  }
+
+  const pruned: Array<{ type: string; name: string; deleted: boolean }> = [];
+  for (const item of await listGroupResources(ctx, http, signal)) {
+    const entry = byType.get(item.type);
+    if (!entry || !isChantOwned(item.tags) || entry.keep.has(item.name)) continue;
+    safeHeartbeat({ step: "azPrune", type: item.type, name: item.name });
+    const result = await deleteArmResource(item.type, item.name, entry.apiVersion, ctx, http, signal);
+    console.log(`pruned: ${item.type}/${item.name} (${ctx.base})`);
+    pruned.push(result);
+  }
+  return pruned;
+}
+
+/**
+ * The inverse of {@link azApply} — read a built ARM template and delete the
+ * resources it declares, in reverse dependency order (a referrer goes before the
+ * resource it references). Idempotent: already-absent resources are a no-op. The
+ * Azure twin of `gcpDelete`; `http` is injectable for tests.
+ */
+export async function azDelete(
+  args: AzApplyArgs,
+  signal?: AbortSignal,
+  http: AzHttp = defaultHttp,
+): Promise<{ deleted: Array<{ type: string; name: string; deleted: boolean }> }> {
+  const base = (args.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
+  const ctx: ArmEvalCtx = {
+    subscriptionId: args.subscriptionId ?? DEFAULT_SUBSCRIPTION,
+    resourceGroup: args.resourceGroup,
+    location: args.location ?? "eastus",
+    deployed: new Map(),
+    http,
+    base,
+    signal,
+  };
+
+  const template = JSON.parse(readFileSync(args.templatePath, "utf8")) as { resources?: ArmResource[] };
+  const deleted: Array<{ type: string; name: string; deleted: boolean }> = [];
+  for (const resource of orderArmResources(template.resources ?? []).reverse()) {
+    const name = String(await evalArmString(resource.name, ctx));
+    safeHeartbeat({ step: "azDelete", type: resource.type, name });
+    const result = await deleteArmResource(resource.type, name, resource.apiVersion, ctx, http, signal);
+    console.log(`${result.deleted ? "deleted" : "absent"}: ${resource.type}/${name} (${base})`);
+    deleted.push(result);
+  }
+  return { deleted };
+}

package/src/op/activities/azure.test.ts

@@ -0,0 +1,22 @@
+import { describe, test, expect } from "vitest";
+import { azGroupEnsureCommand, azGroupDeleteCommand } from "./azure";
+
+describe("azGroupEnsureCommand (#707)", () => {
+  test("creates the resource group in the given location, quietly", () => {
+    expect(azGroupEnsureCommand("chant-rg", "eastus")).toBe(
+      "az group create --name chant-rg --location eastus --output none",
+    );
+  });
+
+  test("honors a non-default location", () => {
+    expect(azGroupEnsureCommand("rg", "westeurope")).toContain("--location westeurope");
+  });
+});
+
+describe("azGroupDeleteCommand (#707)", () => {
+  test("force-deletes the group without blocking", () => {
+    expect(azGroupDeleteCommand("chant-rg")).toBe(
+      "az group delete --name chant-rg --yes --no-wait",
+    );
+  });
+});

package/src/op/activities/azure.ts

@@ -0,0 +1,66 @@
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+
+const execAsync = promisify(exec);
+
+const DEFAULT_LOCATION = "eastus";
+
+export interface AzGroupEnsureArgs {
+  /** Resource group name — the same value passed as `env` to a `arm` `nativeApply`. */
+  resourceGroup: string;
+  /** Azure region for the group. Default: `eastus`. */
+  location?: string;
+}
+
+export interface AzGroupDeleteArgs {
+  /** Resource group to delete. */
+  resourceGroup: string;
+}
+
+/**
+ * Build the `az group create` command. `az group create` is idempotent — a group
+ * that already exists is returned unchanged — so no existence check is needed.
+ * Pure — exported for testing.
+ */
+export function azGroupEnsureCommand(resourceGroup: string, location: string): string {
+  return `az group create --name ${resourceGroup} --location ${location} --output none`;
+}
+
+/** Build the `az group delete` command (non-blocking). Pure — exported for testing. */
+export function azGroupDeleteCommand(resourceGroup: string): string {
+  return `az group delete --name ${resourceGroup} --yes --no-wait`;
+}
+
+/**
+ * Ensure an Azure resource group exists before an ARM deployment.
+ *
+ * `az deployment group create` (the `arm` target of `nativeApply`) fails if its
+ * resource group is absent — unlike CloudFormation, which creates its own stack.
+ * Run this before the apply. Uses fastIdempotent profile — 5m timeout.
+ *
+ * This targets real Azure (via the logged-in `az` context). Local emulation
+ * against floci-az awaits an upstream `Microsoft.Resources/deployments` provider
+ * (see #705); when that lands, an endpoint/custom-cloud override slots in here.
+ */
+export async function azGroupEnsure(args: AzGroupEnsureArgs, signal?: AbortSignal): Promise<void> {
+  const location = args.location ?? DEFAULT_LOCATION;
+  const { stdout, stderr } = await execAsync(
+    azGroupEnsureCommand(args.resourceGroup, location),
+    { signal },
+  );
+  if (stdout) console.log(stdout);
+  if (stderr) console.error(stderr);
+}
+
+/**
+ * Delete an Azure resource group and everything in it (non-blocking). A no-op
+ * success when the group is already gone. Uses fastIdempotent profile — 5m
+ * timeout (`--no-wait` returns immediately).
+ */
+export async function azGroupDelete(args: AzGroupDeleteArgs, signal?: AbortSignal): Promise<void> {
+  try {
+    await execAsync(azGroupDeleteCommand(args.resourceGroup), { signal });
+  } catch {
+    // Group already absent — treat as success.
+  }
+}

package/src/op/activities/index.ts

@@ -0,0 +1,24 @@
+/**
+ * Azure Op activities — resolved by the core activity registry when a project's
+ * `chant.config.ts` lists the `azure` lexicon. Contributes the resource-group
+ * lifecycle (`azGroupEnsure`/`azGroupDelete`) that an ARM `nativeApply` needs.
+ */
+export { azGroupEnsure, azGroupDelete, azGroupEnsureCommand, azGroupDeleteCommand } from "./azure";
+export type { AzGroupEnsureArgs, AzGroupDeleteArgs } from "./azure";
+
+export {
+  azApply,
+  azDelete,
+  pruneArmOrphans,
+  deleteArmResource,
+  listGroupResources,
+  chantOwnershipTags,
+  isChantOwned,
+  evalArm,
+  evalArmString,
+  armResourceUrl,
+  armResourceBody,
+  armDependencies,
+  orderArmResources,
+} from "./az-apply";
+export type { AzApplyArgs, ArmEvalCtx, ArmResource, ArmListItem, AzHttp } from "./az-apply";

package/src/ownership.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, test } from "vitest";
+import { ownershipEntries } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership";
+
+describe("AZURE_TAG_OWNERSHIP_KEYS", () => {
+  test("uses Azure hyphen-form tag keys (no slash, which Azure forbids)", () => {
+    expect(AZURE_TAG_OWNERSHIP_KEYS).toEqual({
+      managedBy: "chant-managed-by",
+      stack: "chant-stack",
+      env: "chant-env",
+    });
+    expect(Object.values(AZURE_TAG_OWNERSHIP_KEYS).some((k) => k.includes("/"))).toBe(false);
+  });
+
+  test("stamps the hyphen keys via the core ownershipEntries helper", () => {
+    const e = ownershipEntries(AZURE_TAG_OWNERSHIP_KEYS, { stack: "billing", env: "stg" });
+    expect(e).toEqual({ "chant-managed-by": "chant", "chant-stack": "billing", "chant-env": "stg" });
+  });
+});

package/src/ownership.ts

@@ -0,0 +1,16 @@
+/**
+ * The azure lexicon's ownership tag convention. Azure tag keys forbid `/`, so
+ * chant's markers use a hyphenated `chant-<name>` form (distinct from the
+ * label-based convention core keeps for k8s/gcp, and from AWS's `chant:<name>`).
+ * Core owns the generic stamp/detect logic (@intentius/chant/ownership); this is
+ * the azure-specific key naming it stamps.
+ */
+
+import type { ChannelKeys } from "@intentius/chant/ownership";
+
+/** Azure tag keys for chant's ownership markers. */
+export const AZURE_TAG_OWNERSHIP_KEYS: ChannelKeys = {
+  managedBy: "chant-managed-by",
+  stack: "chant-stack",
+  env: "chant-env",
+};

package/src/plugin.ts

@@ -6,6 +6,7 @@ import type { TypeScriptGenerator } from "@intentius/chant/import/generator";
 import type { CompletionContext, CompletionItem, HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
 import type { McpToolContribution, McpResourceContribution } from "@intentius/chant/mcp/types";
 import { postSynthChecks as postSynthCheckList } from "./lint/post-synth";
+import { azureAuditCatalog } from "./lint/audit-catalog";
 import { createSkillsLoader } from "@intentius/chant/lexicon-plugin-helpers";
 import { readFileSync, readdirSync, existsSync } from "fs";
 import { join, dirname } from "path";
@@ -27,6 +28,7 @@ import { azureHover } from "./lsp/hover";
  */
 export const azurePlugin: LexiconPlugin = {
   name: "azure",
+  auditCatalog: () => azureAuditCatalog,
   serializer: azureSerializer,
 
   lintRules(): LintRule[] {

package/src/serializer.ts

@@ -14,6 +14,7 @@ import type { Declarable, CoreParameter } from "@intentius/chant/declarable";
 import { isPropertyDeclarable } from "@intentius/chant/declarable";
 import type { Serializer, SerializerResult, SerializeContext } from "@intentius/chant/serializer";
 import { ownershipEntries, type OwnershipMarker } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
@@ -191,7 +192,7 @@ function serializeToTemplate(
   // first so user default tags (and explicit per-resource tags) win.
   const defaultTagEntries: TagEntry[] = [];
   if (ownership) {
-    for (const [key, value] of Object.entries(ownershipEntries("azure-tag", ownership))) {
+    for (const [key, value] of Object.entries(ownershipEntries(AZURE_TAG_OWNERSHIP_KEYS, ownership))) {
       defaultTagEntries.push({ key, value });
     }
   }