@intentius/chant-lexicon-azure 0.15.0 → 0.15.2

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "3b3b9ea67bcddf7d194ad6885c0ef2b41fe820dcc229b36f0593aee5b3227606",
+    "manifest.json": "9b6eec8e49d61507ee2c5451aac2dd7dd84d0a929c5955898a70caaace370115",
     "meta.json": "4b9c0be734f8b4a5fbba3136e14aaa1ea73ff0ee93f2aa480db83e476ce727b5",
     "types/index.d.ts": "d62c0fd7947ddf04a9126cc8bf44a9f4437f21cf8647fc812c022398f2c00d57",
     "rules/hardcoded-location.ts": "a9b1d1cec93f2ca9c5206641f53fc9621cefcfd2c00b3ab89c194b30a75fa949",
@@ -33,5 +33,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "18a72855f694f2b11534c8dafffcd84b8fa040f8e9fc47285135488a7c357639"
+  "composite": "4b88a0517fc5aa7720d15b6e8cce2ffac5986819d42ddd3e5832135157c4981b"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/op/activities/az-apply.d.ts

@@ -1,9 +1,3 @@
-/** Context for evaluating the ARM template expressions chant emits. */
-export interface ArmContext {
-    subscriptionId: string;
-    resourceGroup: string;
-    location: string;
-}
 /** One ARM resource from a `deploymentTemplate.json` `resources[]`. */
 export interface ArmResource {
     type: string;
@@ -14,25 +8,44 @@ export interface ArmResource {
     sku?: unknown;
     kind?: unknown;
     tags?: Record<string, string>;
+    dependsOn?: unknown;
 }
-/**
- * Evaluate an ARM template expression string (`"[...]"`). Supports the functions
- * chant's serializer emits: `concat`, `uniqueString`, `resourceGroup()` (`.id` /
- * `.location`), `subscription()` (`.subscriptionId`), and string literals. A
- * non-expression string is returned unchanged. Pure.
- */
-export declare function evalArmString(s: string, ctx: ArmContext): string;
-/** Recursively evaluate every string in a value against the ARM context. Pure. */
-export declare function evalArm(value: unknown, ctx: ArmContext): unknown;
 /** Injectable HTTP client — mirrors the GCP applier so tests avoid the network. */
 export type AzHttp = (method: string, url: string, body?: unknown, signal?: AbortSignal) => Promise<{
     status: number;
     text: string;
 }>;
-/** The ARM resource-ID PUT URL for a resource under a resource group. Pure. */
-export declare function armResourceUrl(resource: ArmResource, ctx: ArmContext, base: string): string;
-/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. Pure. */
-export declare function armResourceBody(resource: ArmResource, ctx: ArmContext): Record<string, unknown>;
+/**
+ * Context for evaluating ARM template expressions. `deployed` holds the response
+ * bodies of resources already applied this run (keyed by evaluated name) so
+ * `reference()` resolves; `http`/`base` let `listKeys()` call the resource's
+ * key action.
+ */
+export interface ArmEvalCtx {
+    subscriptionId: string;
+    resourceGroup: string;
+    location: string;
+    deployed: Map<string, unknown>;
+    http: AzHttp;
+    base: string;
+    signal?: AbortSignal;
+}
+/** Evaluate an ARM expression string (`"[...]"`); a plain string is returned as-is. */
+export declare function evalArmString(s: string, ctx: ArmEvalCtx): Promise<unknown>;
+/** Recursively evaluate every string in a value against the ARM context. */
+export declare function evalArm(value: unknown, ctx: ArmEvalCtx): Promise<unknown>;
+/** Resource names this resource references via `resourceId('type','name')` / `reference('name')`. Pure. */
+export declare function armDependencies(resource: ArmResource, names: Set<string>): string[];
+/**
+ * Topologically order ARM resources so a referenced resource is applied before
+ * the resource that references it. Names that are expressions are ordered as-is
+ * (they don't match a literal reference). Throws on a cycle. Pure.
+ */
+export declare function orderArmResources(resources: ArmResource[]): ArmResource[];
+/** The ARM resource-ID PUT URL for a resource (name expression evaluated). */
+export declare function armResourceUrl(resource: ArmResource, ctx: ArmEvalCtx): Promise<string>;
+/** The ARM resource PUT body (location/properties/sku/kind/tags), expressions evaluated. */
+export declare function armResourceBody(resource: ArmResource, ctx: ArmEvalCtx): Promise<Record<string, unknown>>;
 export interface AzApplyArgs {
     /** Path to a built ARM template (`deploymentTemplate.json`). */
     templatePath: string;
@@ -44,19 +57,74 @@ export interface AzApplyArgs {
     endpoint?: string;
     /** Subscription id. Default: floci-az's local subscription. */
     subscriptionId?: string;
+    /**
+     * Delete chant-owned resources of a templated type that are no longer in the
+     * template (owned-only prune). Destructive — off by default. Foreign
+     * (non-chant) resources are never touched.
+     */
+    prune?: boolean;
 }
 /**
  * The native Azure applier — read a built ARM template and PUT each resource
- * directly to the ARM resource-CRUD API, resolving ARM expressions first. This
- * is the direct-apply path (the Azure twin of `gcpApply`): it targets floci-az's
- * ARM resource endpoints — which `az deployment` cannot, since floci-az has no
- * `Microsoft.Resources/deployments` provider — or real Azure by endpoint override.
- * The resource group is ensured first. `http` is injectable for tests.
+ * directly to the ARM resource-CRUD API, in dependency order, resolving ARM
+ * expressions (including `reference()`/`listKeys()` against resources applied
+ * earlier this run). The Azure twin of `gcpApply`: it targets floci-az (which
+ * `az deployment` can't, floci-az having no deployments provider) or real Azure
+ * by endpoint override; the resource group is ensured first.
  */
 export declare function azApply(args: AzApplyArgs, signal?: AbortSignal, http?: AzHttp): Promise<{
     applied: Array<{
         type: string;
         name: string;
     }>;
+    pruned: Array<{
+        type: string;
+        name: string;
+        deleted: boolean;
+    }>;
+}>;
+/** The ownership tag azApply stamps on every resource it applies. */
+export declare function chantOwnershipTags(): Record<string, string>;
+/** Whether a resource's tags mark it chant-owned. */
+export declare function isChantOwned(tags: Record<string, string> | null | undefined): boolean;
+/** One resource from the ARM resource-group listing. */
+export interface ArmListItem {
+    id: string;
+    name: string;
+    type: string;
+    tags?: Record<string, string>;
+}
+/** List the resources in the group via the ARM resource-list endpoint. */
+export declare function listGroupResources(ctx: ArmEvalCtx, http?: AzHttp, signal?: AbortSignal): Promise<ArmListItem[]>;
+/** Idempotently delete one ARM resource by type/name/apiVersion. A 404 means it is already gone. */
+export declare function deleteArmResource(type: string, name: string, apiVersion: string, ctx: ArmEvalCtx, http?: AzHttp, signal?: AbortSignal): Promise<{
+    type: string;
+    name: string;
+    deleted: boolean;
+}>;
+/**
+ * Owned-only prune: for each resource type present in the template, delete the
+ * chant-owned live resources of that type whose (evaluated) name is not in the
+ * template. Scoped to templated types — like the GCP applier — so a type chant
+ * isn't managing this run is left alone, and the type's `apiVersion` is taken
+ * from the template. Foreign (non-chant) resources are never touched.
+ */
+export declare function pruneArmOrphans(desired: ArmResource[], ctx: ArmEvalCtx, http?: AzHttp, signal?: AbortSignal): Promise<Array<{
+    type: string;
+    name: string;
+    deleted: boolean;
+}>>;
+/**
+ * The inverse of {@link azApply} — read a built ARM template and delete the
+ * resources it declares, in reverse dependency order (a referrer goes before the
+ * resource it references). Idempotent: already-absent resources are a no-op. The
+ * Azure twin of `gcpDelete`; `http` is injectable for tests.
+ */
+export declare function azDelete(args: AzApplyArgs, signal?: AbortSignal, http?: AzHttp): Promise<{
+    deleted: Array<{
+        type: string;
+        name: string;
+        deleted: boolean;
+    }>;
 }>;
 //# sourceMappingURL=az-apply.d.ts.map

package/dist/op/activities/az-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAQA,uEAAuE;AACvE,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAID;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAKhE;AAED,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAShE;AA4FD,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAY/C,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,kGAAkG;AAClG,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQ/F;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CA6B7D"}
+{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAQA,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc/C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED,4EAA4E;AAC5E,wBAAsB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAgID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAenF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAqBzE;AAID,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ9G;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CA8C9H;AAYD,qEAAqE;AACrE,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE3D;AAED,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErF;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,MAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASlI;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAM3D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAmBlE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAsB/E"}

package/dist/op/activities/floci-az.d.ts

@@ -0,0 +1,44 @@
+export interface FlociAzUpArgs {
+    /** Container name. Default: `chant-floci-az`. */
+    name?: string;
+    /** Host port mapped to the emulator's `:4577`. Default: `4577`. */
+    port?: number;
+    /** Image. Default: `floci/floci-az:latest`. */
+    image?: string;
+    /** Readiness timeout in ms. Default: `60000`. */
+    timeoutMs?: number;
+    /** Health poll interval in ms. Default: `2000`. */
+    intervalMs?: number;
+}
+export interface FlociAzDownArgs {
+    /** Container name to remove. Default: `chant-floci-az`. */
+    name?: string;
+}
+/** `docker ps -q -f name=<name>` — non-empty stdout means the container is running. */
+export declare function flociAzExistsCommand(name: string): string;
+/** Build the `docker run` command that boots floci-az. */
+export declare function flociAzRunCommand(args: FlociAzUpArgs): string;
+/** Build the `docker rm -f` command. */
+export declare function flociAzRmCommand(name: string): string;
+/** The floci-az health endpoint URL for a host port. */
+export declare function flociAzHealthUrl(port: number): string;
+/** The ARM endpoint URL (what `azApply`'s `endpoint` should point at). */
+export declare function flociAzEndpoint(port: number): string;
+/**
+ * Boot a local floci-az (Azure emulator) in Docker and return its ARM endpoint.
+ *
+ * Idempotent: reuses a running container of the same name. Waits for the health
+ * endpoint to answer, then returns `{ endpoint }` for `azApply({ endpoint })`.
+ * The typed twin of the AWS `flociUp` — replaces a raw `docker run` shell step so
+ * the emulator lifecycle is modeled, not scripted. Uses longInfra profile — 20m
+ * timeout, heartbeat every poll (the image may pull).
+ */
+export declare function flociAzUp(args: FlociAzUpArgs, signal?: AbortSignal): Promise<{
+    endpoint: string;
+}>;
+/**
+ * Stop and remove the local floci-az container. A no-op success when the
+ * container is already gone. Uses fastIdempotent profile — 5m timeout.
+ */
+export declare function flociAzDown(args: FlociAzDownArgs, signal?: AbortSignal): Promise<void>;
+//# sourceMappingURL=floci-az.d.ts.map

package/dist/op/activities/floci-az.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"floci-az.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci-az.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,aAAa;IAC5B,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAK7D;AAED,wCAAwC;AACxC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA4CxG;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5F"}

package/dist/op/activities/index.d.ts

@@ -5,6 +5,8 @@
  */
 export { azGroupEnsure, azGroupDelete, azGroupEnsureCommand, azGroupDeleteCommand } from "./azure.js";
 export type { AzGroupEnsureArgs, AzGroupDeleteArgs } from "./azure.js";
-export { azApply, evalArm, evalArmString, armResourceUrl, armResourceBody } from "./az-apply.js";
-export type { AzApplyArgs, ArmContext, ArmResource, AzHttp } from "./az-apply.js";
+export { flociAzUp, flociAzDown, flociAzRunCommand, flociAzRmCommand, flociAzExistsCommand, flociAzHealthUrl, flociAzEndpoint, } from "./floci-az.js";
+export type { FlociAzUpArgs, FlociAzDownArgs } from "./floci-az.js";
+export { azApply, azDelete, pruneArmOrphans, deleteArmResource, listGroupResources, chantOwnershipTags, isChantOwned, evalArm, evalArmString, armResourceUrl, armResourceBody, armDependencies, orderArmResources, } from "./az-apply.js";
+export type { AzApplyArgs, ArmEvalCtx, ArmResource, ArmListItem, AzHttp } from "./az-apply.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEpE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC9F,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAIpE,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EACL,OAAO,EACP,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,6 +74,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.15.0"
+    "@intentius/chant": "^0.15.2"
   }
 }

package/src/op/activities/az-apply.test.ts

@@ -4,53 +4,119 @@ import {
   evalArm,
   armResourceUrl,
   armResourceBody,
+  armDependencies,
+  orderArmResources,
   azApply,
-  type ArmContext,
+  azDelete,
+  pruneArmOrphans,
+  deleteArmResource,
+  listGroupResources,
+  chantOwnershipTags,
+  isChantOwned,
+  type ArmEvalCtx,
   type ArmResource,
   type AzHttp,
 } from "./az-apply";
 
-const CTX: ArmContext = {
-  subscriptionId: "sub-1",
-  resourceGroup: "chant-rg",
-  location: "eastus",
-};
+const noHttp: AzHttp = async () => ({ status: 200, text: "{}" });
+
+function ctx(over: Partial<ArmEvalCtx> = {}): ArmEvalCtx {
+  return {
+    subscriptionId: "sub-1",
+    resourceGroup: "chant-rg",
+    location: "eastus",
+    deployed: new Map(),
+    http: noHttp,
+    base: "http://x",
+    ...over,
+  };
+}
 
-describe("evalArmString (#706)", () => {
-  test("resourceGroup().location / .id", () => {
-    expect(evalArmString("[resourceGroup().location]", CTX)).toBe("eastus");
-    expect(evalArmString("[resourceGroup().id]", CTX)).toBe("/subscriptions/sub-1/resourceGroups/chant-rg");
+describe("evalArmString — static functions (#707)", () => {
+  test("resourceGroup / subscription / concat / uniqueString", async () => {
+    expect(await evalArmString("[resourceGroup().location]", ctx())).toBe("eastus");
+    expect(await evalArmString("[resourceGroup().id]", ctx())).toBe("/subscriptions/sub-1/resourceGroups/chant-rg");
+    expect(await evalArmString("[subscription().subscriptionId]", ctx())).toBe("sub-1");
+    const v = await evalArmString("[concat('store', uniqueString(resourceGroup().id))]", ctx());
+    expect(String(v)).toHaveLength("store".length + 13);
   });
 
-  test("subscription().subscriptionId", () => {
-    expect(evalArmString("[subscription().subscriptionId]", CTX)).toBe("sub-1");
+  test("resourceId('type','name') → the resource-id path", async () => {
+    expect(await evalArmString("[resourceId('Microsoft.Web/serverfarms', 'plan1')]", ctx())).toBe(
+      "/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.Web/serverfarms/plan1",
+    );
   });
 
-  test("concat with a literal and a nested function", () => {
-    const v = evalArmString("[concat('store', uniqueString(resourceGroup().id))]", CTX);
-    expect(v.startsWith("store")).toBe(true);
-    expect(v).toHaveLength("store".length + 13); // uniqueString → 13 chars
+  test("non-expression + [[ escape passthrough", async () => {
+    expect(await evalArmString("plain", ctx())).toBe("plain");
+    expect(await evalArmString("[[literal]", ctx())).toBe("[literal]");
   });
+});
 
-  test("uniqueString is deterministic for the same inputs", () => {
-    const a = evalArmString("[uniqueString(resourceGroup().id)]", CTX);
-    const b = evalArmString("[uniqueString(resourceGroup().id)]", CTX);
-    expect(a).toBe(b);
+describe("evalArmString — reference() (#707)", () => {
+  test("reference('name') → the applied resource's properties, with .prop access", async () => {
+    const deployed = new Map<string, unknown>([
+      ["mystore", { properties: { primaryEndpoints: { blob: "http://mystore.blob/" } } }],
+    ]);
+    expect(await evalArmString("[reference('mystore').primaryEndpoints.blob]", ctx({ deployed }))).toBe(
+      "http://mystore.blob/",
+    );
   });
+});
 
-  test("non-expression strings pass through; [[ is an escaped literal", () => {
-    expect(evalArmString("plain-name", CTX)).toBe("plain-name");
-    expect(evalArmString("[[literal]", CTX)).toBe("[literal]");
+describe("evalArmString — listKeys() (#707)", () => {
+  test("listKeys(resourceId(...), v).keys[0].value → POSTs the key action and indexes", async () => {
+    const calls: string[] = [];
+    const http: AzHttp = async (method, url) => {
+      calls.push(`${method} ${url}`);
+      return { status: 200, text: JSON.stringify({ keys: [{ value: "SECRET-KEY" }, { value: "k2" }] }) };
+    };
+    const expr = "[concat('AccountKey=', listKeys(resourceId('Microsoft.Storage/storageAccounts', 'st'), '2023-01-01').keys[0].value)]";
+    expect(await evalArmString(expr, ctx({ http }))).toBe("AccountKey=SECRET-KEY");
+    expect(calls[0]).toBe("POST http://x/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.Storage/storageAccounts/st/listKeys?api-version=2023-01-01");
   });
+});
 
-  test("evalArm recurses into objects and arrays", () => {
-    expect(evalArm({ a: "[resourceGroup().location]", b: ["[subscription().subscriptionId]", 1] }, CTX)).toEqual({
+describe("evalArm recursion (#707)", () => {
+  test("recurses objects/arrays, resolving async expressions", async () => {
+    expect(await evalArm({ a: "[resourceGroup().location]", b: ["[subscription().subscriptionId]", 1] }, ctx())).toEqual({
       a: "eastus",
       b: ["sub-1", 1],
     });
   });
 });
 
+describe("dependency ordering (#707)", () => {
+  const plan: ArmResource = { type: "Microsoft.Web/serverfarms", apiVersion: "2023-01-01", name: "plan1" };
+  const store: ArmResource = { type: "Microsoft.Storage/storageAccounts", apiVersion: "2023-01-01", name: "st1" };
+  const site: ArmResource = {
+    type: "Microsoft.Web/sites",
+    apiVersion: "2023-01-01",
+    name: "site1",
+    properties: {
+      serverFarmId: "[resourceId('Microsoft.Web/serverfarms', 'plan1')]",
+      conn: "[listKeys(resourceId('Microsoft.Storage/storageAccounts', 'st1'), '2023-01-01')]",
+    },
+  };
+
+  test("armDependencies finds referenced resource names in the template", () => {
+    expect(armDependencies(site, new Set(["plan1", "st1", "site1"])).sort()).toEqual(["plan1", "st1"]);
+    expect(armDependencies(plan, new Set(["plan1", "st1", "site1"]))).toEqual([]);
+  });
+
+  test("orderArmResources applies dependencies before the referrer", () => {
+    const ordered = orderArmResources([site, plan, store]).map((r) => r.name);
+    expect(ordered.indexOf("plan1")).toBeLessThan(ordered.indexOf("site1"));
+    expect(ordered.indexOf("st1")).toBeLessThan(ordered.indexOf("site1"));
+  });
+
+  test("throws on a cycle", () => {
+    const a: ArmResource = { type: "T", apiVersion: "v", name: "a", properties: { r: "[resourceId('T', 'b')]" } };
+    const b: ArmResource = { type: "T", apiVersion: "v", name: "b", properties: { r: "[resourceId('T', 'a')]" } };
+    expect(() => orderArmResources([a, b])).toThrow(/reference cycle/);
+  });
+});
+
 const STORAGE: ArmResource = {
   type: "Microsoft.Storage/storageAccounts",
   apiVersion: "2025-06-01",
@@ -62,15 +128,15 @@ const STORAGE: ArmResource = {
   tags: { "managed-by": "chant" },
 };
 
-describe("armResourceUrl / armResourceBody (#706)", () => {
-  test("URL is the resource-id PUT path with api-version", () => {
-    expect(armResourceUrl(STORAGE, CTX, "http://x")).toBe(
+describe("armResourceUrl / armResourceBody (#707)", () => {
+  test("URL is the resource-id PUT path", async () => {
+    expect(await armResourceUrl(STORAGE, ctx())).toBe(
       "http://x/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.Storage/storageAccounts/chantstore1?api-version=2025-06-01",
     );
   });
 
-  test("body evaluates location, keeps sku/kind/tags/properties", () => {
-    expect(armResourceBody(STORAGE, CTX)).toEqual({
+  test("body evaluates location, keeps sku/kind/tags/properties", async () => {
+    expect(await armResourceBody(STORAGE, ctx())).toEqual({
       location: "eastus",
       sku: { name: "Standard_LRS" },
       kind: "StorageV2",
@@ -80,28 +146,33 @@ describe("armResourceUrl / armResourceBody (#706)", () => {
   });
 });
 
-describe("azApply flow (#706)", () => {
-  test("ensures the resource group, then PUTs each resource", async () => {
+describe("azApply flow (#707)", () => {
+  test("ensures the resource group, applies in dependency order, captures state", async () => {
     const calls: Array<{ method: string; url: string }> = [];
     const http: AzHttp = async (method, url) => {
       calls.push({ method, url });
       return { status: 200, text: "{}" };
     };
-    // Stub the template read via a data: path — azApply reads a file, so drive it
-    // through the pure pieces instead by asserting the call sequence a real run makes.
-    // Here we exercise the HTTP contract with a hand-built template file.
     const fs = await import("node:fs");
     const tmp = `/tmp/chant-arm-${process.pid}.json`;
-    fs.writeFileSync(tmp, JSON.stringify({ resources: [STORAGE] }));
+    const site: ArmResource = {
+      type: "Microsoft.Web/sites",
+      apiVersion: "2023-01-01",
+      name: "site1",
+      properties: { serverFarmId: "[resourceId('Microsoft.Web/serverfarms', 'plan1')]" },
+    };
+    const plan: ArmResource = { type: "Microsoft.Web/serverfarms", apiVersion: "2023-01-01", name: "plan1" };
+    fs.writeFileSync(tmp, JSON.stringify({ resources: [site, plan] })); // listed out of order
     const res = await azApply({ templatePath: tmp, resourceGroup: "chant-rg", location: "eastus", endpoint: "http://x", subscriptionId: "sub-1" }, undefined, http);
     fs.unlinkSync(tmp);
-    expect(res.applied).toEqual([{ type: "Microsoft.Storage/storageAccounts", name: "chantstore1" }]);
-    expect(calls[0].method).toBe("PUT");
-    expect(calls[0].url).toContain("/resourceGroups/chant-rg?api-version=");
-    expect(calls[1].url).toContain("/providers/Microsoft.Storage/storageAccounts/chantstore1?api-version=2025-06-01");
+    // plan (dependency) applied before site (referrer), despite manifest order.
+    expect(res.applied.map((a) => a.name)).toEqual(["plan1", "site1"]);
+    const puts = calls.filter((c) => c.method === "PUT" && c.url.includes("/providers/"));
+    expect(puts[0].url).toContain("/serverfarms/plan1");
+    expect(puts[1].url).toContain("/sites/site1");
   });
 
-  test("surfaces a resource apply failure (RG ok, resource PUT fails)", async () => {
+  test("surfaces a resource apply failure", async () => {
     const fs = await import("node:fs");
     const tmp = `/tmp/chant-arm-fail-${process.pid}.json`;
     fs.writeFileSync(tmp, JSON.stringify({ resources: [STORAGE] }));
@@ -112,4 +183,149 @@ describe("azApply flow (#706)", () => {
     ).rejects.toThrow(/Microsoft.Storage\/storageAccounts chantstore1 apply failed \(400\)/);
     fs.unlinkSync(tmp);
   });
+
+  test("stamps chant ownership on the PUT body", async () => {
+    const fs = await import("node:fs");
+    const tmp = `/tmp/chant-arm-own-${process.pid}.json`;
+    fs.writeFileSync(tmp, JSON.stringify({ resources: [{ type: "T", apiVersion: "v", name: "r1" }] }));
+    let putBody: Record<string, unknown> | undefined;
+    const http: AzHttp = async (method, url, body) => {
+      if (method === "PUT" && url.includes("/providers/")) putBody = body as Record<string, unknown>;
+      return { status: 200, text: "{}" };
+    };
+    await azApply({ templatePath: tmp, resourceGroup: "rg", endpoint: "http://x" }, undefined, http);
+    fs.unlinkSync(tmp);
+    expect((putBody?.tags as Record<string, string>)["managed-by"]).toBe("chant");
+  });
+});
+
+describe("ownership helpers (#azure-prune)", () => {
+  test("chantOwnershipTags / isChantOwned", () => {
+    expect(chantOwnershipTags()).toEqual({ "managed-by": "chant" });
+    expect(isChantOwned({ "managed-by": "chant" })).toBe(true);
+    expect(isChantOwned({ "managed-by": "someone-else" })).toBe(false);
+    expect(isChantOwned(undefined)).toBe(false);
+  });
+});
+
+describe("deleteArmResource (#azure-prune)", () => {
+  test("DELETEs the resource-id path; 404 is not-deleted", async () => {
+    const calls: string[] = [];
+    const http: AzHttp = async (method, url) => {
+      calls.push(`${method} ${url}`);
+      return { status: 200, text: "" };
+    };
+    const res = await deleteArmResource("Microsoft.Storage/storageAccounts", "st1", "2023-01-01", ctx(), http);
+    expect(res).toEqual({ type: "Microsoft.Storage/storageAccounts", name: "st1", deleted: true });
+    expect(calls[0]).toBe(
+      "DELETE http://x/subscriptions/sub-1/resourceGroups/chant-rg/providers/Microsoft.Storage/storageAccounts/st1?api-version=2023-01-01",
+    );
+    const gone = await deleteArmResource("T", "x", "v", ctx(), async () => ({ status: 404, text: "" }));
+    expect(gone.deleted).toBe(false);
+  });
+
+  test("throws on a non-404 error", async () => {
+    await expect(
+      deleteArmResource("T", "x", "v", ctx(), async () => ({ status: 403, text: "no" })),
+    ).rejects.toThrow(/T x delete failed \(403\)/);
+  });
+});
+
+describe("listGroupResources (#azure-prune)", () => {
+  test("returns the value[] items, filtering malformed entries", async () => {
+    const http: AzHttp = async () => ({
+      status: 200,
+      text: JSON.stringify({ value: [{ id: "/a", name: "a", type: "T", tags: { "managed-by": "chant" } }, { id: "/bad" }] }),
+    });
+    const items = await listGroupResources(ctx(), http);
+    expect(items.map((i) => i.name)).toEqual(["a"]);
+  });
+
+  test("returns [] on an error status", async () => {
+    expect(await listGroupResources(ctx(), async () => ({ status: 500, text: "" }))).toEqual([]);
+  });
+});
+
+describe("pruneArmOrphans (#azure-prune)", () => {
+  const desired: ArmResource[] = [{ type: "Microsoft.Storage/storageAccounts", apiVersion: "2023-01-01", name: "keep1" }];
+
+  test("deletes only chant-owned, templated-type resources not in the template", async () => {
+    const live = {
+      value: [
+        { id: "/1", name: "keep1", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "chant" } }, // in template → keep
+        { id: "/2", name: "orphan1", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "chant" } }, // owned, not in template → prune
+        { id: "/3", name: "foreign", type: "Microsoft.Storage/storageAccounts", tags: {} }, // not owned → skip
+        { id: "/4", name: "othertype", type: "Microsoft.Web/sites", tags: { "managed-by": "chant" } }, // type not templated → skip
+      ],
+    };
+    const deletes: string[] = [];
+    const http: AzHttp = async (method, url) => {
+      if (method === "DELETE") deletes.push(url);
+      return { status: 200, text: method === "GET" ? JSON.stringify(live) : "" };
+    };
+    const pruned = await pruneArmOrphans(desired, ctx(), http);
+    expect(pruned).toEqual([{ type: "Microsoft.Storage/storageAccounts", name: "orphan1", deleted: true }]);
+    expect(deletes).toHaveLength(1);
+    expect(deletes[0]).toContain("/storageAccounts/orphan1?api-version=2023-01-01"); // apiVersion from the template
+  });
+});
+
+describe("azApply prune flag (#azure-prune)", () => {
+  test("prunes owned orphans of a templated type after applying", async () => {
+    const fs = await import("node:fs");
+    const tmp = `/tmp/chant-arm-prune-${process.pid}.json`;
+    fs.writeFileSync(tmp, JSON.stringify({ resources: [{ type: "T", apiVersion: "v", name: "keep1" }] }));
+    const live = { value: [{ id: "/o", name: "orphan1", type: "T", tags: { "managed-by": "chant" } }] };
+    const deletes: string[] = [];
+    const http: AzHttp = async (method, url) => {
+      if (method === "DELETE") deletes.push(url);
+      return { status: 200, text: method === "GET" ? JSON.stringify(live) : "{}" };
+    };
+    const res = await azApply({ templatePath: tmp, resourceGroup: "rg", endpoint: "http://x", prune: true }, undefined, http);
+    fs.unlinkSync(tmp);
+    expect(res.applied.map((a) => a.name)).toEqual(["keep1"]);
+    expect(res.pruned).toEqual([{ type: "T", name: "orphan1", deleted: true }]);
+    expect(deletes[0]).toContain("/providers/T/orphan1");
+  });
+
+  test("no prune when the flag is off", async () => {
+    const fs = await import("node:fs");
+    const tmp = `/tmp/chant-arm-noprune-${process.pid}.json`;
+    fs.writeFileSync(tmp, JSON.stringify({ resources: [{ type: "T", apiVersion: "v", name: "keep1" }] }));
+    let listed = false;
+    const http: AzHttp = async (method, url) => {
+      if (method === "GET" && url.includes("/resources?")) listed = true;
+      return { status: 200, text: "{}" };
+    };
+    const res = await azApply({ templatePath: tmp, resourceGroup: "rg", endpoint: "http://x" }, undefined, http);
+    fs.unlinkSync(tmp);
+    expect(res.pruned).toEqual([]);
+    expect(listed).toBe(false);
+  });
+});
+
+describe("azDelete (#azure-prune)", () => {
+  test("deletes declared resources in reverse dependency order", async () => {
+    const fs = await import("node:fs");
+    const tmp = `/tmp/chant-arm-del-${process.pid}.json`;
+    const site: ArmResource = {
+      type: "Microsoft.Web/sites",
+      apiVersion: "2023-01-01",
+      name: "site1",
+      properties: { serverFarmId: "[resourceId('Microsoft.Web/serverfarms', 'plan1')]" },
+    };
+    const plan: ArmResource = { type: "Microsoft.Web/serverfarms", apiVersion: "2023-01-01", name: "plan1" };
+    fs.writeFileSync(tmp, JSON.stringify({ resources: [plan, site] }));
+    const deletes: string[] = [];
+    const http: AzHttp = async (method, url) => {
+      if (method === "DELETE") deletes.push(url);
+      return { status: 200, text: "" };
+    };
+    const res = await azDelete({ templatePath: tmp, resourceGroup: "chant-rg", endpoint: "http://x" }, undefined, http);
+    fs.unlinkSync(tmp);
+    // referrer (site) deleted before the resource it references (plan).
+    expect(res.deleted.map((d) => d.name)).toEqual(["site1", "plan1"]);
+    expect(deletes[0]).toContain("/sites/site1");
+    expect(deletes[1]).toContain("/serverfarms/plan1");
+  });
 });