@intentius/chant-lexicon-azure 0.30.0 → 0.32.0

package/dist/deep-observe.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Azure deep observation (#1086) — the azure row of the deep-observe contract
+ * (#1014).
+ *
+ * `az resource show --resource-group <env> --name <name> --resource-type
+ * <type> -o json` already returns the full ARM resource — the same call the
+ * thin path (./describe-resources.ts) makes, which keeps `provisioningState`
+ * (as `status`) plus `location`/`tags`. The depth is free; the work is
+ * entirely normalization, per the issue.
+ *
+ * ## Why the live tree is flattened, not passed through raw
+ *
+ * Unlike AWS (whose declared props mirror CloudFormation's vocabulary 1:1, so
+ * the Cloud Control payload normalizes and diffs as-is), chant's Azure
+ * resource classes do not mirror the ARM response shape verbatim: codegen
+ * (`spec/parse.ts`'s `RESOURCE_LEVEL_FIELDS` pass) flattens ARM's `properties`
+ * wrapper onto the constructor's top level, so a storage account's declared
+ * `minimumTlsVersion` is a sibling of `location`/`tags`, not nested under a
+ * `properties` key. Passing the raw `az resource show` response through
+ * unflattened would make `properties.minimumTlsVersion` a path with no
+ * declared counterpart, ever — the same permanent-noise problem AWS avoids by
+ * having a vocabulary match to begin with. So this reader flattens
+ * `properties.*` up to the same top level chant's generated classes use,
+ * alongside the resource-level fields (`name`, `location`, `sku`, `kind`,
+ * `identity`, `tags`, `zones`, `plan`) ARM returns as siblings of `properties`.
+ *
+ * `id`, `type`, `etag` and `systemData` are the one thing that's *not*
+ * flattened in — they have no declared counterpart of any kind (chant's
+ * codegen skips `type`/`apiVersion` explicitly, and `id`/`etag`/`systemData`
+ * are pure ARM-envelope bookkeeping), so they are simply never read into the
+ * tree, the same way `type`/`physicalId` live outside `properties` on {@link
+ * DeepResourceObservation} rather than inside it.
+ *
+ * ## Scope
+ *
+ * Same as the thin path: any top-level ARM type (`Microsoft.<provider>/<kind>`,
+ * exactly one `/`) is readable; a nested compound type
+ * (`Microsoft.Storage/storageAccounts/blobServices`) is `unsupported-kind`,
+ * because `az resource show` does not accept a compound type name either.
+ * Deferred, not fixed, here — same as the issue's own "worth fixing here or
+ * explicitly deferring" — widening it is additive and needs no contract change.
+ *
+ * ## Nothing here talks to real Azure on its own terms
+ *
+ * `node:child_process` `exec`, exactly like the thin path — no ARM SDK, no
+ * ambient token. Every test replaces `child_process.exec`.
+ */
+import type { DeepNormalizationHooks, DeepObservationResult } from "@intentius/chant/lexicon";
+/**
+ * Server-populated wherever they appear — matched on the final path segment,
+ * the same technique AWS's `AWS_READ_ONLY_NAMES` uses, because ARM repeats
+ * `provisioningState` at every resource-properties depth and a per-type list
+ * of full paths would be a maintenance trap. Deliberately excludes ambiguous
+ * names like `id`/`name`: a subnet's `properties.routeTable.id` is a declared
+ * cross-reference, and pruning it is how a normalization pass starts hiding
+ * real drift. (The resource's *own* envelope `id` is handled separately —
+ * see the module doc — precisely so this list never has to touch `id` at all.)
+ */
+export declare const AZURE_READ_ONLY_NAMES: ReadonlySet<string>;
+/**
+ * ARM service defaults, per type, as index-erased property paths. Subtracted
+ * only where source never declared the property — cdk-real-drift's default
+ * subtraction, same as AWS's `AWS_SERVICE_DEFAULTS`. Sparse and evidence-based
+ * rather than exhaustive across 1900+ ARM types: widening this table is
+ * additive and needs no contract change.
+ */
+export declare const AZURE_SERVICE_DEFAULTS: Record<string, Record<string, unknown>>;
+/**
+ * The azure lexicon's noise rules. Three classes, same as AWS: server-
+ * populated fields (by name, unconditional), controller-injected boilerplate
+ * (by name, unconditional), and ARM service defaults (gated on
+ * `counterpart === "absent"`) — plus tag-map defaults, which AWS has no
+ * equivalent for since its `Tags` is an array rather than a plain object (an
+ * ARM tag map's key order is already canonicalized unconditionally by core,
+ * since it is a plain object; only the *default empty map* needs a rule here).
+ */
+export declare const azureDeepNormalizationHooks: DeepNormalizationHooks;
+export interface AzureDeepObserveOptions {
+    environment: string;
+    entityNames: string[];
+    entities: Map<string, {
+        entityType: string;
+        props: Record<string, unknown>;
+    }>;
+}
+/**
+ * Read the live property tree for each declared entity via `az resource
+ * show`. One call per entity, same as the thin path — ARM has no bulk
+ * "describe everything in this group" call with per-resource depth the way
+ * CloudFormation's `describe-stack-resources` does, so there is no cheap
+ * list-then-describe split to make here the way AWS's or temporal's readers
+ * do.
+ */
+export declare function observeResourcesDeepAzure(options: AzureDeepObserveOptions): Promise<DeepObservationResult>;
+//# sourceMappingURL=deep-observe.d.ts.map

package/dist/deep-observe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAIH,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAkDlC;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAKpD,CAAC;AAUH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI1E,CAAC;AAuCF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAiCzC,CAAC;AAIF,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,qBAAqB,CAAC,CAgEhC"}

package/dist/describe-resources.d.ts

@@ -17,6 +17,16 @@
  * are holes for the same reason.
  */
 import type { ObservationResult, UnobservedReason } from "@intentius/chant/lexicon";
+/**
+ * Top-level ARM type — i.e. exactly one `/` separating provider from kind.
+ * Nested types like `Microsoft.Storage/storageAccounts/blobServices` need a
+ * different query path that this implementation doesn't yet support.
+ *
+ * Exported so the deep reader (./deep-observe.ts, #1086) applies the exact
+ * same scope limit — a nested type is `unsupported-kind` at both depths, not
+ * silently deeper on one and not the other.
+ */
+export declare function isTopLevelType(entityType: string): boolean;
 /**
  * Classify an `az resource show` failure (#1089). Only the CLI's explicit
  * not-found establishes absence; everything else — an expired login, a

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAmCxH;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAkC9H;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA2E7B"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAsC,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAyBxH;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAkC9H;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA2E7B"}

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { defaultTags, type TagEntry, type DefaultTags } from "./default-tags.js"
 export { azureSerializer } from "./serializer.js";
 export { azurePlugin } from "./plugin.js";
 export { Parameter } from "./parameter.js";
+export { observeResourcesDeepAzure, azureDeepNormalizationHooks, AZURE_READ_ONLY_NAMES, AZURE_SERVICE_DEFAULTS, } from "./deep-observe.js";
 export { ResourceId, ResourceIdIntrinsic, Reference, ReferenceIntrinsic, Concat, ConcatIntrinsic, ResourceGroup, ResourceGroupIntrinsic, Subscription, SubscriptionIntrinsic, UniqueString, UniqueStringIntrinsic, Format, FormatIntrinsic, If, IfIntrinsic, ListKeys, ListKeysIntrinsic, } from "./intrinsics.js";
 export { Azure, ResourceGroupName, ResourceGroupLocation, ResourceGroupId, SubscriptionId, TenantId, DeploymentName, } from "./pseudo.js";
 export { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "50025ac710a4bd52992e4a6b196a56d2ff14735a095dd7f72cf8bcb389b761ea",
+    "manifest.json": "26f39f43ef7014727ea4212bc218d7dac00e6d89dc5d827ada31340b83274afe",
     "meta.json": "051fb4ee43f7de48a36f1abc59c8ff5207c3b75aa28f13db6440b9f5b0337605",
     "types/index.d.ts": "617a6de433bd92a126170a7f5ae903d6d7aa83fbb0b57169d3450b5a13e72e0d",
     "rules/hardcoded-location.ts": "a9b1d1cec93f2ca9c5206641f53fc9621cefcfd2c00b3ab89c194b30a75fa949",
@@ -33,5 +33,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "923cf13c8ea5dfb598f2aecae0e957d42e977bc511747871532644ab9230d8ed"
+  "composite": "6acb8658d790ae68bf979a47f2a36d47cfb9beb72b922d146d146b60164a3227"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AAsB5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAqbzB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,0BAA0B,CAAC;AAuB5E;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAqczB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,7 +74,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.30.0",
+    "@intentius/chant": "^0.32.0",
     "typescript": "^5.9.3"
   }
 }

package/src/deep-observe.test.ts

@@ -0,0 +1,372 @@
+/**
+ * Azure deep observation (#1086) — the azure row of the deep-observe
+ * contract (#1014).
+ *
+ * `node:child_process`'s `exec` is mocked, exactly like
+ * describe-resources.test.ts — no ARM SDK, no ambient `az login` session,
+ * nothing reaches a network.
+ */
+import { describe, test, expect, vi, beforeEach } from "vitest";
+
+const execMock = vi.fn();
+vi.mock("node:child_process", async () => {
+  const actual = await vi.importActual<typeof import("node:child_process")>("node:child_process");
+  return {
+    ...actual,
+    exec: (cmd: string, cb: (err: Error | null, out: { stdout: string; stderr: string }) => void) => {
+      Promise.resolve(execMock(cmd)).then(
+        (out) => cb(null, out as { stdout: string; stderr: string }),
+        (err) => cb(err as Error, { stdout: "", stderr: "" }),
+      );
+    },
+  };
+});
+
+const { azurePlugin } = await import("./plugin");
+const { observeResourcesDeepAzure, azureDeepNormalizationHooks } = await import("./deep-observe");
+const { deepDiffForLexicon } = await import("@intentius/chant/lifecycle/deep-observe");
+const { normalizeDeepObservation, normalizeDeepProperties } = await import("@intentius/chant/deep-observation");
+
+const ok = (body: Record<string, unknown>) => Promise.resolve({ stdout: JSON.stringify(body), stderr: "" });
+const fail = (stderr: string) => Promise.reject(Object.assign(new Error("az failed"), { stderr }));
+
+const entities = (
+  record: Record<string, { entityType: string; props: Record<string, unknown> }>,
+): Map<string, { entityType: string; props: Record<string, unknown> }> => new Map(Object.entries(record));
+
+beforeEach(() => {
+  execMock.mockReset();
+});
+
+describe("the azure noise rules", () => {
+  test("prunes server-populated names wherever they appear", () => {
+    const out = normalizeDeepProperties(
+      {
+        name: "acct",
+        resourceGuid: "11111111-2222-3333-4444-555555555555",
+        properties: { provisioningState: "Succeeded", nested: { provisioningState: "Succeeded", keep: 1 } },
+        identity: { type: "SystemAssigned", principalId: "guid-1", tenantId: "guid-2" },
+      },
+      { entityType: "Microsoft.Storage/storageAccounts", side: "live", hooks: azureDeepNormalizationHooks },
+    );
+    expect(out).toEqual({
+      name: "acct",
+      properties: { nested: { keep: 1 } },
+      identity: { type: "SystemAssigned" },
+    });
+  });
+
+  test("prunes defaultSecurityRules unconditionally — server boilerplate nobody declares", () => {
+    const out = normalizeDeepProperties(
+      { securityRules: [{ name: "allow-ssh", priority: 100 }], defaultSecurityRules: [{ name: "AllowVnetInBound" }] },
+      { entityType: "Microsoft.Network/networkSecurityGroups", side: "live", hooks: azureDeepNormalizationHooks },
+    );
+    expect(out).toEqual({ securityRules: [{ name: "allow-ssh", priority: 100 }] });
+  });
+
+  test("subtracts an empty tag map only where source declares no tags at all", () => {
+    const declaredNothing = normalizeDeepProperties(
+      { name: "acct", tags: {} },
+      { entityType: "Microsoft.Storage/storageAccounts", side: "live", hooks: azureDeepNormalizationHooks, counterpartPaths: new Set(["name"]) },
+    );
+    expect(declaredNothing).toEqual({ name: "acct" });
+
+    const declaredTags = normalizeDeepProperties(
+      { name: "acct", tags: {} },
+      { entityType: "Microsoft.Storage/storageAccounts", side: "live", hooks: azureDeepNormalizationHooks, counterpartPaths: new Set(["name", "tags"]) },
+    );
+    expect(declaredTags).toEqual({ name: "acct", tags: {} });
+  });
+
+  test("subtracts a per-type service default only where source is silent about the property", () => {
+    const declaredNothing = normalizeDeepProperties(
+      { name: "acct", minimumTlsVersion: "TLS1_2" },
+      { entityType: "Microsoft.Storage/storageAccounts", side: "live", hooks: azureDeepNormalizationHooks, counterpartPaths: new Set(["name"]) },
+    );
+    expect(declaredNothing).toEqual({ name: "acct" });
+
+    const declaredIt = normalizeDeepProperties(
+      { name: "acct", minimumTlsVersion: "TLS1_2" },
+      { entityType: "Microsoft.Storage/storageAccounts", side: "live", hooks: azureDeepNormalizationHooks, counterpartPaths: new Set(["name", "minimumTlsVersion"]) },
+    );
+    expect(declaredIt).toEqual({ name: "acct", minimumTlsVersion: "TLS1_2" });
+  });
+
+  test("a one-sided pass never subtracts defaults or the empty tag map — the reader has no declared tree yet", () => {
+    const out = normalizeDeepProperties(
+      { name: "acct", tags: {}, minimumTlsVersion: "TLS1_2" },
+      { entityType: "Microsoft.Storage/storageAccounts", side: "live", hooks: azureDeepNormalizationHooks },
+    );
+    expect(out).toEqual({ name: "acct", tags: {}, minimumTlsVersion: "TLS1_2" });
+  });
+
+  test("canonicalizes a named rule array by its name field", () => {
+    const out = normalizeDeepProperties(
+      { securityRules: [{ name: "deny-all", priority: 200 }, { name: "allow-ssh", priority: 100 }] },
+      { entityType: "Microsoft.Network/networkSecurityGroups", side: "live", hooks: azureDeepNormalizationHooks },
+    );
+    expect((out.securityRules as Array<{ name: string }>).map((r) => r.name)).toEqual(["allow-ssh", "deny-all"]);
+  });
+
+  test("canonicalizes a primitive-valued set by value, nested under any depth", () => {
+    const out = normalizeDeepProperties(
+      { addressSpace: { addressPrefixes: ["10.1.0.0/16", "10.0.0.0/16"] } },
+      { entityType: "Microsoft.Network/virtualNetworks", side: "live", hooks: azureDeepNormalizationHooks },
+    );
+    expect((out.addressSpace as { addressPrefixes: string[] }).addressPrefixes).toEqual(["10.0.0.0/16", "10.1.0.0/16"]);
+  });
+
+  test("leaves an array not on the known-set list in source order", () => {
+    const out = normalizeDeepProperties(
+      { routes: [{ name: "z" }, { name: "a" }] },
+      { entityType: "Microsoft.Network/routeTables", side: "live", hooks: azureDeepNormalizationHooks },
+    );
+    expect((out.routes as Array<{ name: string }>).map((r) => r.name)).toEqual(["z", "a"]);
+  });
+});
+
+describe("observeResourcesDeepAzure", () => {
+  test("queries az resource show with rg + name + type and flattens properties.* onto the top level", async () => {
+    let receivedCmd = "";
+    execMock.mockImplementation((cmd: string) => {
+      receivedCmd = cmd;
+      return ok({
+        id: "/subscriptions/sub/resourceGroups/prod-rg/providers/Microsoft.Storage/storageAccounts/mydata",
+        name: "mydata",
+        type: "Microsoft.Storage/storageAccounts",
+        location: "eastus",
+        tags: { env: "prod" },
+        etag: "\"abc\"",
+        systemData: { createdBy: "someone@example.com" },
+        properties: { provisioningState: "Succeeded", minimumTlsVersion: "TLS1_2", allowBlobPublicAccess: false },
+      });
+    });
+
+    const result = normalizeDeepObservation(
+      await observeResourcesDeepAzure({
+        environment: "prod-rg",
+        entityNames: ["dataAccount"],
+        entities: entities({ dataAccount: { entityType: "Microsoft.Storage/storageAccounts", props: { name: "mydata" } } }),
+      }),
+    );
+
+    expect(receivedCmd).toContain("az resource show");
+    expect(receivedCmd).toContain("--resource-group prod-rg");
+    expect(receivedCmd).toContain("--name mydata");
+    expect(receivedCmd).toContain("--resource-type Microsoft.Storage/storageAccounts");
+
+    // id/type/etag/systemData/provisioningState never reach the tree at all —
+    // no declared tree yet, so this is what a one-sided read looks like.
+    expect(result.resources.dataAccount).toEqual({
+      type: "Microsoft.Storage/storageAccounts",
+      physicalId: "/subscriptions/sub/resourceGroups/prod-rg/providers/Microsoft.Storage/storageAccounts/mydata",
+      properties: { name: "mydata", location: "eastus", tags: { env: "prod" }, minimumTlsVersion: "TLS1_2", allowBlobPublicAccess: false },
+    });
+  });
+
+  test("a resource not found leaves the entity out — a confirmed absence", async () => {
+    execMock.mockImplementation(() => fail("ResourceNotFound: ..."));
+    const result = normalizeDeepObservation(
+      await observeResourcesDeepAzure({
+        environment: "prod-rg",
+        entityNames: ["missing"],
+        entities: entities({ missing: { entityType: "Microsoft.Storage/storageAccounts", props: { name: "missing" } } }),
+      }),
+    );
+    expect(result).toEqual({ resources: {}, unobserved: {} });
+  });
+
+  test("an expired az login is a hole, not an absence", async () => {
+    execMock.mockImplementation(() => fail("Please run 'az login' to setup account."));
+    const result = normalizeDeepObservation(
+      await observeResourcesDeepAzure({
+        environment: "prod-rg",
+        entityNames: ["acct"],
+        entities: entities({ acct: { entityType: "Microsoft.Storage/storageAccounts", props: { name: "acct" } } }),
+      }),
+    );
+    expect(result.resources).toEqual({});
+    expect(result.unobserved.acct.reason).toBe("no-credentials");
+  });
+
+  test("a nested ARM type is unsupported-kind, never absent — az resource show is never called", async () => {
+    const result = normalizeDeepObservation(
+      await observeResourcesDeepAzure({
+        environment: "prod-rg",
+        entityNames: ["nested"],
+        entities: entities({ nested: { entityType: "Microsoft.Storage/storageAccounts/blobServices", props: { name: "default" } } }),
+      }),
+    );
+    expect(result.resources).toEqual({});
+    expect(result.unobserved.nested.reason).toBe("unsupported-kind");
+    expect(execMock).not.toHaveBeenCalled();
+  });
+
+  test("a non-ARM entity type is unsupported-kind — no ARM type to query", async () => {
+    const result = normalizeDeepObservation(
+      await observeResourcesDeepAzure({
+        environment: "prod-rg",
+        entityNames: ["x"],
+        entities: entities({ x: { entityType: "AWS::S3::Bucket", props: { name: "x" } } }),
+      }),
+    );
+    expect(result.unobserved.x.reason).toBe("unsupported-kind");
+    expect(execMock).not.toHaveBeenCalled();
+  });
+
+  test("an entity with no name is a hole — nothing was queried", async () => {
+    const result = normalizeDeepObservation(
+      await observeResourcesDeepAzure({
+        environment: "prod-rg",
+        entityNames: ["broken"],
+        entities: entities({ broken: { entityType: "Microsoft.Storage/storageAccounts", props: {} } }),
+      }),
+    );
+    expect(result.unobserved.broken.reason).toBe("read-failed");
+    expect(execMock).not.toHaveBeenCalled();
+  });
+});
+
+/**
+ * The acceptance test for #1086: the real plugin, a mutated live resource
+ * group, a baseline, and exactly the genuine drift — same shape as the AWS
+ * reference's end-to-end test.
+ */
+describe("end to end: declared + mutated live + baseline (#1086)", () => {
+  const declared = entities({
+    // Declared with TLS enforced, public blob access off, one tag.
+    dataAccount: {
+      entityType: "Microsoft.Storage/storageAccounts",
+      props: { name: "mydata", location: "eastus", tags: { env: "prod" }, minimumTlsVersion: "TLS1_2", allowBlobPublicAccess: false },
+    },
+    // Declared with two address prefixes, in source order.
+    vnet: {
+      entityType: "Microsoft.Network/virtualNetworks",
+      props: { name: "core-vnet", location: "eastus", addressSpace: { addressPrefixes: ["10.0.0.0/16", "10.1.0.0/16"] } },
+    },
+    // No reader for a nested ARM type.
+    blobServices: { entityType: "Microsoft.Storage/storageAccounts/blobServices", props: { name: "default" } },
+    // The deep read of this one fails outright.
+    secureAcct: { entityType: "Microsoft.Storage/storageAccounts", props: { name: "secure-acct" } },
+  });
+
+  const wireMocks = (): void => {
+    execMock.mockImplementation((cmd: string) => {
+      if (cmd.includes("--name mydata")) {
+        return ok({
+          id: "/subscriptions/sub/resourceGroups/prod/providers/Microsoft.Storage/storageAccounts/mydata",
+          name: "mydata",
+          location: "eastus",
+          etag: "\"abc\"",
+          // NOISE: an out-of-band tag the platform team adds to every bucket.
+          tags: { env: "prod", "cost-center": "platform" },
+          properties: {
+            // NOISE: server-populated.
+            provisioningState: "Succeeded",
+            resourceGuid: "11111111-2222-3333-4444-555555555555",
+            // NOISE: matches the declared value, so no drift either way.
+            minimumTlsVersion: "TLS1_2",
+            // GENUINE: somebody flipped this in the portal.
+            allowBlobPublicAccess: true,
+          },
+        });
+      }
+      if (cmd.includes("--name core-vnet")) {
+        return ok({
+          id: "/subscriptions/sub/resourceGroups/prod/providers/Microsoft.Network/virtualNetworks/core-vnet",
+          name: "core-vnet",
+          location: "eastus",
+          properties: {
+            provisioningState: "Succeeded",
+            resourceGuid: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+            // NOISE: same two prefixes, different order.
+            addressSpace: { addressPrefixes: ["10.1.0.0/16", "10.0.0.0/16"] },
+          },
+        });
+      }
+      if (cmd.includes("--name secure-acct")) {
+        return fail("Please run 'az login' to setup account.");
+      }
+      return fail("unexpected call");
+    });
+  };
+
+  const baseline = {
+    dataAccount: {
+      type: "Microsoft.Storage/storageAccounts",
+      accepted: [{ path: "tags.cost-center", value: "platform" }],
+    },
+  };
+
+  test("exactly the genuine drift surfaces; noise, defaults and the accepted tag do not", async () => {
+    wireMocks();
+    const result = await deepDiffForLexicon(azurePlugin, {
+      environment: "prod",
+      buildOutput: "",
+      entities: declared,
+      baseline,
+    });
+
+    // One finding, one property: the console-flipped public-access setting.
+    expect(result.drifted).toEqual([
+      {
+        name: "dataAccount",
+        type: "Microsoft.Storage/storageAccounts",
+        changes: [{ path: "allowBlobPublicAccess", kind: "changed", declared: false, live: true }],
+      },
+    ]);
+
+    // The vnet is clean: reordering and server-populated fields subtract.
+    expect(result.unchanged).toEqual(["vnet"]);
+
+    // The platform team's tag is accepted, so it is reported as suppressed
+    // rather than as drift.
+    expect(result.accepted.map((e) => e.name)).toEqual(["dataAccount"]);
+    expect(result.accepted[0].changes.map((c) => c.path)).toEqual(["tags.cost-center"]);
+
+    // An unreadable deep read is a hole with a reason — never silence, never
+    // noise, and never a create.
+    expect(result.unobserved).toEqual([
+      {
+        name: "blobServices",
+        type: "Microsoft.Storage/storageAccounts/blobServices",
+        reason: "unsupported-kind",
+        detail: "az resource show does not accept a nested ARM type; chant never queried this resource",
+      },
+      { name: "secureAcct", type: "Microsoft.Storage/storageAccounts", reason: "no-credentials", detail: "Please run 'az login' to setup account." },
+    ]);
+  });
+
+  test("without the baseline the platform tag is drift, and accepting it is what silences it", async () => {
+    wireMocks();
+    const result = await deepDiffForLexicon(azurePlugin, { environment: "prod", buildOutput: "", entities: declared });
+    const dataAccount = result.drifted.find((d) => d.name === "dataAccount");
+    expect(dataAccount?.changes.map((c) => c.path).sort()).toEqual(["allowBlobPublicAccess", "tags.cost-center"]);
+    expect(result.accepted).toEqual([]);
+  });
+
+  test("an accepted value that later changes is drift again, with all three axes", async () => {
+    wireMocks();
+    const result = await deepDiffForLexicon(azurePlugin, {
+      environment: "prod",
+      buildOutput: "",
+      entities: declared,
+      baseline: { dataAccount: { accepted: [{ path: "tags.cost-center", value: "someone-elses-team" }] } },
+    });
+    const change = result.drifted.find((d) => d.name === "dataAccount")?.changes.find((c) => c.path === "tags.cost-center");
+    expect(change).toEqual({ path: "tags.cost-center", kind: "undeclared", live: "platform", baseline: "someone-elses-team" });
+  });
+
+  test("a whole-lexicon failure is a hole for every declared entity, not a clean report", async () => {
+    execMock.mockImplementation(() => fail("Unable to locate credentials"));
+    const result = await deepDiffForLexicon(azurePlugin, { environment: "prod", buildOutput: "", entities: declared });
+    expect(result.drifted).toEqual([]);
+    // blobServices is still unsupported-kind — az resource show is never even
+    // called for it, so a broken CLI doesn't change its verdict.
+    expect(result.unobserved.map((u) => u.name).sort()).toEqual(["blobServices", "dataAccount", "secureAcct", "vnet"]);
+    expect(result.unobserved.find((u) => u.name === "blobServices")?.reason).toBe("unsupported-kind");
+    expect(
+      result.unobserved.filter((u) => u.name !== "blobServices").every((u) => u.reason === "read-failed"),
+    ).toBe(true);
+  });
+});

package/src/deep-observe.ts

@@ -0,0 +1,309 @@
+/**
+ * Azure deep observation (#1086) — the azure row of the deep-observe contract
+ * (#1014).
+ *
+ * `az resource show --resource-group <env> --name <name> --resource-type
+ * <type> -o json` already returns the full ARM resource — the same call the
+ * thin path (./describe-resources.ts) makes, which keeps `provisioningState`
+ * (as `status`) plus `location`/`tags`. The depth is free; the work is
+ * entirely normalization, per the issue.
+ *
+ * ## Why the live tree is flattened, not passed through raw
+ *
+ * Unlike AWS (whose declared props mirror CloudFormation's vocabulary 1:1, so
+ * the Cloud Control payload normalizes and diffs as-is), chant's Azure
+ * resource classes do not mirror the ARM response shape verbatim: codegen
+ * (`spec/parse.ts`'s `RESOURCE_LEVEL_FIELDS` pass) flattens ARM's `properties`
+ * wrapper onto the constructor's top level, so a storage account's declared
+ * `minimumTlsVersion` is a sibling of `location`/`tags`, not nested under a
+ * `properties` key. Passing the raw `az resource show` response through
+ * unflattened would make `properties.minimumTlsVersion` a path with no
+ * declared counterpart, ever — the same permanent-noise problem AWS avoids by
+ * having a vocabulary match to begin with. So this reader flattens
+ * `properties.*` up to the same top level chant's generated classes use,
+ * alongside the resource-level fields (`name`, `location`, `sku`, `kind`,
+ * `identity`, `tags`, `zones`, `plan`) ARM returns as siblings of `properties`.
+ *
+ * `id`, `type`, `etag` and `systemData` are the one thing that's *not*
+ * flattened in — they have no declared counterpart of any kind (chant's
+ * codegen skips `type`/`apiVersion` explicitly, and `id`/`etag`/`systemData`
+ * are pure ARM-envelope bookkeeping), so they are simply never read into the
+ * tree, the same way `type`/`physicalId` live outside `properties` on {@link
+ * DeepResourceObservation} rather than inside it.
+ *
+ * ## Scope
+ *
+ * Same as the thin path: any top-level ARM type (`Microsoft.<provider>/<kind>`,
+ * exactly one `/`) is readable; a nested compound type
+ * (`Microsoft.Storage/storageAccounts/blobServices`) is `unsupported-kind`,
+ * because `az resource show` does not accept a compound type name either.
+ * Deferred, not fixed, here — same as the issue's own "worth fixing here or
+ * explicitly deferring" — widening it is additive and needs no contract change.
+ *
+ * ## Nothing here talks to real Azure on its own terms
+ *
+ * `node:child_process` `exec`, exactly like the thin path — no ARM SDK, no
+ * ambient token. Every test replaces `child_process.exec`.
+ */
+
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import type {
+  DeepArrayElement,
+  DeepNode,
+  DeepNormalizationHooks,
+  DeepObservationResult,
+  DeepResourceObservation,
+  UnobservedEntity,
+} from "@intentius/chant/lexicon";
+import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
+import { classifyAzFailure, isTopLevelType } from "./describe-resources";
+
+const execAsync = promisify(exec);
+
+/** The full `az resource show -o json` shape this reader reads (a superset of the thin path's `AzResourceShowResponse`). */
+interface ArmResourceShowResponse {
+  id?: string;
+  name?: string;
+  type?: string;
+  location?: string;
+  kind?: string;
+  sku?: unknown;
+  identity?: unknown;
+  tags?: Record<string, string>;
+  zones?: string[];
+  plan?: unknown;
+  etag?: string;
+  systemData?: unknown;
+  properties?: Record<string, unknown>;
+}
+
+/**
+ * Reshape one `az resource show` response into chant's own flat declared
+ * vocabulary: the resource-level fields ARM returns as siblings of
+ * `properties`, plus every `properties.*` field spread onto that same top
+ * level (see the module doc). `id`/`type`/`etag`/`systemData` are envelope
+ * bookkeeping with no declared counterpart and are never read in at all.
+ */
+function buildLiveProperties(obj: ArmResourceShowResponse): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  if (obj.name !== undefined) out.name = obj.name;
+  if (obj.location !== undefined) out.location = obj.location;
+  if (obj.sku !== undefined) out.sku = obj.sku;
+  if (obj.kind !== undefined) out.kind = obj.kind;
+  if (obj.identity !== undefined) out.identity = obj.identity;
+  if (obj.tags !== undefined) out.tags = obj.tags;
+  if (obj.zones !== undefined) out.zones = obj.zones;
+  if (obj.plan !== undefined) out.plan = obj.plan;
+  if (obj.properties && typeof obj.properties === "object") {
+    for (const [k, v] of Object.entries(obj.properties)) {
+      if (v !== undefined) out[k] = v;
+    }
+  }
+  return out;
+}
+
+// ── Noise rules (#1086) ──────────────────────────────────────────────────────
+
+/**
+ * Server-populated wherever they appear — matched on the final path segment,
+ * the same technique AWS's `AWS_READ_ONLY_NAMES` uses, because ARM repeats
+ * `provisioningState` at every resource-properties depth and a per-type list
+ * of full paths would be a maintenance trap. Deliberately excludes ambiguous
+ * names like `id`/`name`: a subnet's `properties.routeTable.id` is a declared
+ * cross-reference, and pruning it is how a normalization pass starts hiding
+ * real drift. (The resource's *own* envelope `id` is handled separately —
+ * see the module doc — precisely so this list never has to touch `id` at all.)
+ */
+export const AZURE_READ_ONLY_NAMES: ReadonlySet<string> = new Set([
+  "provisioningState",
+  "resourceGuid",
+  "principalId",
+  "tenantId",
+]);
+
+/**
+ * Server-injected boilerplate no chant user ever declares nor could
+ * meaningfully override — Azure stamps every network security group with
+ * these regardless of what was requested, so unlike `AZURE_READ_ONLY_NAMES`
+ * this is dropped outright rather than compared.
+ */
+const AZURE_UNCONDITIONAL_PRUNE_NAMES: ReadonlySet<string> = new Set(["defaultSecurityRules"]);
+
+/**
+ * ARM service defaults, per type, as index-erased property paths. Subtracted
+ * only where source never declared the property — cdk-real-drift's default
+ * subtraction, same as AWS's `AWS_SERVICE_DEFAULTS`. Sparse and evidence-based
+ * rather than exhaustive across 1900+ ARM types: widening this table is
+ * additive and needs no contract change.
+ */
+export const AZURE_SERVICE_DEFAULTS: Record<string, Record<string, unknown>> = {
+  "Microsoft.Storage/storageAccounts": {
+    minimumTlsVersion: "TLS1_2",
+  },
+};
+
+/** Arrays known to be ARM sets (server order is not authoring order), keyed by well-known ARM naming conventions. */
+const AZURE_SET_ARRAY_NAMES: ReadonlySet<string> = new Set([
+  "securityRules",
+  "subnets",
+  "ipRules",
+  "virtualNetworkRules",
+  "addressPrefixes",
+  "dnsServers",
+  "zones",
+]);
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isEmptyRecord(value: unknown): boolean {
+  return isRecord(value) && Object.keys(value).length === 0;
+}
+
+/** Stable JSON with sorted keys — the fallback ordering key for a set-like array without a `name` field. */
+function canonicalJson(value: unknown): string {
+  return (
+    JSON.stringify(value, (_k, v: unknown) =>
+      v && typeof v === "object" && !Array.isArray(v)
+        ? Object.fromEntries(Object.entries(v as Record<string, unknown>).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)))
+        : v,
+    ) ?? ""
+  );
+}
+
+/** The final segment of an index-erased pattern (`properties.networkAcls.ipRules[]` → `ipRules`). */
+function lastSegment(pattern: string): string {
+  const withoutIndex = pattern.replace(/\[\]$/, "");
+  const dot = withoutIndex.lastIndexOf(".");
+  return dot === -1 ? withoutIndex : withoutIndex.slice(dot + 1);
+}
+
+/**
+ * The azure lexicon's noise rules. Three classes, same as AWS: server-
+ * populated fields (by name, unconditional), controller-injected boilerplate
+ * (by name, unconditional), and ARM service defaults (gated on
+ * `counterpart === "absent"`) — plus tag-map defaults, which AWS has no
+ * equivalent for since its `Tags` is an array rather than a plain object (an
+ * ARM tag map's key order is already canonicalized unconditionally by core,
+ * since it is a plain object; only the *default empty map* needs a rule here).
+ */
+export const azureDeepNormalizationHooks: DeepNormalizationHooks = {
+  prune(node: DeepNode): boolean {
+    const name = lastSegment(node.pattern);
+    if (AZURE_READ_ONLY_NAMES.has(name) || AZURE_UNCONDITIONAL_PRUNE_NAMES.has(name)) return true;
+
+    if (node.side !== "live" || node.counterpart !== "absent") return false;
+
+    // ARM always returns *some* tag map; an empty one when nobody declared any
+    // tag at all is the default, not a finding.
+    if (node.pattern === "tags" && isEmptyRecord(node.value)) return true;
+
+    const defaults = AZURE_SERVICE_DEFAULTS[node.entityType];
+    if (!defaults || !Object.prototype.hasOwnProperty.call(defaults, node.pattern)) return false;
+    return canonicalJson(defaults[node.pattern]) === canonicalJson(node.value);
+  },
+
+  /**
+   * The key doubles as a path segment (`securityRules[#allow-ssh]`), so a
+   * `name` field is the element's own identity where ARM gives one — which it
+   * does for essentially every nested rule/subnet/range collection — and
+   * canonical JSON only as a fallback for primitive-valued sets
+   * (`addressPrefixes`, `dnsServers`).
+   */
+  orderKey(element: DeepArrayElement): string | undefined {
+    const name = lastSegment(element.pattern);
+    if (!AZURE_SET_ARRAY_NAMES.has(name)) return undefined;
+    const el = element.element;
+    if (isRecord(el)) {
+      const key = typeof el.name === "string" ? el.name : undefined;
+      return key ?? canonicalJson(el);
+    }
+    return typeof el === "string" ? el : canonicalJson(el);
+  },
+};
+
+// ── The reader ───────────────────────────────────────────────────────────────
+
+export interface AzureDeepObserveOptions {
+  environment: string;
+  entityNames: string[];
+  entities: Map<string, { entityType: string; props: Record<string, unknown> }>;
+}
+
+/**
+ * Read the live property tree for each declared entity via `az resource
+ * show`. One call per entity, same as the thin path — ARM has no bulk
+ * "describe everything in this group" call with per-resource depth the way
+ * CloudFormation's `describe-stack-resources` does, so there is no cheap
+ * list-then-describe split to make here the way AWS's or temporal's readers
+ * do.
+ */
+export async function observeResourcesDeepAzure(
+  options: AzureDeepObserveOptions,
+): Promise<DeepObservationResult> {
+  const resources: Record<string, DeepResourceObservation> = {};
+  const unobserved: Record<string, UnobservedEntity> = {};
+
+  for (const [entityName, { entityType, props }] of options.entities) {
+    if (!entityType.startsWith("Microsoft.")) {
+      unobserved[entityName] = {
+        type: entityType,
+        reason: "unsupported-kind",
+        detail: "not an ARM resource type (expected Microsoft.<provider>/<kind>)",
+      };
+      continue;
+    }
+
+    if (!isTopLevelType(entityType)) {
+      unobserved[entityName] = {
+        type: entityType,
+        reason: "unsupported-kind",
+        detail: "az resource show does not accept a nested ARM type; chant never queried this resource",
+      };
+      continue;
+    }
+
+    const name = props.name as string | undefined;
+    if (!name) {
+      unobserved[entityName] = {
+        type: entityType,
+        reason: "read-failed",
+        detail: "declared entity has no name to query by",
+      };
+      continue;
+    }
+
+    const cmd = [
+      "az", "resource", "show",
+      "--resource-group", options.environment,
+      "--name", name,
+      "--resource-type", entityType,
+      "-o", "json",
+    ].join(" ");
+
+    try {
+      const { stdout } = await execAsync(cmd);
+      const obj: ArmResourceShowResponse = JSON.parse(stdout);
+      resources[entityName] = {
+        type: entityType,
+        physicalId: obj.id,
+        properties: normalizeDeepProperties(buildLiveProperties(obj), {
+          entityType,
+          side: "live",
+          hooks: azureDeepNormalizationHooks,
+        }),
+      };
+    } catch (err) {
+      // Not-found leaves the entity out (absence, same as the thin path).
+      // Auth/binding/other failures are holes so they can't become creates.
+      const outcome = classifyAzFailure(err);
+      if (!outcome.absent) {
+        unobserved[entityName] = { type: entityType, reason: outcome.reason, detail: outcome.detail };
+      }
+    }
+  }
+
+  return deepObservation(resources, unobserved);
+}

package/src/describe-resources.ts

@@ -48,8 +48,12 @@ function pruneUndefined<T extends Record<string, unknown>>(obj: T): Record<strin
  * Top-level ARM type — i.e. exactly one `/` separating provider from kind.
  * Nested types like `Microsoft.Storage/storageAccounts/blobServices` need a
  * different query path that this implementation doesn't yet support.
+ *
+ * Exported so the deep reader (./deep-observe.ts, #1086) applies the exact
+ * same scope limit — a nested type is `unsupported-kind` at both depths, not
+ * silently deeper on one and not the other.
  */
-function isTopLevelType(entityType: string): boolean {
+export function isTopLevelType(entityType: string): boolean {
   const slashCount = (entityType.match(/\//g) ?? []).length;
   return slashCount === 1;
 }

package/src/index.ts

@@ -10,6 +10,15 @@ export { azureSerializer } from "./serializer";
 export { azurePlugin } from "./plugin";
 export { Parameter } from "./parameter";
 
+// Deep observation (#1086): the `az resource show` reader and the noise
+// rules it shares with core's normalization pass.
+export {
+  observeResourcesDeepAzure,
+  azureDeepNormalizationHooks,
+  AZURE_READ_ONLY_NAMES,
+  AZURE_SERVICE_DEFAULTS,
+} from "./deep-observe";
+
 // --- Intrinsics ---
 export {
   ResourceId, ResourceIdIntrinsic,

package/src/plugin.ts

@@ -19,6 +19,7 @@ import { ArmParser } from "./import/parser";
 import { ArmGenerator } from "./import/generator";
 import { azureCompletions } from "./lsp/completions";
 import { azureHover } from "./lsp/hover";
+import { azureDeepNormalizationHooks, observeResourcesDeepAzure } from "./deep-observe";
 
 /**
  * Azure Resource Manager lexicon plugin.
@@ -459,6 +460,22 @@ export const tags = defaultTags([
     return describeResources(options);
   },
 
+  /**
+   * Property-level live read (#1086) — `az resource show` already returns
+   * the full ARM resource; this normalizes it. Implementation in
+   * ./deep-observe.ts.
+   */
+  async observeResourcesDeep(options) {
+    return observeResourcesDeepAzure({
+      environment: options.environment,
+      entityNames: options.entityNames,
+      entities: options.entities,
+    });
+  },
+
+  /** The noise rules the deep pass applies to both the live and declared trees. */
+  deepNormalizationHooks: azureDeepNormalizationHooks,
+
   async exportResources(options) {
     const { exportResources } = await import("./export-resources");
     return exportResources(options);