@intentius/chant-lexicon-azure 0.41.20 → 0.44.1

package/dist/governance.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Azure governance authoring (#791, epic #787 C1): the desired-state config
+ * shape the Azure cloud warden reconciles, and `landingZoneConfig()` — the
+ * typed authoring layer that emits it.
+ *
+ * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
+ * #916/#952) require composites to declare a fixed set of resources, so a
+ * data-driven management-group tree walker cannot be one. The split mirrors
+ * the AWS/GCP slices (lexicons/{aws,gcp}/src/governance.ts): authoring emits
+ * config (this module, arbitrary cardinality); resources for greenfield
+ * bootstrap are the fixed-shape composites in `composites/landing-zone.ts`;
+ * the warden consumes only the config.
+ *
+ * Azure has no OrganizationRoot analog — the tenant and its root management
+ * group come from Entra ID, never from the resource API. Subscriptions the
+ * tree declares reconcile through Microsoft.Subscription/aliases (existing
+ * ids are placed, missing ones created from `billingScope`); aliases deploy
+ * at tenant scope only (#1545).
+ */
+/** A custom policy definition, keyed by name in `AzureGovernanceConfig.policies`. */
+export interface PolicyConfig {
+    description?: string;
+    displayName?: string;
+    /** The policy definition mode ("All", "Indexed", …). Defaults to "All". */
+    mode?: string;
+    /** Parameter definitions for parameters used in the policy rule. */
+    parameters?: Record<string, unknown>;
+    /** The policy rule (if/then). */
+    policyRule: Record<string, unknown>;
+}
+/** A subscription declared inside a management group. */
+export interface SubscriptionConfig {
+    name: string;
+    /** An existing subscription to place. Omitted: the warden creates one via a tenant-scope alias. */
+    subscriptionId?: string;
+    /** Billing scope for subscriptions the warden creates. */
+    billingScope?: string;
+    workload?: "Production" | "DevTest";
+}
+/** One management group: its guardrails, subscriptions, and children, keyed by group id. */
+export interface ManagementGroupConfig {
+    /** Defaults to the group id (the tree key). */
+    displayName?: string;
+    /** Names of policies (from `policies`) assigned to this management group. */
+    policies?: string[];
+    subscriptions?: SubscriptionConfig[];
+    children?: Record<string, ManagementGroupConfig>;
+}
+/**
+ * The desired-state governance tree for one Azure tenant. This is the shape
+ * the Azure cloud warden loads as config — the Azure counterpart of
+ * `AwsGovernanceConfig`/`GcpGovernanceConfig`. Cycles map onto the
+ * governance verbs (#790): the management-group/subscription tree is
+ * `org-unit`, policy assignments are `policy-guardrail`, the activity-log
+ * sink is `audit-sink`.
+ */
+export interface AzureGovernanceConfig {
+    tenant: {
+        /** Policy names assigned at the tenant root management group. */
+        policies?: string[];
+        /** Block subscriptions from leaving the tenant (Microsoft.Subscription/policies). */
+        blockSubscriptionsLeavingTenant?: boolean;
+    };
+    /** Top-level management groups under the tenant root, keyed by group id. */
+    managementGroups: Record<string, ManagementGroupConfig>;
+    /** Custom policy definitions, keyed by the names the tree assigns. */
+    policies: Record<string, PolicyConfig>;
+    /** Where audit evidence flows. */
+    auditSinks?: {
+        activityLog?: {
+            workspaceId: string;
+        };
+    };
+}
+export declare const DENY_CLASSIC_RESOURCES: PolicyConfig;
+export declare const DENY_UNMANAGED_DISKS: PolicyConfig;
+/** Allow resource creation only in `locations` ("global" is always excepted). */
+export declare function locationRestriction(locations: readonly string[]): PolicyConfig;
+/**
+ * The built-in DeployIfNotExists policy "Configure Azure Activity logs to
+ * stream to specified Log Analytics workspace" — the activity-log audit
+ * sink is wired by assigning it, not by declaring diagnostic settings in
+ * every subscription (Microsoft.Insights/diagnosticSettings is not in the
+ * generated surface, and the assignment covers future subscriptions too).
+ */
+export declare const ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID = "/providers/Microsoft.Authorization/policyDefinitions/2465583e-4e78-4c15-b6be-a36cbc7c8b0f";
+/**
+ * The recommended foundation management-group structure. Exported so
+ * callers can extend it rather than restate it.
+ */
+export declare const FOUNDATION_MANAGEMENT_GROUPS: Record<string, ManagementGroupConfig>;
+export interface LandingZoneConfigProps {
+    /**
+     * Start from the recommended foundation: Security / Infrastructure /
+     * Sandbox / Workloads management groups, `deny-classic-resources` and
+     * `deny-unmanaged-disks` assigned at the tenant root, and subscriptions
+     * blocked from leaving the tenant. Default true; your
+     * `managementGroups`/`policies` merge over it (same-name keys win).
+     */
+    foundation?: boolean;
+    /** Adds a root allowed-locations policy allowing only these locations. */
+    allowedLocations?: string[];
+    /** Management-group tree, merged over the foundation's. Greenfield (full tree) and brownfield (partial subtree) are both just this map. */
+    managementGroups?: Record<string, ManagementGroupConfig>;
+    /** Policy definitions, merged over the foundation's. */
+    policies?: Record<string, PolicyConfig>;
+    /** Extra policy names to assign at the tenant root management group. */
+    rootPolicies?: string[];
+    /** Declare the activity-log audit sink flowing into this Log Analytics workspace (resource id). */
+    activityLogWorkspaceId?: string;
+}
+/**
+ * Author the desired-state tree the Azure cloud warden reconciles. Pure.
+ * Throws when the tree assigns a policy name with no definition; only
+ * policies the tree actually assigns are included in the output.
+ */
+export declare function landingZoneConfig(props?: LandingZoneConfigProps): AzureGovernanceConfig;
+//# sourceMappingURL=governance.d.ts.map

package/dist/governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACrC;AAED,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE;QACN,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,qFAAqF;QACrF,+BAA+B,CAAC,EAAE,OAAO,CAAC;KAC3C,CAAC;IACF,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACxD,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,kCAAkC;IAClC,UAAU,CAAC,EAAE;QACX,WAAW,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;KACvC,CAAC;CACH;AAMD,eAAO,MAAM,sBAAsB,EAAE,YAQpC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,YA4BlC,CAAC;AAEF,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAe9E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2CAA2C,8FACqC,CAAC;AAE9F;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAK9E,CAAC;AAMF,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,2IAA2I;IAC3I,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxC,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mGAAmG;IACnG,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,sBAA2B,GAAG,qBAAqB,CA2C3F"}

package/dist/index.d.ts

@@ -4,17 +4,20 @@
  * Azure Resource Manager lexicon for chant.
  */
 export { defaultTags, type TagEntry, type DefaultTags } from "./default-tags.js";
+export { deploymentScope, isDeploymentScope, type DeploymentScope, type DeployScope } from "./deploy-scopes.js";
 export { azureSerializer } from "./serializer.js";
 export { azurePlugin } from "./plugin.js";
 export { Parameter } from "./parameter.js";
-export { observeResourcesDeepAzure, azureDeepNormalizationHooks, AZURE_READ_ONLY_NAMES, AZURE_SERVICE_DEFAULTS, } from "./deep-observe.js";
+export { observeResourcesDeepAzure, azureDeepNormalizationHooks, AZURE_READ_ONLY_NAMES, AZURE_SERVER_COMPUTED_NAMES, AZURE_SERVICE_DEFAULTS, } from "./deep-observe.js";
 export { ResourceId, ResourceIdIntrinsic, Reference, ReferenceIntrinsic, Concat, ConcatIntrinsic, ResourceGroup, ResourceGroupIntrinsic, Subscription, SubscriptionIntrinsic, UniqueString, UniqueStringIntrinsic, Format, FormatIntrinsic, If, IfIntrinsic, ListKeys, ListKeysIntrinsic, } from "./intrinsics.js";
 export { Azure, ResourceGroupName, ResourceGroupLocation, ResourceGroupId, SubscriptionId, TenantId, DeploymentName, } from "./pseudo.js";
 export { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
 export { stackOutput, isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
 export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon-output";
 export * from "./generated/index.js";
-export { StorageAccountSecure, type StorageAccountSecureProps, type StorageAccountSecureResult, VnetDefault, type VnetDefaultProps, type VnetDefaultResult, VmLinux, type VmLinuxProps, type VmLinuxResult, AppService, type AppServiceProps, type AppServiceResult, AksCluster, type AksClusterProps, type AksClusterResult, SqlDatabase, type SqlDatabaseProps, type SqlDatabaseResult, KeyVaultSecure, type KeyVaultSecureProps, type KeyVaultSecureResult, ContainerRegistrySecure, type ContainerRegistrySecureProps, type ContainerRegistrySecureResult, FunctionApp, type FunctionAppProps, type FunctionAppResult, ServiceBusPipeline, type ServiceBusPipelineProps, type ServiceBusPipelineResult, CosmosDatabase, type CosmosDatabaseProps, type CosmosDatabaseResult, ApplicationGateway, type ApplicationGatewayProps, type ApplicationGatewayResult, ContainerInstance, type ContainerInstanceProps, type ContainerInstanceResult, RedisCache, type RedisCacheProps, type RedisCacheResult, PrivateEndpoint, type PrivateEndpointProps, type PrivateEndpointResult, } from "./composites/index.js";
+export { StorageAccountSecure, type StorageAccountSecureProps, type StorageAccountSecureResult, VnetDefault, type VnetDefaultProps, type VnetDefaultResult, VmLinux, type VmLinuxProps, type VmLinuxResult, AppService, type AppServiceProps, type AppServiceResult, AksCluster, type AksClusterProps, type AksClusterResult, SqlDatabase, type SqlDatabaseProps, type SqlDatabaseResult, KeyVaultSecure, type KeyVaultSecureProps, type KeyVaultSecureResult, ContainerRegistrySecure, type ContainerRegistrySecureProps, type ContainerRegistrySecureResult, FunctionApp, type FunctionAppProps, type FunctionAppResult, ServiceBusPipeline, type ServiceBusPipelineProps, type ServiceBusPipelineResult, CosmosDatabase, type CosmosDatabaseProps, type CosmosDatabaseResult, ApplicationGateway, type ApplicationGatewayProps, type ApplicationGatewayResult, ContainerInstance, type ContainerInstanceProps, type ContainerInstanceResult, RedisCache, type RedisCacheProps, type RedisCacheResult, PrivateEndpoint, type PrivateEndpointProps, type PrivateEndpointResult, GovernanceFoundation, type GovernanceFoundationProps, type GovernanceFoundationResult, GovernanceBaseline, type GovernanceBaselineProps, type GovernanceBaselineResult, LocationRestriction, type LocationRestrictionProps, type LocationRestrictionResult, ActivityLogSink, type ActivityLogSinkProps, type ActivityLogSinkResult, } from "./composites/index.js";
+export { landingZoneConfig, locationRestriction, DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS, ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID, FOUNDATION_MANAGEMENT_GROUPS, } from "./governance.js";
+export type { AzureGovernanceConfig, LandingZoneConfigProps, ManagementGroupConfig, PolicyConfig, SubscriptionConfig, } from "./governance.js";
 export { StorageRoles, ComputeRoles, NetworkRoles, KeyVaultRoles, SqlRoles, ContainerRoles, AppServiceRoles, IdentityRoles, } from "./actions/index.js";
 export { generate, writeGeneratedFiles } from "./codegen/generate.js";
 export { packageLexicon } from "./codegen/package.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAIxC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,YAAY,EAAE,qBAAqB,EACnC,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,WAAW,EACf,QAAQ,EAAE,iBAAiB,GAC5B,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,KAAK,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,cAAc,GACf,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGzF,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EACL,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAC9C,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,uBAAuB,EAAE,KAAK,4BAA4B,EAAE,KAAK,6BAA6B,EAC9F,WAAW,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAC1D,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,cAAc,EAAE,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EACnE,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,uBAAuB,EAC5E,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EACvD,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,EACtE,oBAAoB,EAAE,KAAK,yBAAyB,EAAE,KAAK,0BAA0B,EACrF,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAC/E,mBAAmB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAClF,eAAe,EAAE,KAAK,oBAAoB,EAAE,KAAK,qBAAqB,GACvE,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,iBAAiB,EAAE,mBAAmB,EACtC,sBAAsB,EAAE,oBAAoB,EAC5C,2CAA2C,EAAE,4BAA4B,GAC1E,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,qBAAqB,EAAE,sBAAsB,EAC7C,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,GACxD,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "6dce4d5905c3d44221c8b07e2aaafd8e553915c03c8ccabe73ed8ded5b0ac06f",
-    "meta.json": "051fb4ee43f7de48a36f1abc59c8ff5207c3b75aa28f13db6440b9f5b0337605",
-    "types/index.d.ts": "617a6de433bd92a126170a7f5ae903d6d7aa83fbb0b57169d3450b5a13e72e0d",
+    "manifest.json": "f770263394af1084f4898fa1eab75808c183729510a0b6dc9b8a2dde440b10dd",
+    "meta.json": "760a8d2e359be71f29a990339cb075701fe668e6275dfa923b9d112474ba660a",
+    "types/index.d.ts": "c5a8a3e107b07a11ac992fa7d6d136fe1a71c99a89c57921b3e4bc86361adb3f",
     "rules/hardcoded-location.ts": "a9b1d1cec93f2ca9c5206641f53fc9621cefcfd2c00b3ab89c194b30a75fa949",
     "rules/nsg-wildcard.ts": "968ed06e741f16b8d44b02589b8fc4e13ee05a2ea7b6e71d490fb6aac8566066",
     "rules/storage-https.ts": "7800e6601e6cb1d61cd3e3e034168eed5f99cd977cc348226cdbda9cb4723f59",
@@ -28,10 +28,14 @@
     "rules/azr027.ts": "1a334c6184f9a7392a2ff7535b13ebf487e2e08eefd39bc9077c8278ce661f94",
     "rules/azr028.ts": "cbb0b780f62478b3cf26261e28a41f231f202d6bb8905c96b84a1e4080df9a1a",
     "rules/azr029.ts": "18e6cef437207239aa8c8f1b382e0f95661cb0bca0de83ca293f66f0db446ee0",
+    "rules/azr030.ts": "81ede36e17290b860d51d1a0d20769383f903c5cc84036168f1d74b9befe065e",
+    "rules/azr031.ts": "07e2fb24ebb5f006351a4417f877e3230600141e3091e12d1a346982e8678076",
+    "rules/azr032.ts": "cbf23c9b22aeb51a18c77ea410502f5fc0584870f723aa3c8e0b0a87fd7cce4b",
+    "rules/azr033.ts": "54c628f21b45f0de0639807baf025d8477a8b352326b3ff7d1f3f9f80db43506",
     "skills/chant-azure.md": "86399e4fafd35cdf56670b32dbff5db42a4bfa1453b25231c4ee15eea9a2a1b9",
     "skills/chant-azure-security.md": "95ab789202662f60b43cf2fce1ae549cbcf5b689306481dabb656847281879ff",
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "f1cbe9fdfe11df3dc1a8d430ae61327db102ab145cce7e99b9ededba8637accf"
+  "composite": "ef0be6524c75d7bdb8422478c3f72445f976bf855ce9b610638b2d35af5bd0f1"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAI1F,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAqBtD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAa,KAAK,QAAQ,EAAkB,MAAM,gCAAgC,CAAC;AAI1F,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA2BtD,CAAC"}

package/dist/lint/post-synth/azr030.d.ts

@@ -0,0 +1,14 @@
+/**
+ * AZR030: Resource deployed at an unsupported template scope
+ *
+ * Errors when a template contains a resource whose ARM schema does not
+ * define it at the template's deployment scope (#1545). The serializer
+ * picks the template $schema from the common scope of all resources; a
+ * template mixing, say, management groups (tenant-only) with virtual
+ * networks (resource-group-only) has no valid single-template scope —
+ * split the project so each scope deploys its own template (linked
+ * deployments cross scopes).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const azr030: PostSynthCheck;
+//# sourceMappingURL=azr030.d.ts.map

package/dist/lint/post-synth/azr030.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azr030.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/azr030.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAI9G,eAAO,MAAM,MAAM,EAAE,cAoCpB,CAAC"}

package/dist/lint/post-synth/azr031.d.ts

@@ -0,0 +1,10 @@
+/**
+ * AZR031: Policy Assignment Not Enforced (#793, epic #787 C3)
+ *
+ * Flags Microsoft.Authorization/policyAssignments with enforcementMode
+ * DoNotEnforce. The assignment stays visible in the tree while denying
+ * nothing — the Azure shape of a disabled guardrail.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const azr031: PostSynthCheck;
+//# sourceMappingURL=azr031.d.ts.map

package/dist/lint/post-synth/azr031.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azr031.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/azr031.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA6BpB,CAAC"}

package/dist/lint/post-synth/azr032.d.ts

@@ -0,0 +1,11 @@
+/**
+ * AZR032: Policy Definition Assigned Nowhere (#793, epic #787 C3)
+ *
+ * Flags custom Microsoft.Authorization/policyDefinitions with no
+ * policyAssignments referencing them in the same template. The
+ * GovernanceBaseline composite always pairs definition and assignment; a
+ * definition alone is the leftover of a dropped guardrail assignment.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const azr032: PostSynthCheck;
+//# sourceMappingURL=azr032.d.ts.map

package/dist/lint/post-synth/azr032.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azr032.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/azr032.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAiB9G,eAAO,MAAM,MAAM,EAAE,cAiCpB,CAAC"}

package/dist/lint/post-synth/azr033.d.ts

@@ -0,0 +1,10 @@
+/**
+ * AZR033: Subscriptions May Leave the Tenant (#793, epic #787 C3)
+ *
+ * Flags a Microsoft.Subscription/policies resource that sets
+ * blockSubscriptionsLeavingTenant to false — the tenant-level leave-block
+ * the landing-zone foundation declares, explicitly weakened.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const azr033: PostSynthCheck;
+//# sourceMappingURL=azr033.d.ts.map

package/dist/lint/post-synth/azr033.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azr033.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/azr033.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAG9G,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAsBvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAqB3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA0BvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAyB3C,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.41.20",
+  "version": "0.44.1",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [