@intentius/chant-lexicon-azure 0.41.20 → 0.44.1

package/dist/rules/azr030.ts

@@ -0,0 +1,53 @@
+/**
+ * AZR030: Resource deployed at an unsupported template scope
+ *
+ * Errors when a template contains a resource whose ARM schema does not
+ * define it at the template's deployment scope (#1545). The serializer
+ * picks the template $schema from the common scope of all resources; a
+ * template mixing, say, management groups (tenant-only) with virtual
+ * networks (resource-group-only) has no valid single-template scope —
+ * split the project so each scope deploys its own template (linked
+ * deployments cross scopes).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseArmTemplate } from "./arm-refs";
+import { deployScopesFor, scopeForTemplateSchema } from "../../deploy-scopes";
+
+export const azr030: PostSynthCheck = {
+  id: "AZR030",
+  description: "Resource deployed at an unsupported template scope — split scopes into separate templates",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [_lexicon, output] of ctx.outputs) {
+      const template = parseArmTemplate(output);
+      if (!template?.resources) continue;
+
+      const templateScope = scopeForTemplateSchema(
+        (template as Record<string, unknown>).$schema,
+      );
+
+      for (const resource of template.resources) {
+        if (typeof resource.type !== "string") continue;
+        const scopes = deployScopesFor(resource.type);
+        if (scopes.includes(templateScope)) continue;
+
+        const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+        diagnostics.push({
+          checkId: "AZR030",
+          severity: "error",
+          message:
+            `Resource "${resourceName}" (${resource.type}) deploys at ` +
+            `${scopes.join("/")} scope, but this template targets ${templateScope} scope — ` +
+            `move it to a project deployed at a scope its schema supports`,
+          entity: resourceName,
+          lexicon: "azure",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/azr031.ts

@@ -0,0 +1,41 @@
+/**
+ * AZR031: Policy Assignment Not Enforced (#793, epic #787 C3)
+ *
+ * Flags Microsoft.Authorization/policyAssignments with enforcementMode
+ * DoNotEnforce. The assignment stays visible in the tree while denying
+ * nothing — the Azure shape of a disabled guardrail.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseArmTemplate } from "./arm-refs";
+
+export const azr031: PostSynthCheck = {
+  id: "AZR031",
+  description: "Policy assignment has enforcementMode DoNotEnforce — the guardrail is disabled",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [_lexicon, output] of ctx.outputs) {
+      const template = parseArmTemplate(output);
+      if (!template?.resources) continue;
+
+      for (const resource of template.resources) {
+        if (resource.type !== "Microsoft.Authorization/policyAssignments") continue;
+        const mode = resource.properties?.enforcementMode;
+        if (mode !== "DoNotEnforce") continue;
+
+        const name = typeof resource.name === "string" ? resource.name : String(resource.name);
+        diagnostics.push({
+          checkId: "AZR031",
+          severity: "error",
+          message: `Policy assignment "${name}" has enforcementMode DoNotEnforce — the guardrail is assigned but enforces nothing`,
+          entity: name,
+          lexicon: "azure",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/azr032.ts

@@ -0,0 +1,60 @@
+/**
+ * AZR032: Policy Definition Assigned Nowhere (#793, epic #787 C3)
+ *
+ * Flags custom Microsoft.Authorization/policyDefinitions with no
+ * policyAssignments referencing them in the same template. The
+ * GovernanceBaseline composite always pairs definition and assignment; a
+ * definition alone is the leftover of a dropped guardrail assignment.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseArmTemplate } from "./arm-refs";
+
+/**
+ * True when a policyDefinitionId expression targets the definition name —
+ * either a quoted literal inside resourceId()/managementGroupResourceId()
+ * or the trailing segment of a literal resource id.
+ */
+function references(definitionName: string, policyDefinitionId: unknown): boolean {
+  if (typeof policyDefinitionId !== "string") return false;
+  return (
+    policyDefinitionId.includes(`'${definitionName}'`) ||
+    policyDefinitionId.endsWith(`/${definitionName}`) ||
+    policyDefinitionId === definitionName
+  );
+}
+
+export const azr032: PostSynthCheck = {
+  id: "AZR032",
+  description: "Custom policy definition assigned nowhere — a defined but unassigned guardrail enforces nothing",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [_lexicon, output] of ctx.outputs) {
+      const template = parseArmTemplate(output);
+      if (!template?.resources) continue;
+
+      const assignmentIds = template.resources
+        .filter((r) => r.type === "Microsoft.Authorization/policyAssignments")
+        .map((r) => r.properties?.policyDefinitionId);
+
+      for (const resource of template.resources) {
+        if (resource.type !== "Microsoft.Authorization/policyDefinitions") continue;
+        if (typeof resource.name !== "string") continue;
+        const name = resource.name;
+        if (assignmentIds.some((id) => references(name, id))) continue;
+
+        diagnostics.push({
+          checkId: "AZR032",
+          severity: "error",
+          message: `Policy definition "${name}" is assigned nowhere in this template — pair it with a policy assignment or the guardrail enforces nothing`,
+          entity: name,
+          lexicon: "azure",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/azr033.ts

@@ -0,0 +1,40 @@
+/**
+ * AZR033: Subscriptions May Leave the Tenant (#793, epic #787 C3)
+ *
+ * Flags a Microsoft.Subscription/policies resource that sets
+ * blockSubscriptionsLeavingTenant to false — the tenant-level leave-block
+ * the landing-zone foundation declares, explicitly weakened.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { parseArmTemplate } from "./arm-refs";
+
+export const azr033: PostSynthCheck = {
+  id: "AZR033",
+  description: "Tenant subscription policy does not block subscriptions from leaving",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [_lexicon, output] of ctx.outputs) {
+      const template = parseArmTemplate(output);
+      if (!template?.resources) continue;
+
+      for (const resource of template.resources) {
+        if (resource.type !== "Microsoft.Subscription/policies") continue;
+        if (resource.properties?.blockSubscriptionsLeavingTenant !== false) continue;
+
+        const name = typeof resource.name === "string" ? resource.name : String(resource.name);
+        diagnostics.push({
+          checkId: "AZR033",
+          severity: "error",
+          message: `Subscription tenant policy "${name}" sets blockSubscriptionsLeavingTenant: false — subscriptions can be moved out of the tenant`,
+          entity: name,
+          lexicon: "azure",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAsZlG;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA0C7B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAkblG;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA0C7B,CAAC"}

package/dist/spec/api-versions.d.ts

@@ -46,17 +46,36 @@ export declare function parseSchemaPath(path: string): {
  * (validate.ts's REQUIRED_NAMES and composites/vm-linux.ts depend on it);
  * it drops the disk-only resources (disks, diskAccesses, diskEncryptionSets,
  * snapshots), which nothing here currently references.
+ *
+ * A pin can list several versions (#1545): Azure publishes some providers as
+ * per-family deltas, so no single date carries every resource we need. The
+ * files merge in the order listed — the first file that defines a resource
+ * name wins, later files only contribute resources not yet seen.
+ * Microsoft.Authorization needs three: 2022-04-01 for roleAssignments /
+ * roleDefinitions (#223), 2026-06-01 (latest stable policy file) for
+ * policyAssignments / policyDefinitions / policySetDefinitions and their
+ * _versions children, and 2022-07-01-preview for policyExemptions, which has
+ * no GA date and whose newer preview files (2024-12-01-preview and later)
+ * drag in policy variables we don't want yet.
+ *
+ * Microsoft.Management and Microsoft.Subscription are pinned to their latest
+ * GA dates: the naive latest for both is a preview (2024-02-01-preview adds
+ * serviceGroups; 2025-11-01-preview adds changeTenantRequest), and the
+ * management-group hierarchy should not author against preview apiVersions.
  */
-export declare const PROVIDER_VERSION_OVERRIDES: Record<string, string>;
+export declare const PROVIDER_VERSION_OVERRIDES: Record<string, readonly string[]>;
 /**
- * Given a set of schema paths, return only the latest API version per provider,
- * with {@link PROVIDER_VERSION_OVERRIDES} pinning specific providers to a chosen
- * version (used where "latest" drops resources we depend on).
+ * Given a set of schema paths, return the schema files to generate from, per
+ * provider: the single latest API version, unless
+ * {@link PROVIDER_VERSION_OVERRIDES} pins the provider to one or more chosen
+ * versions (used where "latest" drops resources we depend on). For pinned
+ * providers the array preserves the pin order — callers merge the files
+ * first-wins per resource name.
  *
- * Returns a Map of provider → { path, apiVersion }.
+ * Returns a Map of provider → [{ path, apiVersion }, ...].
  */
-export declare function latestVersionPerProvider(paths: string[]): Map<string, {
+export declare function latestVersionPerProvider(paths: string[]): Map<string, Array<{
     path: string;
     apiVersion: string;
-}>;
+}>>;
 //# sourceMappingURL=api-versions.d.ts.map

package/dist/spec/api-versions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-versions.d.ts","sourceRoot":"","sources":["../../src/spec/api-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOjD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAG7D,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,GACd,GAAG,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBnD"}
+{"version":3,"file":"api-versions.d.ts","sourceRoot":"","sources":["../../src/spec/api-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAKxE,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EAAE,GACd,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA2B1D"}

package/dist/spec/fetch.d.ts

@@ -7,6 +7,11 @@
  */
 /**
  * Top-level ARM JSON Schema for a provider file.
+ *
+ * Besides the resource-group-scope `resourceDefinitions`, provider files
+ * carry parallel sections for the other deployment scopes. Org-hierarchy and
+ * policy resources (management groups, subscription aliases, policy
+ * definitions) exist ONLY in those sections (#1545).
  */
 export interface ArmProviderSchema {
     id?: string;
@@ -14,8 +19,13 @@ export interface ArmProviderSchema {
     title?: string;
     description?: string;
     resourceDefinitions?: Record<string, ArmResourceDefinition>;
+    subscription_resourceDefinitions?: Record<string, ArmResourceDefinition>;
+    managementGroup_resourceDefinitions?: Record<string, ArmResourceDefinition>;
+    tenant_resourceDefinitions?: Record<string, ArmResourceDefinition>;
     definitions?: Record<string, ArmSchemaDefinition>;
 }
+/** ARM deployment scopes a resource definition can target. */
+export type DeployScope = "resourceGroup" | "subscription" | "managementGroup" | "tenant";
 /**
  * A single resource definition within a provider schema.
  */
@@ -86,6 +96,16 @@ export interface ArmSchemaDefinition {
  * comment.
  */
 export declare const AZURE_SCHEMA_COMMIT = "0085cb6f3a98e735359807143bcb1667aeec930f";
+/**
+ * Explode one provider schema file into per-resource schema entries,
+ * writing into `out` keyed by resource type. Resource types already present
+ * in `out` are left untouched (first file wins across a multi-version pin).
+ *
+ * For providers in {@link SCOPED_SECTION_PROVIDERS} all deployment-scope
+ * sections are read; the definition comes from the highest-priority section
+ * that has it, and `deployScopes` unions every section that defines it.
+ */
+export declare function explodeProviderSchema(provider: string, apiVersion: string, providerSchema: ArmProviderSchema, out: Map<string, Buffer>): void;
 /**
  * Fetch ARM schemas and return a Map keyed by resource type
  * (e.g. "Microsoft.Storage/storageAccounts") to raw JSON bytes.

package/dist/spec/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/spec/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,mBAAmB,6CAA6C,CAAC;AAgC9E;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAkDjF;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/spec/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC5D,gCAAgC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzE,mCAAmC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC5E,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CACnD;AAED,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,mBAAmB,6CAA6C,CAAC;AAwD9E;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,iBAAiB,EACjC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GACvB,IAAI,CAuCN;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA4CjF;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}

package/dist/spec/parse.d.ts

@@ -11,6 +11,7 @@
  * - ARM schemas use oneOf wrappers with expression refs that must be unwrapped
  * - ARM schemas lack readOnlyProperties — attributes are curated
  */
+import type { DeployScope } from "./fetch.js";
 import { constraintsIsEmpty as coreConstraintsIsEmpty, type PropertyConstraints } from "@intentius/chant/codegen/json-schema";
 export type { PropertyConstraints } from "@intentius/chant/codegen/json-schema";
 export interface ParsedProperty {
@@ -45,6 +46,12 @@ export interface ParsedResource {
         tagOnCreate: boolean;
         tagUpdatable: boolean;
     };
+    /**
+     * ARM deployment scopes the schema defines this resource at (#1545).
+     * Absent means the resource came from `resourceDefinitions` only,
+     * i.e. plain resource-group scope.
+     */
+    deployScopes?: DeployScope[];
 }
 export interface ArmSchemaParseResult {
     resource: ParsedResource;

package/dist/spec/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAI9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AA+GD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,aAWrC,CAAC;AAEH;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,oBAAoB,CA+H1E;AA+CD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/spec/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAiE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAGL,kBAAkB,IAAI,sBAAsB,EAE5C,KAAK,mBAAmB,EAIzB,MAAM,sCAAsC,CAAC;AAI9C,YAAY,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAEhF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7E;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AA+GD;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,aAWrC,CAAC;AAEH;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,oBAAoB,CAwI1E;AA+CD,eAAO,MAAM,kBAAkB,+BAAyB,CAAC;AAMzD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvD"}