@intentius/chant-lexicon-azure 0.41.20 → 0.44.1

package/src/deep-observe.ts

@@ -50,7 +50,7 @@
 
 import { boundedConcurrently } from "@intentius/chant/observation";
 import { getResource, isNotFound, type AzureReadClientOptions } from "./api/read-client";
-import type { AzHttp } from "./op/activities/az-apply";
+import { LEGACY_OWNERSHIP_TAG_KEY, type AzHttp } from "./op/activities/az-apply";
 import type {
   DeepArrayElement,
   DeepNode,
@@ -60,7 +60,10 @@ import type {
   UnobservedEntity,
 } from "@intentius/chant/lexicon";
 import { deepObservation, normalizeDeepProperties } from "@intentius/chant/deep-observation";
+import { OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
 import { classifyArmFailure, isTopLevelType } from "./describe-resources";
+import { isBracketExpression } from "./lint/post-synth/arm-refs";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership";
 
 
 /** The full `az resource show -o json` shape this reader reads (a superset of the thin path's `AzResourceShowResponse`). */
@@ -86,10 +89,21 @@ interface ArmResourceShowResponse {
  * `properties`, plus every `properties.*` field spread onto that same top
  * level (see the module doc). `id`/`type`/`etag`/`systemData` are envelope
  * bookkeeping with no declared counterpart and are never read in at all.
+ *
+ * `queriedName` is the declared name the GET was addressed by. A child
+ * resource is declared as `vnet/subnet` while ARM answers with the leaf
+ * (`name: "subnet"`) — the same identity in two spellings, since the URL that
+ * returned 200 is the declared name. The leaf is folded back to the declared
+ * spelling; a name that is not the leaf of the query is kept as returned.
  */
-function buildLiveProperties(obj: ArmResourceShowResponse): Record<string, unknown> {
+function buildLiveProperties(obj: ArmResourceShowResponse, queriedName?: string): Record<string, unknown> {
   const out: Record<string, unknown> = {};
-  if (obj.name !== undefined) out.name = obj.name;
+  if (obj.name !== undefined) {
+    out.name =
+      queriedName !== undefined && queriedName !== obj.name && queriedName.endsWith(`/${obj.name}`)
+        ? queriedName
+        : obj.name;
+  }
   if (obj.location !== undefined) out.location = obj.location;
   if (obj.sku !== undefined) out.sku = obj.sku;
   if (obj.kind !== undefined) out.kind = obj.kind;
@@ -122,6 +136,10 @@ export const AZURE_READ_ONLY_NAMES: ReadonlySet<string> = new Set([
   "resourceGuid",
   "principalId",
   "tenantId",
+  // The resource's own envelope etag never reaches the tree (see the module
+  // doc), but ARM also stamps one on every *nested* child — each security rule,
+  // each subnet — and nobody declares those.
+  "etag",
 ]);
 
 /**
@@ -132,6 +150,22 @@ export const AZURE_READ_ONLY_NAMES: ReadonlySet<string> = new Set([
  */
 const AZURE_UNCONDITIONAL_PRUNE_NAMES: ReadonlySet<string> = new Set(["defaultSecurityRules"]);
 
+/**
+ * Server-computed surfaces ARM fills in on its own (#1214, the AKS row of the
+ * CC round-trip): a managed cluster always comes back with `fqdn`,
+ * `currentKubernetesVersion` and `nodeResourceGroup` whether or not the
+ * declaration said anything about them. Unlike `AZURE_READ_ONLY_NAMES` these
+ * are counterpart-gated rather than pruned outright: `nodeResourceGroup` IS
+ * declarable at create time, so a declared value is still compared — only the
+ * purely server-filled appearance is noise. Sparse and evidence-based, like
+ * `AZURE_SERVICE_DEFAULTS`.
+ */
+export const AZURE_SERVER_COMPUTED_NAMES: ReadonlySet<string> = new Set([
+  "currentKubernetesVersion",
+  "fqdn",
+  "nodeResourceGroup",
+]);
+
 /**
  * ARM service defaults, per type, as index-erased property paths. Subtracted
  * only where source never declared the property — cdk-real-drift's default
@@ -156,6 +190,30 @@ const AZURE_SET_ARRAY_NAMES: ReadonlySet<string> = new Set([
   "zones",
 ]);
 
+/**
+ * chant's own ownership marker, as tag paths (#1213 — the azure edition of
+ * AWS's #1301 correction). The serializer stamps `chant-stack`/`chant-env` from
+ * project config and `azApply` stamps the managed-by pair on every resource it
+ * PUTs, so a managed estate always carries them live while the declared
+ * *properties* the diff compares do not — chant reading its own signature back
+ * as drift. Counterpart-gated at the call site, so a source that declares one
+ * of these tags itself is still compared.
+ */
+const AZURE_OWNERSHIP_TAG_PATTERNS: ReadonlySet<string> = new Set([
+  `tags.${AZURE_TAG_OWNERSHIP_KEYS.stack}`,
+  `tags.${AZURE_TAG_OWNERSHIP_KEYS.env}`,
+]);
+
+/**
+ * The managed-by pair is gated on the value as well: both keys always carry
+ * `"chant"` when chant wrote them, so `managed-by: terraform` appearing out of
+ * band still surfaces as the drift it is.
+ */
+const AZURE_MANAGED_BY_TAG_PATTERNS: ReadonlySet<string> = new Set([
+  `tags.${AZURE_TAG_OWNERSHIP_KEYS.managedBy}`,
+  `tags.${LEGACY_OWNERSHIP_TAG_KEY}`,
+]);
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -202,11 +260,51 @@ export const azureDeepNormalizationHooks: DeepNormalizationHooks = {
     // tag at all is the default, not a finding.
     if (node.pattern === "tags" && isEmptyRecord(node.value)) return true;
 
+    // A live `location` nobody declared is the effective placement, not drift:
+    // a child resource (a subnet) has no location property of its own to
+    // declare, and every top-level resource that CAN take one is declared with
+    // one (or with `[resourceGroup().location]`, which is a declared
+    // counterpart). Resource-level only — `pattern` is the exact top-level
+    // path, so a nested `.location` inside a declared property is untouched.
+    if (node.pattern === "location") return true;
+
+    // A server-computed surface nobody declared is ARM doing its job, not
+    // drift (see the set's doc for why this is counterpart-gated).
+    if (AZURE_SERVER_COMPUTED_NAMES.has(name)) return true;
+
+    // chant's own ownership marker is not drift (see the sets' docs).
+    if (AZURE_OWNERSHIP_TAG_PATTERNS.has(node.pattern)) return true;
+    if (AZURE_MANAGED_BY_TAG_PATTERNS.has(node.pattern) && node.value === OWNERSHIP_MANAGED_BY_VALUE) return true;
+
+    // ARM stamps a self-`id` on every element of a nested child collection —
+    // each security rule, each inline subnet. Only the element's *own* id
+    // (`securityRules[].id`, directly on the element): a declared
+    // cross-reference like `virtualNetworkRules[].id` has a counterpart and is
+    // still compared, and object-valued references (`routeTable.id`) never
+    // match the array-element shape.
+    if (node.pattern.endsWith("[].id")) return true;
+
     const defaults = AZURE_SERVICE_DEFAULTS[node.entityType];
     if (!defaults || !Object.prototype.hasOwnProperty.call(defaults, node.pattern)) return false;
     return canonicalJson(defaults[node.pattern]) === canonicalJson(node.value);
   },
 
+  /**
+   * An ARM bracket-expression string (`"[resourceId(...)]"`) is an unevaluated
+   * reference: the applier resolves it at deploy time, so the live side holds
+   * the evaluated value and comparing the two is comparing a formula to its
+   * result. Collapsed to UNRESOLVED on the declared side only — a live payload
+   * cannot carry an unevaluated expression, and `[[`-escaped strings are ARM's
+   * own literal-`[` spelling, not expressions.
+   */
+  unresolved(node: DeepNode): boolean {
+    return (
+      node.side === "declared" &&
+      isBracketExpression(node.value) &&
+      !(node.value as string).startsWith("[[")
+    );
+  },
+
   /**
    * The key doubles as a path segment (`securityRules[#allow-ssh]`), so a
    * `name` field is the element's own identity where ARM gives one — which it
@@ -296,7 +394,7 @@ export async function observeResourcesDeepAzure(
       resources[entityName] = {
         type: entityType,
         physicalId: obj.id,
-        properties: normalizeDeepProperties(buildLiveProperties(obj), {
+        properties: normalizeDeepProperties(buildLiveProperties(obj, name), {
           entityType,
           side: "live",
           hooks: azureDeepNormalizationHooks,

package/src/deploy-scopes.ts

@@ -0,0 +1,166 @@
+/**
+ * ARM deployment-scope metadata (#1545).
+ *
+ * The generated lexicon records `deployScopes` for resources that exist
+ * somewhere other than plain resource-group scope (management groups,
+ * subscription aliases, policy definitions). This module loads that map and
+ * resolves which deployment scope a template targets, shared by the
+ * serializer (picks the template $schema) and AZR030 (flags resources
+ * emitted at a scope their schema does not define).
+ *
+ * Lazy-loaded and cached for the lifetime of the process.
+ */
+
+import { readFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+
+export type DeployScope = "resourceGroup" | "subscription" | "managementGroup" | "tenant";
+
+/** Marker symbol for deployment-scope pin identification. */
+export const DEPLOYMENT_SCOPE_MARKER = Symbol.for("chant.azure.deploymentScope");
+
+/**
+ * A deployment-scope pin — wraps a scope into a Declarable the serializer
+ * uses instead of inferring the scope from the resource set.
+ */
+export interface DeploymentScope extends Declarable {
+  readonly [DEPLOYMENT_SCOPE_MARKER]: true;
+  readonly [DECLARABLE_MARKER]: true;
+  readonly lexicon: "azure";
+  readonly entityType: "chant:azure:deploymentScope";
+  readonly scope: DeployScope;
+}
+
+/** Type guard for DeploymentScope. */
+export function isDeploymentScope(value: unknown): value is DeploymentScope {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    DEPLOYMENT_SCOPE_MARKER in value &&
+    (value as Record<symbol, unknown>)[DEPLOYMENT_SCOPE_MARKER] === true
+  );
+}
+
+/**
+ * Pin the project's deployment scope. Without a pin the serializer picks
+ * the scope every resource supports that is closest to a resource group,
+ * which cannot tell a management-group policy project from a subscription
+ * one — policy definitions and assignments deploy at both. One pin per
+ * project; AZR030 flags resources whose schema does not define the pinned
+ * scope.
+ *
+ * @example
+ * ```ts
+ * export const scope = deploymentScope("managementGroup");
+ * ```
+ */
+export function deploymentScope(scope: DeployScope): DeploymentScope {
+  return {
+    [DEPLOYMENT_SCOPE_MARKER]: true,
+    [DECLARABLE_MARKER]: true,
+    lexicon: "azure",
+    entityType: "chant:azure:deploymentScope",
+    scope,
+  };
+}
+
+/** Template $schema URL per deployment scope. */
+export const TEMPLATE_SCHEMAS: Record<DeployScope, string> = {
+  resourceGroup: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  subscription: "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
+  managementGroup: "https://schema.management.azure.com/schemas/2019-08-01/managementGroupDeploymentTemplate.json#",
+  tenant: "https://schema.management.azure.com/schemas/2019-08-01/tenantDeploymentTemplate.json#",
+};
+
+const RESOURCE_GROUP_ONLY: DeployScope[] = ["resourceGroup"];
+
+interface LexiconEntry {
+  kind: string;
+  resourceType: string;
+  deployScopes?: DeployScope[];
+  [key: string]: unknown;
+}
+
+let _cached: Map<string, DeployScope[]> | undefined;
+
+const __dirname_ = dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Load per-resource deployment scopes from the lexicon JSON.
+ * Only resources with a non-default scope set appear; everything else is
+ * plain resource-group scope. Result is cached after first call.
+ */
+export function loadDeployScopes(): Map<string, DeployScope[]> {
+  if (_cached) return _cached;
+
+  const map = new Map<string, DeployScope[]>();
+  try {
+    let content: string | undefined;
+    // Try generated/ (dev) first, then dist/meta.json (installed package)
+    for (const candidate of [
+      join(__dirname_, "generated", "lexicon-azure.json"),
+      join(__dirname_, "..", "dist", "meta.json"),
+    ]) {
+      try { content = readFileSync(candidate, "utf-8"); break; } catch {}
+    }
+    if (content) {
+      const data = JSON.parse(content) as Record<string, LexiconEntry>;
+      for (const entry of Object.values(data)) {
+        if (entry.kind === "resource" && entry.resourceType && entry.deployScopes?.length) {
+          map.set(entry.resourceType, entry.deployScopes);
+        }
+      }
+    }
+  } catch {
+    // Lexicon not available — every resource reads as resource-group scope
+  }
+
+  _cached = map;
+  return map;
+}
+
+/** Deployment scopes for one ARM resource type (defaults to resource group). */
+export function deployScopesFor(resourceType: string): DeployScope[] {
+  return loadDeployScopes().get(resourceType) ?? RESOURCE_GROUP_ONLY;
+}
+
+/**
+ * Resolve the deployment scope for a template containing the given resource
+ * types: the scopes every resource supports, intersected.
+ *
+ * Resource-group scope wins whenever the intersection allows it (the
+ * pre-#1545 behavior for every template that could already be emitted).
+ * Otherwise the scope closest to a resource group is chosen. An empty
+ * intersection has no valid single-template answer; resource-group scope is
+ * returned and AZR030 reports the resources that cannot deploy there.
+ */
+export function resolveTemplateScope(resourceTypes: Iterable<string>): DeployScope {
+  let candidates: Set<DeployScope> | undefined;
+  for (const type of resourceTypes) {
+    const scopes = deployScopesFor(type);
+    if (!candidates) {
+      candidates = new Set(scopes);
+    } else {
+      for (const scope of [...candidates]) {
+        if (!scopes.includes(scope)) candidates.delete(scope);
+      }
+    }
+  }
+  if (!candidates || candidates.size === 0) return "resourceGroup";
+  for (const scope of ["resourceGroup", "subscription", "managementGroup", "tenant"] as DeployScope[]) {
+    if (candidates.has(scope)) return scope;
+  }
+  return "resourceGroup";
+}
+
+/** Map a template $schema URL back to its deployment scope. */
+export function scopeForTemplateSchema(schema: unknown): DeployScope {
+  if (typeof schema === "string") {
+    if (schema.includes("subscriptionDeploymentTemplate")) return "subscription";
+    if (schema.includes("managementGroupDeploymentTemplate")) return "managementGroup";
+    if (schema.includes("tenantDeploymentTemplate")) return "tenant";
+  }
+  return "resourceGroup";
+}

package/src/export-resources.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, vi, beforeEach } from "vitest";
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
 
 // execMock returns either a {stdout,stderr} result or an Error. We deliver it
 // via the callback on a microtask — never as a rejected promise — so a failure
@@ -40,7 +40,10 @@ const liveTemplate = {
 };
 
 describe("azure exportResources I/O glue (#159 / #160)", () => {
-  beforeEach(() => execMock.mockReset());
+  beforeEach(() => {
+    execMock.mockReset();
+    delete process.env.AZURE_ENDPOINT_URL;
+  });
 
   test("runs `az group export` against the resource group and maps the body", async () => {
     execMock.mockReturnValue({ stdout: JSON.stringify(liveTemplate), stderr: "" });
@@ -88,3 +91,92 @@ describe("azure exportResources I/O glue (#159 / #160)", () => {
     expect(ir.resources.map((r) => r.logicalId)).toEqual(["mine"]);
   });
 });
+
+// ── The ARM transport (#1214) ────────────────────────────────────────────────
+// With AZURE_ENDPOINT_URL ambient (the emulator lane), export never shells the
+// CLI: it lists the group's resources and GETs each one over the applier's own
+// transport, then scrubs the server-managed surface back to the declared shape.
+
+const nsgBody = {
+  id: "/subscriptions/s/resourceGroups/local/providers/Microsoft.Network/networkSecurityGroups/cc-vnet-nsg",
+  name: "cc-vnet-nsg",
+  type: "Microsoft.Network/networkSecurityGroups",
+  location: "eastus",
+  etag: 'W/"abc"',
+  tags: { "chant-managed-by": "chant" },
+  properties: {
+    provisioningState: "Succeeded",
+    resourceGuid: "1111",
+    securityRules: [
+      {
+        name: "allow-ssh",
+        id: "/subscriptions/s/…/securityRules/allow-ssh",
+        properties: { provisioningState: "Succeeded", priority: 150, sourceAddressPrefix: "0.0.0.0/0" },
+      },
+    ],
+    defaultSecurityRules: [{ name: "AllowVnetInBound" }],
+  },
+};
+
+const subnetBody = {
+  id: "/subscriptions/s/resourceGroups/local/providers/Microsoft.Network/virtualNetworks/cc-vnet/subnets/subnet-1",
+  name: "cc-vnet/subnet-1",
+  type: "Microsoft.Network/virtualNetworks/subnets",
+  properties: {
+    provisioningState: "Succeeded",
+    addressPrefix: "10.0.1.0/24",
+    routeTable: { id: "/subscriptions/s/resourceGroups/local/providers/Microsoft.Network/routeTables/cc-vnet-rt" },
+  },
+};
+
+describe("azure exportResources over ARM (#1214)", () => {
+  const fetchMock = vi.fn();
+
+  beforeEach(() => {
+    execMock.mockReset();
+    fetchMock.mockReset();
+    process.env.AZURE_ENDPOINT_URL = "http://localhost:4577";
+    vi.stubGlobal("fetch", fetchMock);
+    fetchMock.mockImplementation((url: string) => {
+      const path = url.split("?")[0];
+      const body = path.endsWith("/resources")
+        ? { value: [{ id: nsgBody.id }, { id: subnetBody.id }] }
+        : path.endsWith(nsgBody.id)
+          ? nsgBody
+          : subnetBody;
+      return Promise.resolve({ status: 200, text: () => Promise.resolve(JSON.stringify(body)) });
+    });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    delete process.env.AZURE_ENDPOINT_URL;
+  });
+
+  test("lists the group, reads each resource whole, and never shells the CLI", async () => {
+    const ir = await exportResources({ environment: "local" });
+    expect(execMock).not.toHaveBeenCalled();
+    expect(fetchMock.mock.calls[0][0]).toContain("/resourceGroups/local/resources?api-version=");
+    expect(ir.resources.map((r) => r.logicalId)).toEqual(["cc-vnet-nsg", "cc-vnet/subnet-1"]);
+  });
+
+  test("scrubs the server-managed surface, keeps declared cross-references", async () => {
+    const ir = await exportResources({ environment: "local" });
+    const nsg = ir.resources[0].properties as Record<string, unknown>;
+    expect(nsg.provisioningState).toBeUndefined();
+    expect(nsg.resourceGuid).toBeUndefined();
+    expect(nsg.etag).toBeUndefined();
+    expect(nsg.defaultSecurityRules).toBeUndefined();
+    const rule = (nsg.securityRules as Record<string, unknown>[])[0];
+    expect(rule.id).toBeUndefined();
+    expect((rule.properties as Record<string, unknown>).provisioningState).toBeUndefined();
+    expect((rule.properties as Record<string, unknown>).priority).toBe(150);
+    const subnet = ir.resources[1].properties as Record<string, unknown>;
+    expect((subnet.routeTable as Record<string, unknown>).id).toContain("cc-vnet-rt");
+  });
+
+  test("owned filtering reads the ownership marker off the live tags", async () => {
+    const ir = await exportResources({ environment: "local", owned: true });
+    expect(ir.resources.map((r) => r.logicalId)).toEqual(["cc-vnet-nsg"]);
+  });
+});

package/src/export-resources.ts

@@ -3,23 +3,107 @@
  * so `chant import --from <azure-env>` regenerates Azure resources as chant
  * TypeScript.
  *
- * The environment argument is the Azure resource group. Export reads the live
- * ARM template with `az group export` and maps it to the import IR. All I/O
- * lives here; selector/ownership filtering and IR-building are pure in
- * `./import/live-export`.
+ * The environment argument is the Azure resource group. Two transports, same
+ * IR:
+ *
+ * - With `AZURE_ENDPOINT_URL` set (the emulator lane, and the var azure's own
+ *   observers already read on every live call), export rides the applier's ARM
+ *   transport (#1212's swap, extended to the cloud→code direction for #1214):
+ *   list the group's resources, GET each one whole, scrub the server-managed
+ *   surface back to the declared shape, and hand the result to the same
+ *   `ArmParser` the static-import path uses. Unsigned, exactly like `azApply`
+ *   — which is why this path is gated on the ambient var rather than replacing
+ *   the CLI: real ARM wants a bearer token.
+ * - Without it, the signed path: `az group export` via the Azure CLI,
+ *   unchanged.
+ *
+ * Selector/ownership filtering and IR-building are pure in
+ * `./import/live-export`; all I/O lives here.
  */
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 import type { ExportedTemplate, ResourceSelector } from "@intentius/chant/lexicon";
 import { parseExportedTemplate } from "./import/live-export";
+import { getResourceById, listResources, type ArmResourceBody } from "./api/read-client";
+import { AZURE_READ_ONLY_NAMES, AZURE_SERVER_COMPUTED_NAMES } from "./deep-observe";
 
 const execAsync = promisify(exec);
 
+/** Generic ARM api-version, same as the read client's — adequate for every top-level type chant declares. */
+const EXPORT_API_VERSION = "2021-04-01";
+
+/**
+ * Envelope bookkeeping ARM stamps on every body — never part of the declared
+ * shape at any depth. `id` is NOT here: a nested `routeTable.id` is a declared
+ * cross-reference; only an array element's self-`id` is scrubbed (below), the
+ * same two rules deep observation applies.
+ */
+const ENVELOPE_KEYS: ReadonlySet<string> = new Set(["etag", "systemData"]);
+
+/**
+ * Scrub a live ARM body back to the declared shape (the contract's default
+ * fidelity): server-populated names, server-computed surfaces, NSG default
+ * rules and nested envelope bookkeeping all drop; everything a user would
+ * have authored stays.
+ */
+function scrub(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map((el) => {
+      if (el !== null && typeof el === "object" && !Array.isArray(el)) {
+        const { id: _selfId, ...rest } = el as Record<string, unknown>;
+        return scrub(rest);
+      }
+      return scrub(el);
+    });
+  }
+  if (value !== null && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+      if (AZURE_READ_ONLY_NAMES.has(k) || AZURE_SERVER_COMPUTED_NAMES.has(k)) continue;
+      if (ENVELOPE_KEYS.has(k) || k === "defaultSecurityRules") continue;
+      out[k] = scrub(v);
+    }
+    return out;
+  }
+  return value;
+}
+
+/** One live body → one ARM-template resource, the shape `ArmParser` reads. */
+function toTemplateResource(body: ArmResourceBody, verbatim: boolean): Record<string, unknown> {
+  const { id: _id, type, name, ...rest } = body;
+  const content = verbatim ? rest : (scrub(rest) as Record<string, unknown>);
+  return { type, apiVersion: EXPORT_API_VERSION, name, ...content };
+}
+
+async function exportViaArm(
+  endpoint: string,
+  options: { environment: string; selector?: ResourceSelector; owned?: boolean; verbatim?: boolean },
+): Promise<ExportedTemplate> {
+  const client = { endpoint, resourceGroup: options.environment };
+  const listed = await listResources(client);
+  const resources: Record<string, unknown>[] = [];
+  for (const entry of listed) {
+    if (typeof entry.id !== "string") continue;
+    const body = await getResourceById(client, entry.id);
+    resources.push(toTemplateResource(body, options.verbatim === true));
+  }
+  const template = {
+    $schema: "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+    contentVersion: "1.0.0.0",
+    resources,
+  };
+  return parseExportedTemplate(JSON.stringify(template), options.selector, options.owned);
+}
+
 export async function exportResources(options: {
   environment: string;
   selector?: ResourceSelector;
   owned?: boolean;
+  verbatim?: boolean;
 }): Promise<ExportedTemplate> {
+  const endpoint = process.env.AZURE_ENDPOINT_URL;
+  if (endpoint) return exportViaArm(endpoint, options);
+
   const cmd = [
     "az", "group", "export",
     "--resource-group", options.environment,