@intentius/chant-lexicon-azure 0.44.13 → 0.45.0

package/dist/codegen/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwFH;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAM9E"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../../src/codegen/docs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwEH;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAM9E"}

package/dist/deploy-scopes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-scopes.d.ts","sourceRoot":"","sources":["../src/deploy-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEjF,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAE1F,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,eAA4C,CAAC;AAEjF;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;IACzC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAQnE;AAED,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAKxD,CAAC;AAeF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA2B7D;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,EAAE,CAEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,WAAW,CAiBjF;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,WAAW,CAOnE"}
+{"version":3,"file":"deploy-scopes.d.ts","sourceRoot":"","sources":["../src/deploy-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEjF,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,cAAc,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAE1F,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,eAA4C,CAAC;AAEjF;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC;IACzC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,eAAe,CAQnE;AAED,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAKxD,CAAC;AA4BF;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA4B7D;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,EAAE,CAEnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,WAAW,CAiBjF;AAED,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,WAAW,CAOnE"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "83a42695ec14e03ab09f53ef897b440d7359528f3345719a7a0a07518b1a1c5e",
+    "manifest.json": "4609a8f5c9124e4231b979bb8d752c0e30548aee93dab288629af7cc575d4ac3",
     "meta.json": "760a8d2e359be71f29a990339cb075701fe668e6275dfa923b9d112474ba660a",
     "types/index.d.ts": "c5a8a3e107b07a11ac992fa7d6d136fe1a71c99a89c57921b3e4bc86361adb3f",
     "rules/hardcoded-location.ts": "a9b1d1cec93f2ca9c5206641f53fc9621cefcfd2c00b3ab89c194b30a75fa949",
@@ -37,5 +37,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "b16712818a44b98bd58d668194942e80ede194ef7315289ffb57c50d74318a33"
+  "composite": "b01efebfbcfbced31dbbb52f7f3ae3b656ba2a0ff41be474bbe9c27aad9961bf"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.44.13",
+  "version": "0.45.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/op/activities/az-apply.d.ts

@@ -177,37 +177,51 @@ export interface AzNotPrunable {
     type: string;
     name: string;
     /**
-     * `no-api-version` — the resource is owned and undeclared, but its type is
-     * absent from the current template, which is the only place an `apiVersion`
-     * comes from. `deleteArmResource` cannot build a URL without one.
+     * `no-api-version` — the resource is owned and undeclared, but no apiVersion
+     * could be found for its type: the current template does not declare the
+     * type, the lexicon's pinned registry has no entry for it, and ARM's
+     * provider metadata listed no apiVersion for it (or the call failed).
+     * `deleteArmResource` cannot build a URL without one.
      */
     reason: "no-api-version";
 }
 /**
- * Owned-only prune: for each resource type present in the template, delete the
- * chant-owned live resources of that type whose (evaluated) name is not in the
- * template. Foreign (non-chant) resources are never touched.
+ * Resolve an apiVersion for a live resource type from ARM's provider metadata:
+ * `GET /subscriptions/{sub}/providers/{namespace}?api-version=2021-04-01`
+ * returns `resourceTypes[].apiVersions[]`. Picks the newest stable version,
+ * falling back to the newest preview when no stable one exists. One call per
+ * namespace per prune run; the result is memoised in `cache` so a group with
+ * many orphans of one provider costs one round trip. Returns `undefined` when
+ * the endpoint is unavailable (floci-az does not implement it) or the type is
+ * not listed.
+ */
+export declare function providerApiVersion(resourceType: string, ctx: ArmEvalCtx, http?: AzHttp, signal?: AbortSignal, cache?: Map<string, Map<string, string>>): Promise<string | undefined>;
+/**
+ * Owned-only prune: delete every chant-owned live resource in the group whose
+ * (evaluated) name is not declared in the template. Foreign (non-chant)
+ * resources are never touched.
+ *
+ * ## Where the apiVersion comes from (#1457, #1472)
  *
- * ## The type-left-the-template hole (#1457)
+ * `deleteArmResource` needs an `apiVersion`, and ARM's resource-group listing
+ * does not return one per resource. The template is the obvious source, but it
+ * only covers types it still declares: declare one storage account, apply,
+ * delete it from source, and the template has zero resources of that type.
+ * Keying the delete scope off the template alone made the last resource of a
+ * type a permanent orphan (#1457 made that a reported skip rather than a
+ * silent one).
  *
- * `byType` is keyed off the resources the template CURRENTLY declares, and the
- * `!entry` guard skipped any live resource of a type the template no longer
- * mentions — before `isChantOwned` was ever consulted.
+ * So the apiVersion is resolved in order:
  *
- * So: declare one storage account, apply, then delete it from source. The
- * template now has zero resources of that type, `byType` has no entry, and the
- * live account is skipped. It is owned, it is undeclared, and prune would never
- * touch it — on that run or any future one. **Prune the last resource of a type
- * and you created a permanent orphan.** Prune one of several and it works,
- * which is why it survived testing.
+ * 1. the template, when it still declares the type;
+ * 2. the lexicon's pinned per-provider registry (`lookupApiVersion`, the same
+ *    registry the serializer stamps into the template) — deterministic, no
+ *    extra call, covers every type the lexicon can emit;
+ * 3. ARM's provider metadata (`providerApiVersion`) — covers a type the
+ *    lexicon has never heard of, at one extra call per namespace per run.
  *
- * The guard cannot simply be removed: `deleteArmResource` needs an
- * `apiVersion`, and the template is the only source of one — ARM's
- * resource-group listing does not return it per resource. So the skip stays,
- * and is now REPORTED rather than silent: a permanent invisible orphan becomes
- * a permanent visible one, which is the difference between a bug and a known
- * limitation. Resolving it properly wants a per-type apiVersion source (the
- * provider metadata endpoint, or a lexicon-side map).
+ * Only when all three come up empty is the resource reported as
+ * `notPrunable: no-api-version`.
  *
  * This matters more since #1448, which routed `ApplyOp`'s `arm` target through
  * `azApply` — before that, the composite reached `--mode Complete` and never

package/dist/op/activities/az-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAMhC,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc/C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED,4EAA4E;AAC5E,wBAAsB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAgID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAenF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAqBzE;AAID,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ9G;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE;qDACiD;IACjD,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CAgDD;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGrF;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,MAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASlI;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAM3D;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;CAC/B,GAAG,WAAW,CAqBd;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CA+BD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAsB/E"}
+{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAMhC,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc/C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED,4EAA4E;AAC5E,wBAAsB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAgID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAenF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAqBzE;AAID,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ9G;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE;qDACiD;IACjD,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CAgDD;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGrF;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,MAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASlI;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAM3D;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;CAC/B,GAAG,WAAW,CAqBd;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAKD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,KAAK,GAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAa,GAClD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CA8CD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAsB/E"}

package/dist/op/activities/index.d.ts

@@ -7,6 +7,6 @@ export { azGroupEnsure, azGroupDelete, azGroupEnsureCommand, azGroupDeleteComman
 export type { AzGroupEnsureArgs, AzGroupDeleteArgs } from "./azure.js";
 export { flociAzUp, flociAzDown, flociAzRunCommand, flociAzRmCommand, flociAzExistsCommand, flociAzHealthUrl, flociAzEndpoint, } from "./floci-az.js";
 export type { FlociAzUpArgs, FlociAzDownArgs } from "./floci-az.js";
-export { azApply, azDelete, pruneArmOrphans, toApplyResult, deleteArmResource, listGroupResources, chantOwnershipTags, isChantOwned, evalArm, evalArmString, armResourceUrl, armResourceBody, armDependencies, orderArmResources, } from "./az-apply.js";
+export { azApply, azDelete, pruneArmOrphans, providerApiVersion, toApplyResult, deleteArmResource, listGroupResources, chantOwnershipTags, isChantOwned, evalArm, evalArmString, armResourceUrl, armResourceBody, armDependencies, orderArmResources, } from "./az-apply.js";
 export type { AzApplyArgs, ArmEvalCtx, ArmResource, ArmListItem, AzHttp } from "./az-apply.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAIpE,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EACL,OAAO,EACP,QAAQ,EACR,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAIpE,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EACL,OAAO,EACP,QAAQ,EACR,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC"}

package/dist/serializer.d.ts

@@ -10,6 +10,20 @@
  * - parameters, outputs sections
  */
 import type { Serializer } from "@intentius/chant/serializer";
+export declare function apiVersionRegistryCandidates(dir?: string): string[];
+export declare function loadApiVersions(candidates?: string[]): Map<string, string>;
+/** Test hook: drop the cached registry so the next lookup reloads it. */
+export declare function resetApiVersionCache(): void;
+/**
+ * Registry lookup without the serializer's fallback: the pinned apiVersion for
+ * `resourceType`, or `undefined` when neither the overrides nor the generated
+ * registry know the type. ARM resource types are case-insensitive and the live
+ * listing does not always echo the casing the registry uses, so the match is
+ * case-insensitive too. Used by prune (#1472), which needs an apiVersion for a
+ * type the current template no longer declares.
+ */
+export declare function lookupApiVersion(resourceType: string): string | undefined;
+export declare function getApiVersion(resourceType: string): string;
 /**
  * Azure ARM template serializer implementation.
  */

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AAkblG;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA0C7B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAsC,MAAM,6BAA6B,CAAC;AA8ElG,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,MAAqB,GAAG,MAAM,EAAE,CAKjF;AAED,wBAAgB,eAAe,CAAC,UAAU,GAAE,MAAM,EAAmC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB1G;AAcD,yEAAyE;AACzE,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWzE;AAED,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAO1D;AA2TD;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,UA0C7B,CAAC"}

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAGlG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AA2BvF,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAgBpF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAGlG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AA2BvF,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAsBpF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.44.13",
+  "version": "0.45.0",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,7 +74,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.44.13",
+    "@intentius/chant": "^0.45.0",
     "typescript": "^5.9.3"
   }
 }

package/src/codegen/docs.ts

@@ -75,22 +75,6 @@ const docsConfig: DocsConfig = {
   // `lint-rules` below is the rules documentation; the generated `rules` table
   // would duplicate it and land in no sidebar (#1312). aws, k8s, gitlab and
   // github already suppress it for the same reason.
-  // These pages are hand-written files under docs/src/content/docs/. The
-  // pipeline preserves pages it did not emit, but Starlight has no
-  // auto-discovery, so without an entry here they are reachable only by URL —
-  // which is what had happened to all ten of them.
-  sidebarExtra: [
-    { label: "Getting Started", slug: "getting-started" },
-    { label: "Resources", slug: "resources" },
-    { label: "Parameters & Outputs", slug: "parameters-outputs" },
-    { label: "Composites", slug: "composites" },
-    { label: "Linked Templates", slug: "linked-templates" },
-    { label: "Lint Rules", slug: "lint-rules" },
-    { label: "Importing ARM Templates", slug: "importing" },
-    { label: "Deploying to AKS", slug: "aks-kubernetes" },
-    { label: "Examples", slug: "examples" },
-    { label: "AI Skills", slug: "skills" },
-  ],
 };
 
 /**

package/src/deploy-scopes.ts

@@ -85,7 +85,20 @@ interface LexiconEntry {
 
 let _cached: Map<string, DeployScope[]> | undefined;
 
-const __dirname_ = dirname(fileURLToPath(import.meta.url));
+/**
+ * Directory of this module, resolved lazily. On workerd `import.meta.url`
+ * is undefined and `fileURLToPath` throws, so this must never run at module
+ * scope (#1621): the post-synth barrel imports this file and a module-scope
+ * throw kills the worker at startup. Returns undefined when unresolvable;
+ * callers then take the documented resource-group-only fallback.
+ */
+function moduleDir(): string | undefined {
+  try {
+    return dirname(fileURLToPath(import.meta.url));
+  } catch {
+    return undefined;
+  }
+}
 
 /**
  * Load per-resource deployment scopes from the lexicon JSON.
@@ -98,11 +111,12 @@ export function loadDeployScopes(): Map<string, DeployScope[]> {
   const map = new Map<string, DeployScope[]>();
   try {
     let content: string | undefined;
+    const dir = moduleDir();
     // Try generated/ (dev) first, then dist/meta.json (installed package)
-    for (const candidate of [
-      join(__dirname_, "generated", "lexicon-azure.json"),
-      join(__dirname_, "..", "dist", "meta.json"),
-    ]) {
+    for (const candidate of dir ? [
+      join(dir, "generated", "lexicon-azure.json"),
+      join(dir, "..", "dist", "meta.json"),
+    ] : []) {
       try { content = readFileSync(candidate, "utf-8"); break; } catch {}
     }
     if (content) {

package/src/op/activities/az-apply.test.ts

@@ -19,7 +19,9 @@ import {
   type ArmEvalCtx,
   type ArmResource,
   type AzHttp,
+  providerApiVersion,
 } from "./az-apply";
+import { lookupApiVersion } from "../../serializer";
 
 const noHttp: AzHttp = async () => ({ status: 200, text: "{}" });
 
@@ -278,7 +280,7 @@ describe("pruneArmOrphans (#azure-prune)", () => {
         { id: "/1", name: "keep1", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "chant" } }, // in template → keep
         { id: "/2", name: "orphan1", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "chant" } }, // owned, not in template → prune
         { id: "/3", name: "foreign", type: "Microsoft.Storage/storageAccounts", tags: {} }, // not owned → skip
-        { id: "/4", name: "othertype", type: "Microsoft.Web/sites", tags: { "managed-by": "chant" } }, // type not templated → skip
+        { id: "/4", name: "othertype", type: "Microsoft.Web/sites", tags: { "managed-by": "chant" } }, // type not templated → registry apiVersion
       ],
     };
     const deletes: string[] = [];
@@ -287,15 +289,16 @@ describe("pruneArmOrphans (#azure-prune)", () => {
       return { status: 200, text: method === "GET" ? JSON.stringify(live) : "" };
     };
     const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
-    expect(pruned).toEqual([{ type: "Microsoft.Storage/storageAccounts", name: "orphan1", deleted: true }]);
-    expect(deletes).toHaveLength(1);
-    expect(deletes[0]).toContain("/storageAccounts/orphan1?api-version=2023-01-01"); // apiVersion from the template
-    // #1457: "othertype" is chant-owned and undeclared, and its TYPE is absent
-    // from the template — so there is no apiVersion to delete it with. It used
-    // to be dropped by the `!entry` guard in silence; now it is reported.
-    expect(notPrunable).toEqual([
-      { type: "Microsoft.Web/sites", name: "othertype", reason: "no-api-version" },
+    expect(pruned).toEqual([
+      { type: "Microsoft.Storage/storageAccounts", name: "orphan1", deleted: true },
+      { type: "Microsoft.Web/sites", name: "othertype", deleted: true },
     ]);
+    expect(deletes).toHaveLength(2);
+    expect(deletes[0]).toContain("/storageAccounts/orphan1?api-version=2023-01-01"); // apiVersion from the template
+    // #1472: "othertype" is chant-owned and undeclared, and its TYPE is absent
+    // from the template — the apiVersion comes from the lexicon registry instead.
+    expect(deletes[1]).toContain(`/sites/othertype?api-version=${lookupApiVersion("Microsoft.Web/sites")}`);
+    expect(notPrunable).toEqual([]);
   });
 
   // #1448 routes ApplyOp's `arm` target here, so this is now the delete scope for
@@ -412,7 +415,7 @@ describe("azDelete (#azure-prune)", () => {
  * unreachable by prune forever. Prune one of SEVERAL and it works, which is why
  * this survived testing.
  */
-describe("pruneArmOrphans: a type that left the template (#1457)", () => {
+describe("pruneArmOrphans: a type that left the template (#1457, #1472)", () => {
   const ctx = (): ArmEvalCtx => ({
     subscriptionId: "sub",
     resourceGroup: "rg",
@@ -422,30 +425,193 @@ describe("pruneArmOrphans: a type that left the template (#1457)", () => {
     base: "http://x",
   });
 
-  const liveHttp = (value: unknown[], deletes: string[]): AzHttp => async (method, url) => {
-    if (method === "DELETE") deletes.push(url);
-    return { status: 200, text: method === "GET" ? JSON.stringify({ value }) : "" };
-  };
+  // Only the resource-group listing answers; the provider-metadata endpoint
+  // 404s, the way floci-az does.
+  const liveHttp = (value: unknown[], deletes: string[], providers: string[] = []): AzHttp =>
+    async (method, url) => {
+      if (method === "DELETE") deletes.push(url);
+      if (method === "GET" && url.includes("/resources?")) return { status: 200, text: JSON.stringify({ value }) };
+      if (method === "GET" && url.includes("/providers/")) {
+        providers.push(url);
+        return { status: 404, text: "" };
+      }
+      return { status: 200, text: "" };
+    };
 
-  test("an owned orphan whose type is gone is reported, not silently skipped", async () => {
+  test("an owned orphan whose type is gone is deleted with the registry apiVersion", async () => {
     // The template now declares a DIFFERENT type entirely — the storage account
-    // was the last of its kind and has been removed from source.
+    // was the last of its kind and has been removed from source. #1457 only
+    // reported this; the registry the serializer pins from now supplies the
+    // apiVersion, so the orphan is actually deleted.
     const desired: ArmResource[] = [
       { type: "Microsoft.Web/sites", apiVersion: "2022-03-01", name: "site" },
     ];
     const deletes: string[] = [];
+    const providers: string[] = [];
     const http = liveHttp(
       [{ id: "/1", name: "leftover", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "chant" } }],
       deletes,
+      providers,
     );
     const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
-    expect(pruned).toEqual([]);
-    expect(notPrunable).toEqual([
-      { type: "Microsoft.Storage/storageAccounts", name: "leftover", reason: "no-api-version" },
+    expect(pruned).toEqual([{ type: "Microsoft.Storage/storageAccounts", name: "leftover", deleted: true }]);
+    expect(notPrunable).toEqual([]);
+    const registryVersion = lookupApiVersion("Microsoft.Storage/storageAccounts");
+    expect(registryVersion).toBeDefined();
+    expect(deletes).toEqual([
+      `http://x/subscriptions/sub/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/leftover?api-version=${registryVersion}`,
+    ]);
+    // The registry answered, so ARM's provider metadata was never consulted.
+    expect(providers).toEqual([]);
+  });
+
+  test("the live listing's type casing need not match the registry's", async () => {
+    const desired: ArmResource[] = [];
+    const deletes: string[] = [];
+    const http = liveHttp(
+      [{ id: "/1", name: "leftover", type: "microsoft.storage/storageaccounts", tags: { "managed-by": "chant" } }],
+      deletes,
+    );
+    const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
+    expect(pruned).toEqual([{ type: "microsoft.storage/storageaccounts", name: "leftover", deleted: true }]);
+    expect(notPrunable).toEqual([]);
+    expect(deletes[0]).toContain(`?api-version=${lookupApiVersion("Microsoft.Storage/storageAccounts")}`);
+  });
+
+  test("a type the registry does not know falls back to ARM provider metadata, newest stable", async () => {
+    const desired: ArmResource[] = [];
+    const deletes: string[] = [];
+    const gets: string[] = [];
+    const http: AzHttp = async (method, url) => {
+      if (method === "DELETE") deletes.push(url);
+      if (method === "GET") gets.push(url);
+      if (method === "GET" && url.includes("/resources?")) {
+        return {
+          status: 200,
+          text: JSON.stringify({
+            value: [
+              { id: "/1", name: "a", type: "Microsoft.Example/widgets", tags: { "managed-by": "chant" } },
+              { id: "/2", name: "b", type: "Microsoft.Example/widgets", tags: { "managed-by": "chant" } },
+            ],
+          }),
+        };
+      }
+      if (method === "GET" && url.includes("/providers/Microsoft.Example?")) {
+        return {
+          status: 200,
+          text: JSON.stringify({
+            namespace: "Microsoft.Example",
+            resourceTypes: [
+              { resourceType: "widgets", apiVersions: ["2024-05-01-preview", "2023-09-01", "2024-01-01", "2022-01-01"] },
+              { resourceType: "gadgets", apiVersions: ["2020-01-01"] },
+            ],
+          }),
+        };
+      }
+      return { status: 200, text: "" };
+    };
+    const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
+    expect(pruned).toEqual([
+      { type: "Microsoft.Example/widgets", name: "a", deleted: true },
+      { type: "Microsoft.Example/widgets", name: "b", deleted: true },
     ]);
-    // Still not deleted — the apiVersion genuinely is not available. The fix is
-    // that it is now visible rather than that it is now deleted.
+    expect(notPrunable).toEqual([]);
+    // Newest STABLE wins over the newer preview.
+    expect(deletes).toEqual([
+      "http://x/subscriptions/sub/resourceGroups/rg/providers/Microsoft.Example/widgets/a?api-version=2024-01-01",
+      "http://x/subscriptions/sub/resourceGroups/rg/providers/Microsoft.Example/widgets/b?api-version=2024-01-01",
+    ]);
+    // One provider-metadata call per namespace per run, not per orphan.
+    expect(gets.filter((u) => u.includes("/providers/Microsoft.Example?api-version=2021-04-01"))).toHaveLength(1);
+    expect(gets.find((u) => u.includes("/providers/Microsoft.Example?"))).toBe(
+      "http://x/subscriptions/sub/providers/Microsoft.Example?api-version=2021-04-01",
+    );
+  });
+
+  test("no template, no registry entry, no provider metadata → still reported, never deleted", async () => {
+    const desired: ArmResource[] = [];
+    const deletes: string[] = [];
+    const providers: string[] = [];
+    const http = liveHttp(
+      [{ id: "/1", name: "mystery", type: "Microsoft.Nowhere/things", tags: { "managed-by": "chant" } }],
+      deletes,
+      providers,
+    );
+    const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
+    expect(pruned).toEqual([]);
+    expect(notPrunable).toEqual([{ type: "Microsoft.Nowhere/things", name: "mystery", reason: "no-api-version" }]);
     expect(deletes).toEqual([]);
+    // All three sources were tried; the last one is the provider endpoint.
+    expect(providers).toEqual(["http://x/subscriptions/sub/providers/Microsoft.Nowhere?api-version=2021-04-01"]);
+  });
+
+  test("providerApiVersion: preview-only types, missing types, and failed calls", async () => {
+    const cache = new Map<string, Map<string, string>>();
+    let calls = 0;
+    const http: AzHttp = async () => {
+      calls++;
+      return {
+        status: 200,
+        text: JSON.stringify({
+          resourceTypes: [{ resourceType: "previewOnly", apiVersions: ["2023-01-01-preview", "2024-01-01-preview"] }],
+        }),
+      };
+    };
+    expect(await providerApiVersion("Microsoft.P/previewOnly", ctx(), http, undefined, cache)).toBe("2024-01-01-preview");
+    expect(await providerApiVersion("Microsoft.P/absent", ctx(), http, undefined, cache)).toBeUndefined();
+    expect(calls).toBe(1);
+    expect(await providerApiVersion("notatype", ctx(), http)).toBeUndefined();
+    const failing: AzHttp = async () => { throw new Error("network"); };
+    expect(await providerApiVersion("Microsoft.P/previewOnly", ctx(), failing)).toBeUndefined();
+  });
+
+  test("azApply end to end: declare one storage account, apply, remove it, prune → deleted", async () => {
+    // The Floci-az style fake: PUT records the resource (with the ownership tag
+    // chant stamps), the group listing echoes what was recorded, DELETE removes
+    // it. The provider-metadata endpoint is absent, as on floci-az.
+    const store = new Map<string, { id: string; name: string; type: string; tags?: Record<string, string> }>();
+    const deletes: string[] = [];
+    const http: AzHttp = async (method, url, body) => {
+      const m = url.match(/\/providers\/([^/]+\/[^/]+)\/([^/?]+)\?api-version=([^&]+)$/);
+      if (method === "PUT" && m) {
+        const tags = (body as { tags?: Record<string, string> }).tags;
+        store.set(`${m[1]}/${m[2]}`, { id: `/${m[2]}`, name: m[2], type: m[1], tags });
+        return { status: 200, text: JSON.stringify({ properties: {} }) };
+      }
+      if (method === "DELETE" && m) {
+        deletes.push(url);
+        const had = store.delete(`${m[1]}/${m[2]}`);
+        return { status: had ? 200 : 404, text: "" };
+      }
+      if (method === "GET" && url.includes("/resources?")) {
+        return { status: 200, text: JSON.stringify({ value: [...store.values()] }) };
+      }
+      return { status: 404, text: "" };
+    };
+    const path = `/tmp/chant-1472-az-${process.pid}.json`;
+    const account = { type: "Microsoft.Storage/storageAccounts", apiVersion: "2023-01-01", name: "lastone" };
+    try {
+      writeFileSync(path, JSON.stringify({ resources: [account] }));
+      const first = await azApply({ templatePath: path, resourceGroup: "rg", endpoint: "http://x", prune: true }, undefined, http);
+      expect(first.applied).toEqual([{ type: account.type, name: "lastone" }]);
+      expect(store.size).toBe(1);
+
+      // Remove the only storage account from source: the template now declares
+      // no resource of that type at all.
+      writeFileSync(path, JSON.stringify({ resources: [] }));
+      const second = await azApply({ templatePath: path, resourceGroup: "rg", endpoint: "http://x", prune: true }, undefined, http);
+      expect(second.applied).toEqual([]);
+      expect(second.pruned).toEqual([{ type: account.type, name: "lastone", deleted: true }]);
+      expect(second.notPrunable).toEqual([]);
+      expect(store.size).toBe(0);
+      expect(deletes).toEqual([
+        `http://x/subscriptions/${"00000000-0000-0000-0000-000000000001"}/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/lastone?api-version=${lookupApiVersion(account.type)}`,
+      ]);
+      // Core's envelope agrees: nothing left over that could not be attempted.
+      expect(toApplyResult(second).notAttempted ?? []).toEqual([]);
+    } finally {
+      unlinkSync(path);
+    }
   });
 
   test("pruning one of several of a type still works — the case that hid this", async () => {

package/src/op/activities/az-apply.ts

@@ -3,6 +3,8 @@ import { createHash } from "node:crypto";
 import { safeHeartbeat } from "@intentius/chant/op";
 import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
 import { AZURE_TAG_OWNERSHIP_KEYS } from "../../ownership";
+import { lookupApiVersion } from "../../serializer";
+import { compareApiDates } from "../../spec/api-versions";
 import {
   applyResult,
   type ApplyResult,
@@ -501,38 +503,96 @@ export interface AzNotPrunable {
   type: string;
   name: string;
   /**
-   * `no-api-version` — the resource is owned and undeclared, but its type is
-   * absent from the current template, which is the only place an `apiVersion`
-   * comes from. `deleteArmResource` cannot build a URL without one.
+   * `no-api-version` — the resource is owned and undeclared, but no apiVersion
+   * could be found for its type: the current template does not declare the
+   * type, the lexicon's pinned registry has no entry for it, and ARM's
+   * provider metadata listed no apiVersion for it (or the call failed).
+   * `deleteArmResource` cannot build a URL without one.
    */
   reason: "no-api-version";
 }
 
+/** The ARM provider-metadata apiVersion (`GET /subscriptions/{sub}/providers/{ns}`). */
+const PROVIDER_METADATA_API_VERSION = "2021-04-01";
+
+/**
+ * Resolve an apiVersion for a live resource type from ARM's provider metadata:
+ * `GET /subscriptions/{sub}/providers/{namespace}?api-version=2021-04-01`
+ * returns `resourceTypes[].apiVersions[]`. Picks the newest stable version,
+ * falling back to the newest preview when no stable one exists. One call per
+ * namespace per prune run; the result is memoised in `cache` so a group with
+ * many orphans of one provider costs one round trip. Returns `undefined` when
+ * the endpoint is unavailable (floci-az does not implement it) or the type is
+ * not listed.
+ */
+export async function providerApiVersion(
+  resourceType: string,
+  ctx: ArmEvalCtx,
+  http: AzHttp = defaultHttp,
+  signal?: AbortSignal,
+  cache: Map<string, Map<string, string>> = new Map(),
+): Promise<string | undefined> {
+  const slash = resourceType.indexOf("/");
+  if (slash < 0) return undefined;
+  const namespace = resourceType.slice(0, slash);
+  const typeName = resourceType.slice(slash + 1).toLowerCase();
+  let byType = cache.get(namespace.toLowerCase());
+  if (!byType) {
+    byType = new Map();
+    cache.set(namespace.toLowerCase(), byType);
+    const url = `${ctx.base}/subscriptions/${ctx.subscriptionId}/providers/${namespace}?api-version=${PROVIDER_METADATA_API_VERSION}`;
+    let res: { status: number; text: string };
+    try {
+      res = await http("GET", url, undefined, signal);
+    } catch {
+      return undefined;
+    }
+    if (res.status >= 300) return undefined;
+    let parsed: { resourceTypes?: Array<{ resourceType?: string; apiVersions?: string[] }> };
+    try {
+      parsed = JSON.parse(res.text);
+    } catch {
+      return undefined;
+    }
+    for (const rt of parsed.resourceTypes ?? []) {
+      if (!rt?.resourceType || !Array.isArray(rt.apiVersions) || rt.apiVersions.length === 0) continue;
+      const versions = rt.apiVersions.filter((v): v is string => typeof v === "string");
+      const stable = versions.filter((v) => !v.endsWith("-preview"));
+      const pool = stable.length > 0 ? stable : versions;
+      if (pool.length === 0) continue;
+      const newest = pool.reduce((a, b) => (compareApiDates(b, a) > 0 ? b : a));
+      byType.set(rt.resourceType.toLowerCase(), newest);
+    }
+  }
+  return byType.get(typeName);
+}
+
 /**
- * Owned-only prune: for each resource type present in the template, delete the
- * chant-owned live resources of that type whose (evaluated) name is not in the
- * template. Foreign (non-chant) resources are never touched.
+ * Owned-only prune: delete every chant-owned live resource in the group whose
+ * (evaluated) name is not declared in the template. Foreign (non-chant)
+ * resources are never touched.
+ *
+ * ## Where the apiVersion comes from (#1457, #1472)
  *
- * ## The type-left-the-template hole (#1457)
+ * `deleteArmResource` needs an `apiVersion`, and ARM's resource-group listing
+ * does not return one per resource. The template is the obvious source, but it
+ * only covers types it still declares: declare one storage account, apply,
+ * delete it from source, and the template has zero resources of that type.
+ * Keying the delete scope off the template alone made the last resource of a
+ * type a permanent orphan (#1457 made that a reported skip rather than a
+ * silent one).
  *
- * `byType` is keyed off the resources the template CURRENTLY declares, and the
- * `!entry` guard skipped any live resource of a type the template no longer
- * mentions — before `isChantOwned` was ever consulted.
+ * So the apiVersion is resolved in order:
  *
- * So: declare one storage account, apply, then delete it from source. The
- * template now has zero resources of that type, `byType` has no entry, and the
- * live account is skipped. It is owned, it is undeclared, and prune would never
- * touch it — on that run or any future one. **Prune the last resource of a type
- * and you created a permanent orphan.** Prune one of several and it works,
- * which is why it survived testing.
+ * 1. the template, when it still declares the type;
+ * 2. the lexicon's pinned per-provider registry (`lookupApiVersion`, the same
+ *    registry the serializer stamps into the template) — deterministic, no
+ *    extra call, covers every type the lexicon can emit;
+ * 3. ARM's provider metadata (`providerApiVersion`) — covers a type the
+ *    lexicon has never heard of, at one extra call per namespace per run.
  *
- * The guard cannot simply be removed: `deleteArmResource` needs an
- * `apiVersion`, and the template is the only source of one — ARM's
- * resource-group listing does not return it per resource. So the skip stays,
- * and is now REPORTED rather than silent: a permanent invisible orphan becomes
- * a permanent visible one, which is the difference between a bug and a known
- * limitation. Resolving it properly wants a per-type apiVersion source (the
- * provider metadata endpoint, or a lexicon-side map).
+ * Only when all three come up empty is the resource reported as
+ * `notPrunable: no-api-version`.
  *
  * This matters more since #1448, which routed `ApplyOp`'s `arm` target through
  * `azApply` — before that, the composite reached `--mode Complete` and never
@@ -555,24 +615,39 @@ export async function pruneArmOrphans(
     byType.set(r.type, entry);
   }
 
+  const providerCache = new Map<string, Map<string, string>>();
+  const resolveApiVersion = async (type: string): Promise<string | undefined> => {
+    const fromTemplate = byType.get(type)?.apiVersion;
+    if (fromTemplate) return fromTemplate;
+    let fromRegistry: string | undefined;
+    try {
+      fromRegistry = lookupApiVersion(type);
+    } catch {
+      // A missing registry is the serializer's problem to report; prune still
+      // has the provider metadata to fall back on.
+    }
+    if (fromRegistry) return fromRegistry;
+    return providerApiVersion(type, ctx, http, signal, providerCache);
+  };
+
   const pruned: Array<{ type: string; name: string; deleted: boolean }> = [];
   const notPrunable: AzNotPrunable[] = [];
   for (const item of await listGroupResources(ctx, http, signal)) {
     // Ownership first, so a foreign resource never reaches the report either —
     // it is not an orphan chant failed to prune, it is simply not chant's.
     if (!isChantOwned(item.tags)) continue;
-    const entry = byType.get(item.type);
-    if (!entry) {
+    if (byType.get(item.type)?.keep.has(item.name)) continue;
+    const apiVersion = await resolveApiVersion(item.type);
+    if (!apiVersion) {
       console.log(
-        `prune: ${item.type}/${item.name} is chant-owned and undeclared, but its type is absent ` +
-          `from the template so no apiVersion is available — not deleted`,
+        `prune: ${item.type}/${item.name} is chant-owned and undeclared, but no apiVersion is ` +
+          `available for its type (not in the template, the lexicon registry, or ARM provider metadata) — not deleted`,
       );
       notPrunable.push({ type: item.type, name: item.name, reason: "no-api-version" });
       continue;
     }
-    if (entry.keep.has(item.name)) continue;
     safeHeartbeat({ step: "azPrune", type: item.type, name: item.name });
-    const result = await deleteArmResource(item.type, item.name, entry.apiVersion, ctx, http, signal);
+    const result = await deleteArmResource(item.type, item.name, apiVersion, ctx, http, signal);
     console.log(`pruned: ${item.type}/${item.name} (${ctx.base})`);
     pruned.push(result);
   }

package/src/op/activities/index.ts

@@ -23,6 +23,7 @@ export {
   azApply,
   azDelete,
   pruneArmOrphans,
+  providerApiVersion,
   toApplyResult,
   deleteArmResource,
   listGroupResources,

package/src/serializer-api-versions.test.ts

@@ -0,0 +1,94 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+import { execFileSync } from "child_process";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import {
+  azureSerializer,
+  apiVersionRegistryCandidates,
+  getApiVersion,
+  loadApiVersions,
+  resetApiVersionCache,
+} from "./serializer";
+import { PROVIDER_VERSION_OVERRIDES } from "./spec/api-versions";
+
+function makeEntity(entityType: string, props: Record<string, unknown> = {}): any {
+  return { [DECLARABLE_MARKER]: true, lexicon: "azure", entityType, kind: "resource", props };
+}
+
+// This file runs as ESM (package.json "type": "module"), so `require` is not
+// defined in module scope — the path #1581 broke.
+describe("apiVersion registry under ESM (#1581)", () => {
+  afterEach(() => resetApiVersionCache());
+
+  it("resolves pinned versions in a real ESM process (no require shim)", () => {
+    // vitest defines a module-scope `require`, which hid #1581. Run the
+    // serializer under plain tsx ESM, where `require` is undefined.
+    const here = dirname(fileURLToPath(import.meta.url));
+    const script = [
+      `import { azureSerializer } from ${JSON.stringify(join(here, "serializer.ts"))};`,
+      `import { DECLARABLE_MARKER } from "@intentius/chant/declarable";`,
+      `const entities = new Map();`,
+      `entities.set("vm", { [DECLARABLE_MARKER]: true, lexicon: "azure", entityType: "Microsoft.Compute/virtualMachines", kind: "resource", props: { name: "vm", location: "eastus" } });`,
+      `const t = JSON.parse(azureSerializer.serialize(entities));`,
+      `console.log(JSON.stringify({ req: typeof require, apiVersion: t.resources[0].apiVersion }));`,
+    ].join("\n");
+    const dir = mkdtempSync(join(tmpdir(), "azure-esm-"));
+    try {
+      const file = join(dir, "probe.mts");
+      writeFileSync(file, script);
+      const out = execFileSync("npx", ["tsx", file], { cwd: here, encoding: "utf-8", timeout: 120_000 });
+      const { req, apiVersion } = JSON.parse(out.trim().split("\n").pop()!);
+      expect(req).toBe("undefined");
+      expect(PROVIDER_VERSION_OVERRIDES["Microsoft.Compute"]).toContain(apiVersion);
+      expect(apiVersion).not.toBe("2023-01-01");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("loads the registry via import.meta.url and uses pinned versions", () => {
+    const versions = loadApiVersions();
+    expect(versions.size).toBeGreaterThan(100);
+
+    // The pinned Microsoft.Compute version (spec/api-versions.ts) must reach
+    // the serializer, not the uniform 2023-01-01 fallback.
+    const computePins = PROVIDER_VERSION_OVERRIDES["Microsoft.Compute"];
+    expect(computePins?.length).toBeGreaterThan(0);
+    expect(computePins).toContain(versions.get("Microsoft.Compute/virtualMachines"));
+
+    const entities = new Map<string, any>();
+    entities.set("vm", makeEntity("Microsoft.Compute/virtualMachines", { name: "vm", location: "eastus" }));
+    entities.set("sa", makeEntity("Microsoft.Storage/storageAccounts", { name: "sa", location: "eastus" }));
+    const template = JSON.parse(azureSerializer.serialize(entities) as string);
+    const byType = Object.fromEntries(template.resources.map((r: any) => [r.type, r.apiVersion]));
+    expect(computePins).toContain(byType["Microsoft.Compute/virtualMachines"]);
+    expect(byType["Microsoft.Storage/storageAccounts"]).toBe(versions.get("Microsoft.Storage/storageAccounts"));
+    expect(byType["Microsoft.Storage/storageAccounts"]).not.toBe("2023-01-01");
+  });
+
+  it("throws loudly when no registry can be found", () => {
+    const dir = mkdtempSync(join(tmpdir(), "azure-apiv-"));
+    try {
+      expect(() => loadApiVersions(apiVersionRegistryCandidates(dir))).toThrow(/apiVersion registry not found/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("throws on an empty registry rather than falling back uniformly", () => {
+    const dir = mkdtempSync(join(tmpdir(), "azure-apiv-"));
+    try {
+      writeFileSync(join(dir, "meta.json"), "{}");
+      expect(() => loadApiVersions([join(dir, "meta.json")])).toThrow(/registry is empty/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps explicit overrides ahead of the registry", () => {
+    expect(getApiVersion("Microsoft.Authorization/roleAssignments")).toBe("2022-04-01");
+  });
+});

package/src/serializer.ts

@@ -18,6 +18,9 @@ import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
 import { isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
 import { isAttrRefLike } from "@intentius/chant/utils";
 import { resolveDependsOn } from "@intentius/chant/resource-attributes";
@@ -74,42 +77,48 @@ const RESOURCE_LEVEL_FIELDS = new Set([
 
 /**
  * Load apiVersion for a resource type from the lexicon registry.
+ *
+ * Reads the generated registry (src/generated/lexicon-azure.json in a dev
+ * checkout, dist/meta.json in the installed package). Resolves the package
+ * directory from import.meta.url so it works under pure ESM as well as
+ * tsx/vitest — the old `require()`-based resolver threw under ESM and the
+ * throw was swallowed, so every resource emitted the fallback apiVersion
+ * (#1581). A missing registry is now an error: a uniform fallback apiVersion
+ * silently bypasses the per-provider pins in spec/api-versions.ts.
  */
 function resolveDir(): string {
-  const { dirname } = require("path");
-  // Bun / ESM
-  try {
-    const { fileURLToPath } = require("url");
-    return dirname(fileURLToPath(import.meta.url));
-  } catch {}
-  // CJS / tsx fallback
-  if (typeof __dirname !== "undefined") return __dirname;
-  return dirname(require.resolve("./serializer"));
+  return dirname(fileURLToPath(import.meta.url));
+}
+
+export function apiVersionRegistryCandidates(dir: string = resolveDir()): string[] {
+  return [
+    join(dir, "generated", "lexicon-azure.json"),
+    join(dir, "..", "dist", "meta.json"),
+  ];
 }
 
-function loadApiVersions(): Map<string, string> {
+export function loadApiVersions(candidates: string[] = apiVersionRegistryCandidates()): Map<string, string> {
   const map = new Map<string, string>();
-  try {
-    const { readFileSync } = require("fs");
-    const { join } = require("path");
-    const dir = resolveDir();
-    // Try generated/ (dev) first, then dist/meta.json (installed package)
-    let content: string | undefined;
-    for (const candidate of [
-      join(dir, "generated", "lexicon-azure.json"),
-      join(dir, "..", "dist", "meta.json"),
-    ]) {
-      try { content = readFileSync(candidate, "utf-8"); break; } catch {}
-    }
-    if (!content) return map;
-    const data = JSON.parse(content) as Record<string, { resourceType: string; apiVersion?: string }>;
-    for (const entry of Object.values(data)) {
-      if (entry.apiVersion && entry.resourceType) {
-        map.set(entry.resourceType, entry.apiVersion);
-      }
+  let content: string | undefined;
+  for (const candidate of candidates) {
+    if (!existsSync(candidate)) continue;
+    content = readFileSync(candidate, "utf-8");
+    break;
+  }
+  if (content === undefined) {
+    throw new Error(
+      `azure: apiVersion registry not found (tried ${candidates.join(", ")}). ` +
+        "Run `npm run generate` (dev) or reinstall the package (dist/meta.json).",
+    );
+  }
+  const data = JSON.parse(content) as Record<string, { resourceType: string; apiVersion?: string }>;
+  for (const entry of Object.values(data)) {
+    if (entry.apiVersion && entry.resourceType) {
+      map.set(entry.resourceType, entry.apiVersion);
     }
-  } catch {
-    // Lexicon not available
+  }
+  if (map.size === 0) {
+    throw new Error("azure: apiVersion registry is empty — regenerate with `npm run generate`");
   }
   return map;
 }
@@ -126,11 +135,39 @@ const API_VERSION_OVERRIDES = new Map<string, string>([
 
 let _apiVersions: Map<string, string> | undefined;
 
-function getApiVersion(resourceType: string): string {
+/** Test hook: drop the cached registry so the next lookup reloads it. */
+export function resetApiVersionCache(): void {
+  _apiVersions = undefined;
+}
+
+/**
+ * Registry lookup without the serializer's fallback: the pinned apiVersion for
+ * `resourceType`, or `undefined` when neither the overrides nor the generated
+ * registry know the type. ARM resource types are case-insensitive and the live
+ * listing does not always echo the casing the registry uses, so the match is
+ * case-insensitive too. Used by prune (#1472), which needs an apiVersion for a
+ * type the current template no longer declares.
+ */
+export function lookupApiVersion(resourceType: string): string | undefined {
   const override = API_VERSION_OVERRIDES.get(resourceType);
   if (override) return override;
   if (!_apiVersions) _apiVersions = loadApiVersions();
-  return _apiVersions.get(resourceType) ?? "2023-01-01";
+  const exact = _apiVersions.get(resourceType);
+  if (exact) return exact;
+  const wanted = resourceType.toLowerCase();
+  for (const [type, version] of _apiVersions) {
+    if (type.toLowerCase() === wanted) return version;
+  }
+  return undefined;
+}
+
+export function getApiVersion(resourceType: string): string {
+  const version = lookupApiVersion(resourceType);
+  if (version) return version;
+  console.warn(
+    `azure: no pinned apiVersion for ${resourceType} in the lexicon registry; falling back to 2023-01-01`,
+  );
+  return "2023-01-01";
 }
 
 /**

package/src/validate.ts

@@ -44,6 +44,12 @@ export async function validate(opts?: { basePath?: string }): Promise<ValidateRe
     // after bounding (#438), so match required names by substring.
     requiredNamesMatchSubstring: true,
     basePath,
+    // chant #1475 — azure generates from a commit sha of
+    // azure-resource-manager-schemas (#1144), so a fresh generate is
+    // deterministic. Gate the surface on every validate: the #1144 pin left
+    // the snapshot 483 entries behind until #1572 re-baselined it, because
+    // nothing compared the two on a PR.
+    checkSurfaceSnapshot: "always",
     coverageThresholds: {
       minPropertyPct: 1,
       minLifecyclePct: 1,