@intentius/chant-lexicon-azure 0.44.14 → 0.46.0

package/src/serializer.ts

@@ -18,6 +18,9 @@ import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership";
 import type { LexiconOutput } from "@intentius/chant/lexicon-output";
 import { walkValue, type SerializerVisitor } from "@intentius/chant/serializer-walker";
 import { isChildProject, type ChildProjectInstance } from "@intentius/chant/child-project";
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
 import { isStackOutput, type StackOutput } from "@intentius/chant/stack-output";
 import { isAttrRefLike } from "@intentius/chant/utils";
 import { resolveDependsOn } from "@intentius/chant/resource-attributes";
@@ -74,42 +77,48 @@ const RESOURCE_LEVEL_FIELDS = new Set([
 
 /**
  * Load apiVersion for a resource type from the lexicon registry.
+ *
+ * Reads the generated registry (src/generated/lexicon-azure.json in a dev
+ * checkout, dist/meta.json in the installed package). Resolves the package
+ * directory from import.meta.url so it works under pure ESM as well as
+ * tsx/vitest — the old `require()`-based resolver threw under ESM and the
+ * throw was swallowed, so every resource emitted the fallback apiVersion
+ * (#1581). A missing registry is now an error: a uniform fallback apiVersion
+ * silently bypasses the per-provider pins in spec/api-versions.ts.
  */
 function resolveDir(): string {
-  const { dirname } = require("path");
-  // Bun / ESM
-  try {
-    const { fileURLToPath } = require("url");
-    return dirname(fileURLToPath(import.meta.url));
-  } catch {}
-  // CJS / tsx fallback
-  if (typeof __dirname !== "undefined") return __dirname;
-  return dirname(require.resolve("./serializer"));
+  return dirname(fileURLToPath(import.meta.url));
+}
+
+export function apiVersionRegistryCandidates(dir: string = resolveDir()): string[] {
+  return [
+    join(dir, "generated", "lexicon-azure.json"),
+    join(dir, "..", "dist", "meta.json"),
+  ];
 }
 
-function loadApiVersions(): Map<string, string> {
+export function loadApiVersions(candidates: string[] = apiVersionRegistryCandidates()): Map<string, string> {
   const map = new Map<string, string>();
-  try {
-    const { readFileSync } = require("fs");
-    const { join } = require("path");
-    const dir = resolveDir();
-    // Try generated/ (dev) first, then dist/meta.json (installed package)
-    let content: string | undefined;
-    for (const candidate of [
-      join(dir, "generated", "lexicon-azure.json"),
-      join(dir, "..", "dist", "meta.json"),
-    ]) {
-      try { content = readFileSync(candidate, "utf-8"); break; } catch {}
-    }
-    if (!content) return map;
-    const data = JSON.parse(content) as Record<string, { resourceType: string; apiVersion?: string }>;
-    for (const entry of Object.values(data)) {
-      if (entry.apiVersion && entry.resourceType) {
-        map.set(entry.resourceType, entry.apiVersion);
-      }
+  let content: string | undefined;
+  for (const candidate of candidates) {
+    if (!existsSync(candidate)) continue;
+    content = readFileSync(candidate, "utf-8");
+    break;
+  }
+  if (content === undefined) {
+    throw new Error(
+      `azure: apiVersion registry not found (tried ${candidates.join(", ")}). ` +
+        "Run `npm run generate` (dev) or reinstall the package (dist/meta.json).",
+    );
+  }
+  const data = JSON.parse(content) as Record<string, { resourceType: string; apiVersion?: string }>;
+  for (const entry of Object.values(data)) {
+    if (entry.apiVersion && entry.resourceType) {
+      map.set(entry.resourceType, entry.apiVersion);
     }
-  } catch {
-    // Lexicon not available
+  }
+  if (map.size === 0) {
+    throw new Error("azure: apiVersion registry is empty — regenerate with `npm run generate`");
   }
   return map;
 }
@@ -126,11 +135,39 @@ const API_VERSION_OVERRIDES = new Map<string, string>([
 
 let _apiVersions: Map<string, string> | undefined;
 
-function getApiVersion(resourceType: string): string {
+/** Test hook: drop the cached registry so the next lookup reloads it. */
+export function resetApiVersionCache(): void {
+  _apiVersions = undefined;
+}
+
+/**
+ * Registry lookup without the serializer's fallback: the pinned apiVersion for
+ * `resourceType`, or `undefined` when neither the overrides nor the generated
+ * registry know the type. ARM resource types are case-insensitive and the live
+ * listing does not always echo the casing the registry uses, so the match is
+ * case-insensitive too. Used by prune (#1472), which needs an apiVersion for a
+ * type the current template no longer declares.
+ */
+export function lookupApiVersion(resourceType: string): string | undefined {
   const override = API_VERSION_OVERRIDES.get(resourceType);
   if (override) return override;
   if (!_apiVersions) _apiVersions = loadApiVersions();
-  return _apiVersions.get(resourceType) ?? "2023-01-01";
+  const exact = _apiVersions.get(resourceType);
+  if (exact) return exact;
+  const wanted = resourceType.toLowerCase();
+  for (const [type, version] of _apiVersions) {
+    if (type.toLowerCase() === wanted) return version;
+  }
+  return undefined;
+}
+
+export function getApiVersion(resourceType: string): string {
+  const version = lookupApiVersion(resourceType);
+  if (version) return version;
+  console.warn(
+    `azure: no pinned apiVersion for ${resourceType} in the lexicon registry; falling back to 2023-01-01`,
+  );
+  return "2023-01-01";
 }
 
 /**

package/src/spec/api-versions.test.ts

@@ -82,6 +82,22 @@ describe("PROVIDER_VERSION_OVERRIDES", () => {
     ]);
   });
 
+  it("keeps both pinned Microsoft.AzureStackHCI files, newest first (#1795)", () => {
+    // 2026-05-01-preview is the naive "latest by date" but carries only the
+    // cluster/edge family; the VM family lives in 2026-04-01-preview. The pin
+    // keeps both, in pin order, and drops the unpinned dates.
+    const paths = [
+      "schemas/2026-04-01-preview/Microsoft.AzureStackHCI.json",
+      "schemas/2026-04-30/Microsoft.AzureStackHCI.json",
+      "schemas/2026-05-01-preview/Microsoft.AzureStackHCI.json",
+    ];
+    const result = latestVersionPerProvider(paths);
+    expect(result.get("Microsoft.AzureStackHCI")?.map((f) => f.apiVersion)).toEqual([
+      "2026-05-01-preview",
+      "2026-04-01-preview",
+    ]);
+  });
+
   it("pins Microsoft.Management and Microsoft.Subscription to their latest GA dates (#1545)", () => {
     const paths = [
       "schemas/2023-04-01/Microsoft.Management.json",

package/src/spec/api-versions.ts

@@ -76,6 +76,18 @@ export function parseSchemaPath(
  * no GA date and whose newer preview files (2024-12-01-preview and later)
  * drag in policy variables we don't want yet.
  *
+ * Microsoft.AzureStackHCI splits the same way (#1795): the newest dated file
+ * (2026-05-01-preview) carries only the cluster/edge-device family, while the
+ * VM family (virtualMachineInstances, virtualNetworks, networkInterfaces,
+ * publicIPAddresses, galleryImages, virtualHardDisks, ...) last appears in
+ * 2026-04-01-preview. Pin both, newest first — the cluster/edge family
+ * generates from 2026-05-01-preview and the VM family fills in from
+ * 2026-04-01-preview. `Microsoft.DataReplication/replicationVaults_
+ * privateEndpointConnectionProxies` dropped out in the same re-baseline but
+ * is NOT pinnable back: no dated Microsoft.DataReplication.json at the
+ * AZURE_SCHEMA_COMMIT pin (2021-02-16-preview, 2024-09-01, 2026-05-01)
+ * defines it — upstream removed the resource, so it stays gone.
+ *
  * Microsoft.Management and Microsoft.Subscription are pinned to their latest
  * GA dates: the naive latest for both is a preview (2024-02-01-preview adds
  * serviceGroups; 2025-11-01-preview adds changeTenantRequest), and the
@@ -83,6 +95,7 @@ export function parseSchemaPath(
  */
 export const PROVIDER_VERSION_OVERRIDES: Record<string, readonly string[]> = {
   "Microsoft.Authorization": ["2022-04-01", "2026-06-01", "2022-07-01-preview"],
+  "Microsoft.AzureStackHCI": ["2026-05-01-preview", "2026-04-01-preview"],
   "Microsoft.Compute": ["2026-03-01"],
   "Microsoft.Management": ["2023-04-01"],
   "Microsoft.Subscription": ["2021-10-01"],

package/src/validate.ts

@@ -44,6 +44,12 @@ export async function validate(opts?: { basePath?: string }): Promise<ValidateRe
     // after bounding (#438), so match required names by substring.
     requiredNamesMatchSubstring: true,
     basePath,
+    // chant #1475 — azure generates from a commit sha of
+    // azure-resource-manager-schemas (#1144), so a fresh generate is
+    // deterministic. Gate the surface on every validate: the #1144 pin left
+    // the snapshot 483 entries behind until #1572 re-baselined it, because
+    // nothing compared the two on a PR.
+    checkSurfaceSnapshot: "always",
     coverageThresholds: {
       minPropertyPct: 1,
       minLifecyclePct: 1,