@intentius/chant-lexicon-azure 0.44.14 → 0.46.0

package/dist/validate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAGlG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AA2BvF,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAgBpF"}
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAGlG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AA2BvF,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAsBpF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.44.14",
+  "version": "0.46.0",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,7 +74,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.44.14",
+    "@intentius/chant": "^0.46.0",
     "typescript": "^5.9.3"
   }
 }

package/src/codegen/docs.ts

@@ -75,22 +75,6 @@ const docsConfig: DocsConfig = {
   // `lint-rules` below is the rules documentation; the generated `rules` table
   // would duplicate it and land in no sidebar (#1312). aws, k8s, gitlab and
   // github already suppress it for the same reason.
-  // These pages are hand-written files under docs/src/content/docs/. The
-  // pipeline preserves pages it did not emit, but Starlight has no
-  // auto-discovery, so without an entry here they are reachable only by URL —
-  // which is what had happened to all ten of them.
-  sidebarExtra: [
-    { label: "Getting Started", slug: "getting-started" },
-    { label: "Resources", slug: "resources" },
-    { label: "Parameters & Outputs", slug: "parameters-outputs" },
-    { label: "Composites", slug: "composites" },
-    { label: "Linked Templates", slug: "linked-templates" },
-    { label: "Lint Rules", slug: "lint-rules" },
-    { label: "Importing ARM Templates", slug: "importing" },
-    { label: "Deploying to AKS", slug: "aks-kubernetes" },
-    { label: "Examples", slug: "examples" },
-    { label: "AI Skills", slug: "skills" },
-  ],
 };
 
 /**

package/src/deploy-scopes.ts

@@ -85,7 +85,20 @@ interface LexiconEntry {
 
 let _cached: Map<string, DeployScope[]> | undefined;
 
-const __dirname_ = dirname(fileURLToPath(import.meta.url));
+/**
+ * Directory of this module, resolved lazily. On workerd `import.meta.url`
+ * is undefined and `fileURLToPath` throws, so this must never run at module
+ * scope (#1621): the post-synth barrel imports this file and a module-scope
+ * throw kills the worker at startup. Returns undefined when unresolvable;
+ * callers then take the documented resource-group-only fallback.
+ */
+function moduleDir(): string | undefined {
+  try {
+    return dirname(fileURLToPath(import.meta.url));
+  } catch {
+    return undefined;
+  }
+}
 
 /**
  * Load per-resource deployment scopes from the lexicon JSON.
@@ -98,11 +111,12 @@ export function loadDeployScopes(): Map<string, DeployScope[]> {
   const map = new Map<string, DeployScope[]>();
   try {
     let content: string | undefined;
+    const dir = moduleDir();
     // Try generated/ (dev) first, then dist/meta.json (installed package)
-    for (const candidate of [
-      join(__dirname_, "generated", "lexicon-azure.json"),
-      join(__dirname_, "..", "dist", "meta.json"),
-    ]) {
+    for (const candidate of dir ? [
+      join(dir, "generated", "lexicon-azure.json"),
+      join(dir, "..", "dist", "meta.json"),
+    ] : []) {
       try { content = readFileSync(candidate, "utf-8"); break; } catch {}
     }
     if (content) {

package/src/describe-resources.ts

@@ -27,6 +27,8 @@
 
 import type { ObservationResult, ResourceMetadata, UnobservedEntity, UnobservedReason } from "@intentius/chant/lexicon";
 import { boundedConcurrently, observation } from "@intentius/chant/observation";
+import { readOwnership } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "./ownership";
 import { AzureReadError, getResource, isNotFound, type AzureReadClientOptions } from "./api/read-client";
 import type { AzHttp } from "./op/activities/az-apply";
 
@@ -187,6 +189,12 @@ export async function describeResources(options: {
         type: entityType,
         physicalId: body.id,
         status: (body.properties?.provisioningState as string | undefined) ?? "PRESENT",
+        // Marker identity (#1222): the ARM envelope carries the resource's
+        // tags, so the stamped stack/env identity is readable here even though
+        // this path declares no ownership channel (the verdict stays out —
+        // floci-az drops tags, so a verdict here would misreport under the
+        // emulator; the identity, when the tags are present, is verbatim).
+        marker: readOwnership(body.tags, AZURE_TAG_OWNERSHIP_KEYS),
         attributes: pruneUndefined({
           location: body.location,
           tags: body.tags,