@intentius/chant-lexicon-azure 0.56.0 → 0.58.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/deep-observe.d.ts +1 -2
- package/dist/deep-observe.d.ts.map +1 -1
- package/dist/integrity.json +2 -2
- package/dist/lint/audit-catalog.d.ts.map +1 -1
- package/dist/lint/audit-lineage.d.ts +10 -0
- package/dist/lint/audit-lineage.d.ts.map +1 -0
- package/dist/manifest.json +1 -1
- package/dist/op/activities/az-apply.d.ts.map +1 -1
- package/dist/op/builders.d.ts +5 -3
- package/dist/op/builders.d.ts.map +1 -1
- package/package.json +2 -2
- package/src/deep-observe.test.ts +24 -9
- package/src/deep-observe.ts +1 -2
- package/src/index.ts +3 -3
- package/src/lint/audit-catalog.ts +5 -1
- package/src/lint/audit-lineage.ts +80 -0
- package/src/op/activities/az-apply.ts +0 -4
- package/src/op/builders.ts +5 -3
package/dist/deep-observe.d.ts
CHANGED
|
@@ -104,8 +104,7 @@ export interface AzureDeepObserveOptions {
|
|
|
104
104
|
* show`. One call per entity, same as the thin path — ARM has no bulk
|
|
105
105
|
* "describe everything in this group" call with per-resource depth the way
|
|
106
106
|
* CloudFormation's `describe-stack-resources` does, so there is no cheap
|
|
107
|
-
* list-then-describe split to make here the way AWS's
|
|
108
|
-
* do.
|
|
107
|
+
* list-then-describe split to make here the way AWS's own reader does.
|
|
109
108
|
*/
|
|
110
109
|
export declare function observeResourcesDeepAzure(options: AzureDeepObserveOptions): Promise<DeepObservationResult>;
|
|
111
110
|
//# sourceMappingURL=deep-observe.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AA+DlC;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CASpD,CAAC;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI1E,CAAC;AA+DF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAyEzC,CAAC;AAIF,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED
|
|
1
|
+
{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAIH,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,KAAK,EAGV,sBAAsB,EACtB,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AA+DlC;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CASpD,CAAC;AAUH;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,CAI1D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAI1E,CAAC;AA+DF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAyEzC,CAAC;AAIF,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,qBAAqB,CAAC,CAkEhC"}
|
package/dist/integrity.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"algorithm": "sha256",
|
|
3
3
|
"artifacts": {
|
|
4
|
-
"manifest.json": "
|
|
4
|
+
"manifest.json": "c3ab00dcfe166bc1723d9b48de21527aeb6fbc841d09d5719060f45894a1f146",
|
|
5
5
|
"meta.json": "8c7a1ea3cfaf39461d3e758fa2b0cbd70c7800fac736e56df8d14a3e07ef1840",
|
|
6
6
|
"types/index.d.ts": "16cb7dc2f9b4f82dc974935442f294d0c88077c0f21d21a92690b19227174b59",
|
|
7
7
|
"rules/hardcoded-location.ts": "a9b1d1cec93f2ca9c5206641f53fc9621cefcfd2c00b3ab89c194b30a75fa949",
|
|
@@ -37,5 +37,5 @@
|
|
|
37
37
|
"skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
|
|
38
38
|
"skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
|
|
39
39
|
},
|
|
40
|
-
"composite": "
|
|
40
|
+
"composite": "6410434f22424bce5a9cfcc3491f6d5976ad2b77e0d8c253ea749f6fd90c62fd"
|
|
41
41
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAa,KAAK,QAAQ,
|
|
1
|
+
{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAa,KAAK,QAAQ,EAAgC,MAAM,gCAAgC,CAAC;AAKxG,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA2BtD,CAAC"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Prior art for these audit rules: the open-source tools whose checks cover the
|
|
3
|
+
* same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
|
|
4
|
+
* the registry, the relation vocabulary, and why this is credit rather than
|
|
5
|
+
* authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
|
|
6
|
+
* when a credited tool's index no longer lists a rule cited here.
|
|
7
|
+
*/
|
|
8
|
+
import type { Lineage } from "@intentius/chant/audit/catalog";
|
|
9
|
+
export declare const azureAuditLineage: Record<string, Lineage[]>;
|
|
10
|
+
//# sourceMappingURL=audit-lineage.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAsEvD,CAAC"}
|
package/dist/manifest.json
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAMhC,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc/C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED,4EAA4E;AAC5E,wBAAsB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAgID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAenF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAqBzE;AAID,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ9G;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE;qDACiD;IACjD,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CA+CD;AAUD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGrF;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,MAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASlI;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAM3D;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;CAC/B,GAAG,WAAW,CAqBd;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAKD;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,EACpB,KAAK,GAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAa,GAClD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CA6CD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAqB/E"}
|
package/dist/op/builders.d.ts
CHANGED
|
@@ -1,9 +1,11 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Typed step-builder wrappers for this lexicon's activities (chant #1288
|
|
3
3
|
* Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
|
|
4
|
-
* live beside their `*Args` interfaces rather than in core
|
|
5
|
-
*
|
|
6
|
-
* interface
|
|
4
|
+
* live beside their `*Args` interfaces rather than in core: core cannot
|
|
5
|
+
* import a lexicon's types, so a wrapper whose `opts` IS the activity's own
|
|
6
|
+
* `*Args` interface can only sit in the lexicon that declares that
|
|
7
|
+
* interface. `opts`'s type in each wrapper below IS the activity's own
|
|
8
|
+
* `*Args` interface (via `Omit`/`WithStepRefs`) — never restated. `core`'s own
|
|
7
9
|
* `azApply`/`azDelete`/`azGroupEnsure`/`azGroupDelete`/`flociAzUp`/
|
|
8
10
|
* `flociAzDown` are unchanged and produce byte-identical `ActivityStep`
|
|
9
11
|
* output; these are purely additive.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE5E,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,eAAe,MAAM,EACrB,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,GAAG,QAAQ,KACvE,iBAGF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GACxB,eAAe,MAAM,EACrB,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC,GAAG,QAAQ,KACvE,iBAGF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,OAAO,GAClB,cAAc,MAAM,EACpB,MAAM,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,GAAG,QAAQ,KAC/D,iBAGF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,GACnB,cAAc,MAAM,EACpB,MAAM,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,GAAG,QAAQ,KAC/D,iBAGF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,OAAO,YAAY,CAAC,aAAa,CAAC,GAAG,QAAQ,KAAG,iBAGzE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,OAAO,YAAY,CAAC,eAAe,CAAC,GAAG,QAAQ,KAAG,iBAG7E,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@intentius/chant-lexicon-azure",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.58.0",
|
|
4
4
|
"description": "Azure lexicon for chant — declarative IaC in TypeScript",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://intentius.io/chant",
|
|
@@ -74,7 +74,7 @@
|
|
|
74
74
|
"typescript": "^5.9.3"
|
|
75
75
|
},
|
|
76
76
|
"peerDependencies": {
|
|
77
|
-
"@intentius/chant": "^0.
|
|
77
|
+
"@intentius/chant": "^0.58.0",
|
|
78
78
|
"typescript": "^5.9.3"
|
|
79
79
|
}
|
|
80
80
|
}
|
package/src/deep-observe.test.ts
CHANGED
|
@@ -529,10 +529,15 @@ describe("end to end: declared + mutated live + baseline (#1086)", () => {
|
|
|
529
529
|
// The vnet is clean: reordering and server-populated fields subtract.
|
|
530
530
|
expect(result.unchanged).toEqual(["vnet"]);
|
|
531
531
|
|
|
532
|
-
// The platform team's tag is
|
|
533
|
-
//
|
|
534
|
-
|
|
535
|
-
|
|
532
|
+
// The platform team's tag is on a path source never declared, so since
|
|
533
|
+
// #2160 the claim answers before the baseline does: unclaimed, at its
|
|
534
|
+
// live value, and not drift. ARM records no field manager, so the
|
|
535
|
+
// claimed-field set is the only source that can answer.
|
|
536
|
+
expect(result.accepted).toEqual([]);
|
|
537
|
+
expect(result.unclaimed.map((e) => e.name)).toEqual(["dataAccount"]);
|
|
538
|
+
expect(result.unclaimed[0].fields).toEqual([
|
|
539
|
+
{ path: "tags.cost-center", live: "platform", source: "claimed-fields", baseline: "platform" },
|
|
540
|
+
]);
|
|
536
541
|
|
|
537
542
|
// An unreadable deep read is a hole with a reason — never silence, never
|
|
538
543
|
// noise, and never a create.
|
|
@@ -547,24 +552,34 @@ describe("end to end: declared + mutated live + baseline (#1086)", () => {
|
|
|
547
552
|
]);
|
|
548
553
|
});
|
|
549
554
|
|
|
550
|
-
test("
|
|
555
|
+
test("the claim silences the platform tag with no baseline at all (#2160)", async () => {
|
|
551
556
|
wireMocks();
|
|
552
557
|
const result = await deepDiffForLexicon(azurePlugin, { environment: "prod", buildOutput: "", entities: declared });
|
|
553
558
|
const dataAccount = result.drifted.find((d) => d.name === "dataAccount");
|
|
554
|
-
expect(dataAccount?.changes.map((c) => c.path)
|
|
559
|
+
expect(dataAccount?.changes.map((c) => c.path)).toEqual(["allowBlobPublicAccess"]);
|
|
560
|
+
expect(result.unclaimed[0].fields.map((f) => f.path)).toEqual(["tags.cost-center"]);
|
|
555
561
|
expect(result.accepted).toEqual([]);
|
|
556
562
|
});
|
|
557
563
|
|
|
558
564
|
test("an accepted value that later changes is drift again, with all three axes", async () => {
|
|
565
|
+
// The baseline's value-bound rule, on the path that is actually declared.
|
|
559
566
|
wireMocks();
|
|
560
567
|
const result = await deepDiffForLexicon(azurePlugin, {
|
|
561
568
|
environment: "prod",
|
|
562
569
|
buildOutput: "",
|
|
563
570
|
entities: declared,
|
|
564
|
-
baseline: { dataAccount: { accepted: [{ path: "
|
|
571
|
+
baseline: { dataAccount: { accepted: [{ path: "allowBlobPublicAccess", value: false }] } },
|
|
572
|
+
});
|
|
573
|
+
const change = result.drifted
|
|
574
|
+
.find((d) => d.name === "dataAccount")
|
|
575
|
+
?.changes.find((c) => c.path === "allowBlobPublicAccess");
|
|
576
|
+
expect(change).toEqual({
|
|
577
|
+
path: "allowBlobPublicAccess",
|
|
578
|
+
kind: "changed",
|
|
579
|
+
declared: false,
|
|
580
|
+
live: true,
|
|
581
|
+
baseline: false,
|
|
565
582
|
});
|
|
566
|
-
const change = result.drifted.find((d) => d.name === "dataAccount")?.changes.find((c) => c.path === "tags.cost-center");
|
|
567
|
-
expect(change).toEqual({ path: "tags.cost-center", kind: "undeclared", live: "platform", baseline: "someone-elses-team" });
|
|
568
583
|
});
|
|
569
584
|
|
|
570
585
|
test("a whole-lexicon failure is a hole for every declared entity, not a clean report", async () => {
|
package/src/deep-observe.ts
CHANGED
|
@@ -339,8 +339,7 @@ export interface AzureDeepObserveOptions {
|
|
|
339
339
|
* show`. One call per entity, same as the thin path — ARM has no bulk
|
|
340
340
|
* "describe everything in this group" call with per-resource depth the way
|
|
341
341
|
* CloudFormation's `describe-stack-resources` does, so there is no cheap
|
|
342
|
-
* list-then-describe split to make here the way AWS's
|
|
343
|
-
* do.
|
|
342
|
+
* list-then-describe split to make here the way AWS's own reader does.
|
|
344
343
|
*/
|
|
345
344
|
export async function observeResourcesDeepAzure(
|
|
346
345
|
options: AzureDeepObserveOptions,
|
package/src/index.ts
CHANGED
|
@@ -7,9 +7,9 @@
|
|
|
7
7
|
// Typed Op step-builder wrappers (chant #1288 Stage 2) — azApply/azDelete/
|
|
8
8
|
// azGroupEnsure/azGroupDelete/flociAzUp/flociAzDown with authoring-time
|
|
9
9
|
// types derived from this lexicon's own *Args interfaces (see
|
|
10
|
-
// ./op/builders.ts's module doc for why these live here rather than in
|
|
11
|
-
//
|
|
12
|
-
//
|
|
10
|
+
// ./op/builders.ts's module doc for why these live here rather than in
|
|
11
|
+
// core). Opt-in: `@intentius/chant/op`'s same-named exports are core's
|
|
12
|
+
// original untyped builders, unchanged.
|
|
13
13
|
export { azApply, azDelete, azGroupEnsure, azGroupDelete, flociAzUp, flociAzDown } from "./op/builders";
|
|
14
14
|
|
|
15
15
|
// --- Core ---
|
|
@@ -2,7 +2,8 @@
|
|
|
2
2
|
* The azure lexicon's `chant audit` catalog — metadata for the AZR* ARM
|
|
3
3
|
* post-synth rules. Contributed via `azurePlugin.auditCatalog()` (#687).
|
|
4
4
|
*/
|
|
5
|
-
import { auditRule, type RuleMeta, type Authority } from "@intentius/chant/audit/catalog";
|
|
5
|
+
import { auditRule, type RuleMeta, type Authority, applyLineage } from "@intentius/chant/audit/catalog";
|
|
6
|
+
import { azureAuditLineage } from "./audit-lineage";
|
|
6
7
|
|
|
7
8
|
const AZ_SEC: Authority = { name: "Microsoft Cloud Security Benchmark", url: "https://learn.microsoft.com/en-us/security/benchmark/azure/" };
|
|
8
9
|
|
|
@@ -34,3 +35,6 @@ export const azureAuditCatalog: Record<string, RuleMeta> = {
|
|
|
34
35
|
AZR032: auditRule("AZR032", "merge-worthy", "guidance", "Custom policy definition assigned nowhere", "Pair the policy definition with a policy assignment — unassigned it enforces nothing.", { authority: [AZ_SEC] }),
|
|
35
36
|
AZR033: auditRule("AZR033", "merge-worthy", "guidance", "Subscriptions may leave the tenant", "Set blockSubscriptionsLeavingTenant: true on the Microsoft.Subscription/policies resource.", { authority: [AZ_SEC] }),
|
|
36
37
|
};
|
|
38
|
+
|
|
39
|
+
// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
|
|
40
|
+
applyLineage(azureAuditCatalog, azureAuditLineage);
|
|
@@ -0,0 +1,80 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Prior art for these audit rules: the open-source tools whose checks cover the
|
|
3
|
+
* same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
|
|
4
|
+
* the registry, the relation vocabulary, and why this is credit rather than
|
|
5
|
+
* authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
|
|
6
|
+
* when a credited tool's index no longer lists a rule cited here.
|
|
7
|
+
*/
|
|
8
|
+
import type { Lineage } from "@intentius/chant/audit/catalog";
|
|
9
|
+
|
|
10
|
+
export const azureAuditLineage: Record<string, Lineage[]> = {
|
|
11
|
+
AZR010: [
|
|
12
|
+
{ tool: "bicep-linter", rule: "no-unnecessary-dependson", url: "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter-rule-no-unnecessary-dependson", relation: "equivalent" },
|
|
13
|
+
],
|
|
14
|
+
AZR011: [
|
|
15
|
+
{ tool: "arm-ttk", rule: "apiVersions-Should-Be-Recent", url: "https://github.com/Azure/arm-ttk/blob/master/arm-ttk/testcases/deploymentTemplate/apiVersions-Should-Be-Recent.test.ps1", relation: "overlaps" },
|
|
16
|
+
],
|
|
17
|
+
AZR012: [
|
|
18
|
+
{ tool: "arm-ttk", rule: "apiVersions-Should-Be-Recent", url: "https://github.com/Azure/arm-ttk/blob/master/arm-ttk/testcases/deploymentTemplate/apiVersions-Should-Be-Recent.test.ps1", relation: "overlaps" },
|
|
19
|
+
{ tool: "bicep-linter", rule: "use-recent-api-versions", url: "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter-rule-use-recent-api-versions", relation: "overlaps" },
|
|
20
|
+
],
|
|
21
|
+
AZR014: [
|
|
22
|
+
{ tool: "psrule-azure", rule: "Azure.Storage.BlobPublicAccess", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Storage.BlobPublicAccess/", relation: "equivalent" },
|
|
23
|
+
{ tool: "checkov", rule: "CKV_AZURE_59", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
24
|
+
],
|
|
25
|
+
AZR016: [
|
|
26
|
+
{ tool: "psrule-azure", rule: "Azure.KeyVault.SoftDelete", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SoftDelete/", relation: "equivalent" },
|
|
27
|
+
{ tool: "checkov", rule: "CKV_AZURE_111", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
28
|
+
{ tool: "kics", rule: "Key Vault Not Recoverable", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/7c25f361-7c66-44bf-9b69-022acd5eb4bd/", relation: "overlaps" },
|
|
29
|
+
],
|
|
30
|
+
AZR017: [
|
|
31
|
+
{ tool: "psrule-azure", rule: "Azure.KeyVault.PurgeProtect", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.PurgeProtect/", relation: "equivalent" },
|
|
32
|
+
{ tool: "checkov", rule: "CKV_AZURE_110", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
33
|
+
{ tool: "kics", rule: "Key Vault Not Recoverable", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/7c25f361-7c66-44bf-9b69-022acd5eb4bd/", relation: "overlaps" },
|
|
34
|
+
],
|
|
35
|
+
AZR018: [
|
|
36
|
+
{ tool: "psrule-azure", rule: "Azure.SQL.Auditing", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.SQL.Auditing/", relation: "equivalent" },
|
|
37
|
+
{ tool: "checkov", rule: "CKV_AZURE_23", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
38
|
+
{ tool: "kics", rule: "SQL Server Database Without Auditing", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/e055285c-bc01-48b4-8aa5-8a54acdd29df/", relation: "equivalent" },
|
|
39
|
+
],
|
|
40
|
+
AZR019: [
|
|
41
|
+
{ tool: "psrule-azure", rule: "Azure.SQL.TDE", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.SQL.TDE/", relation: "equivalent" },
|
|
42
|
+
],
|
|
43
|
+
AZR020: [
|
|
44
|
+
{ tool: "psrule-azure", rule: "Azure.AppService.ManagedIdentity", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.ManagedIdentity/", relation: "equivalent" },
|
|
45
|
+
{ tool: "checkov", rule: "CKV_AZURE_71", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
46
|
+
],
|
|
47
|
+
AZR021: [
|
|
48
|
+
{ tool: "psrule-azure", rule: "Azure.AppService.UseHTTPS", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.UseHTTPS/", relation: "equivalent" },
|
|
49
|
+
{ tool: "checkov", rule: "CKV_AZURE_14", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
50
|
+
{ tool: "kics", rule: "Website Not Forcing HTTPS", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/488847ff-6031-487c-bf42-98fd6ac5c9a0/", relation: "equivalent" },
|
|
51
|
+
],
|
|
52
|
+
AZR022: [
|
|
53
|
+
{ tool: "psrule-azure", rule: "Azure.AppService.MinTLS", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.MinTLS/", relation: "equivalent" },
|
|
54
|
+
{ tool: "checkov", rule: "CKV_AZURE_15", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
55
|
+
{ tool: "kics", rule: "Web App Not Using TLS Last Version", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/b5c851d5-00f1-43dc-a8de-3218fd6f71be/", relation: "equivalent" },
|
|
56
|
+
],
|
|
57
|
+
AZR023: [
|
|
58
|
+
{ tool: "psrule-azure", rule: "Azure.VM.UseManagedDisks", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.VM.UseManagedDisks/", relation: "equivalent" },
|
|
59
|
+
{ tool: "checkov", rule: "CKV_AZURE_92", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
60
|
+
],
|
|
61
|
+
AZR025: [
|
|
62
|
+
{ tool: "psrule-azure", rule: "Azure.AKS.UseRBAC", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.UseRBAC/", relation: "equivalent" },
|
|
63
|
+
{ tool: "checkov", rule: "CKV_AZURE_5", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
64
|
+
{ tool: "kics", rule: "AKS Cluster RBAC Disabled", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/9307a2ed-35c2-413d-94de-a1a0682c2158/", relation: "equivalent" },
|
|
65
|
+
],
|
|
66
|
+
AZR026: [
|
|
67
|
+
{ tool: "psrule-azure", rule: "Azure.AKS.NetworkPolicy", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.NetworkPolicy/", relation: "equivalent" },
|
|
68
|
+
{ tool: "checkov", rule: "CKV_AZURE_7", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
69
|
+
{ tool: "kics", rule: "AKS Cluster Network Policy Not Configured", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/25c0228e-4444-459b-a2df-93c7df40b7ed/", relation: "equivalent" },
|
|
70
|
+
],
|
|
71
|
+
AZR027: [
|
|
72
|
+
{ tool: "psrule-azure", rule: "Azure.ACR.AdminUser", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ACR.AdminUser/", relation: "equivalent" },
|
|
73
|
+
{ tool: "checkov", rule: "CKV_AZURE_137", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
74
|
+
],
|
|
75
|
+
AZR029: [
|
|
76
|
+
{ tool: "checkov", rule: "CKV_AZURE_2", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
|
|
77
|
+
{ tool: "kics", rule: "Azure Managed Disk Without Encryption", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/350f3955-b5be-436f-afaa-3d2be2fa6cdd/", relation: "equivalent" },
|
|
78
|
+
{ tool: "psrule-azure", rule: "Azure.VM.ADE", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.VM.ADE/", relation: "overlaps" },
|
|
79
|
+
],
|
|
80
|
+
};
|
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
import { readFileSync } from "node:fs";
|
|
2
2
|
import { createHash } from "node:crypto";
|
|
3
|
-
import { safeHeartbeat } from "@intentius/chant/op";
|
|
4
3
|
import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
|
|
5
4
|
import { AZURE_TAG_OWNERSHIP_KEYS } from "../../ownership";
|
|
6
5
|
import { lookupApiVersion } from "../../serializer";
|
|
@@ -337,7 +336,6 @@ export async function azApply(
|
|
|
337
336
|
const applied: Array<{ type: string; name: string }> = [];
|
|
338
337
|
for (const resource of orderArmResources(resources)) {
|
|
339
338
|
const name = String(await evalArmString(resource.name, ctx));
|
|
340
|
-
safeHeartbeat({ step: "azApply", type: resource.type, name });
|
|
341
339
|
// Stamp chant ownership so a later prune can tell chant-managed resources
|
|
342
340
|
// apart from foreign ones in the same group.
|
|
343
341
|
const body = await armResourceBody(resource, ctx);
|
|
@@ -646,7 +644,6 @@ export async function pruneArmOrphans(
|
|
|
646
644
|
notPrunable.push({ type: item.type, name: item.name, reason: "no-api-version" });
|
|
647
645
|
continue;
|
|
648
646
|
}
|
|
649
|
-
safeHeartbeat({ step: "azPrune", type: item.type, name: item.name });
|
|
650
647
|
const result = await deleteArmResource(item.type, item.name, apiVersion, ctx, http, signal);
|
|
651
648
|
console.log(`pruned: ${item.type}/${item.name} (${ctx.base})`);
|
|
652
649
|
pruned.push(result);
|
|
@@ -680,7 +677,6 @@ export async function azDelete(
|
|
|
680
677
|
const deleted: Array<{ type: string; name: string; deleted: boolean }> = [];
|
|
681
678
|
for (const resource of orderArmResources(template.resources ?? []).reverse()) {
|
|
682
679
|
const name = String(await evalArmString(resource.name, ctx));
|
|
683
|
-
safeHeartbeat({ step: "azDelete", type: resource.type, name });
|
|
684
680
|
const result = await deleteArmResource(resource.type, name, resource.apiVersion, ctx, http, signal);
|
|
685
681
|
console.log(`${result.deleted ? "deleted" : "absent"}: ${resource.type}/${name} (${base})`);
|
|
686
682
|
deleted.push(result);
|
package/src/op/builders.ts
CHANGED
|
@@ -1,9 +1,11 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Typed step-builder wrappers for this lexicon's activities (chant #1288
|
|
3
3
|
* Stage 2). See `lexicons/k8s/src/op/builders.ts`'s module doc for why these
|
|
4
|
-
* live beside their `*Args` interfaces rather than in core
|
|
5
|
-
*
|
|
6
|
-
* interface
|
|
4
|
+
* live beside their `*Args` interfaces rather than in core: core cannot
|
|
5
|
+
* import a lexicon's types, so a wrapper whose `opts` IS the activity's own
|
|
6
|
+
* `*Args` interface can only sit in the lexicon that declares that
|
|
7
|
+
* interface. `opts`'s type in each wrapper below IS the activity's own
|
|
8
|
+
* `*Args` interface (via `Omit`/`WithStepRefs`) — never restated. `core`'s own
|
|
7
9
|
* `azApply`/`azDelete`/`azGroupEnsure`/`azGroupDelete`/`flociAzUp`/
|
|
8
10
|
* `flociAzDown` are unchanged and produce byte-identical `ActivityStep`
|
|
9
11
|
* output; these are purely additive.
|