@intentius/chant-lexicon-azure 0.124.31 → 0.124.32

package/dist/intrinsics.js

@@ -0,0 +1,179 @@
+/**
+ * ARM template function intrinsics.
+ *
+ * Each intrinsic implements INTRINSIC_MARKER + toJSON() for serialization
+ * to ARM template bracket expressions: "[resourceId(...)]", "[concat(...)]", etc.
+ */
+var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+import { INTRINSIC_MARKER, resolveIntrinsicValue } from "@intentius/chant/intrinsic";
+/**
+ * resourceId(resourceType, name1, name2, ...) — returns a resource ID string.
+ */
+export class ResourceIdIntrinsic {
+    constructor(resourceType, ...names) {
+        this[_a] = true;
+        this.resourceType = resourceType;
+        this.names = names;
+    }
+    toJSON() {
+        const args = [
+            `'${this.resourceType}'`,
+            ...this.names.map((n) => serializeArg(n)),
+        ].join(", ");
+        return `[resourceId(${args})]`;
+    }
+}
+_a = INTRINSIC_MARKER;
+export function ResourceId(resourceType, ...names) {
+    return new ResourceIdIntrinsic(resourceType, ...names);
+}
+/**
+ * reference(name, apiVersion?) — returns the runtime state of a resource.
+ */
+export class ReferenceIntrinsic {
+    constructor(name, apiVersion) {
+        this[_b] = true;
+        this.name = name;
+        this.apiVersion = apiVersion;
+    }
+    toJSON() {
+        if (this.apiVersion) {
+            return `[reference('${this.name}', '${this.apiVersion}')]`;
+        }
+        return `[reference('${this.name}')]`;
+    }
+}
+_b = INTRINSIC_MARKER;
+export function Reference(name, apiVersion) {
+    return new ReferenceIntrinsic(name, apiVersion);
+}
+/**
+ * concat(value1, value2, ...) — concatenates strings.
+ */
+export class ConcatIntrinsic {
+    constructor(...values) {
+        this[_c] = true;
+        this.values = values;
+    }
+    toJSON() {
+        const args = this.values.map((v) => serializeArg(v)).join(", ");
+        return `[concat(${args})]`;
+    }
+}
+_c = INTRINSIC_MARKER;
+export function Concat(...values) {
+    return new ConcatIntrinsic(...values);
+}
+/**
+ * resourceGroup() — returns the current resource group object.
+ */
+export class ResourceGroupIntrinsic {
+    constructor() {
+        this[_d] = true;
+    }
+    toJSON() {
+        return "[resourceGroup()]";
+    }
+}
+_d = INTRINSIC_MARKER;
+export function ResourceGroup() {
+    return new ResourceGroupIntrinsic();
+}
+/**
+ * subscription() — returns the current subscription object.
+ */
+export class SubscriptionIntrinsic {
+    constructor() {
+        this[_e] = true;
+    }
+    toJSON() {
+        return "[subscription()]";
+    }
+}
+_e = INTRINSIC_MARKER;
+export function Subscription() {
+    return new SubscriptionIntrinsic();
+}
+/**
+ * uniqueString(value1, ...) — generates a deterministic hash string.
+ */
+export class UniqueStringIntrinsic {
+    constructor(...values) {
+        this[_f] = true;
+        this.values = values;
+    }
+    toJSON() {
+        const args = this.values.map((v) => serializeArg(v)).join(", ");
+        return `[uniqueString(${args})]`;
+    }
+}
+_f = INTRINSIC_MARKER;
+export function UniqueString(...values) {
+    return new UniqueStringIntrinsic(...values);
+}
+/**
+ * format(formatString, arg1, arg2, ...) — formats a string.
+ */
+export class FormatIntrinsic {
+    constructor(fmt, ...args) {
+        this[_g] = true;
+        this.fmt = fmt;
+        this.args = args;
+    }
+    toJSON() {
+        const allArgs = [`'${this.fmt}'`, ...this.args.map((a) => serializeArg(a))].join(", ");
+        return `[format(${allArgs})]`;
+    }
+}
+_g = INTRINSIC_MARKER;
+export function Format(fmt, ...args) {
+    return new FormatIntrinsic(fmt, ...args);
+}
+/**
+ * if(condition, trueValue, falseValue) — conditional expression.
+ */
+export class IfIntrinsic {
+    constructor(condition, trueValue, falseValue) {
+        this[_h] = true;
+        this.condition = condition;
+        this.trueValue = trueValue;
+        this.falseValue = falseValue;
+    }
+    toJSON() {
+        return `[if('${this.condition}', ${serializeArg(this.trueValue)}, ${serializeArg(this.falseValue)})]`;
+    }
+}
+_h = INTRINSIC_MARKER;
+export function If(condition, trueValue, falseValue) {
+    return new IfIntrinsic(condition, trueValue, falseValue);
+}
+/**
+ * listKeys(resourceId, apiVersion) — lists access keys for a resource.
+ */
+export class ListKeysIntrinsic {
+    constructor(resourceId, apiVersion) {
+        this[_j] = true;
+        this.resourceId = resourceId;
+        this.apiVersion = apiVersion;
+    }
+    toJSON() {
+        return `[listKeys(${serializeArg(this.resourceId)}, '${this.apiVersion}')]`;
+    }
+}
+_j = INTRINSIC_MARKER;
+export function ListKeys(resourceId, apiVersion) {
+    return new ListKeysIntrinsic(resourceId, apiVersion);
+}
+// --- Helpers ---
+function serializeArg(value) {
+    if (typeof value === "string")
+        return `'${value}'`;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    const resolved = resolveIntrinsicValue(value);
+    if (typeof resolved === "string" && resolved.startsWith("[") && resolved.endsWith("]")) {
+        // Nested ARM expression — strip outer brackets
+        return resolved.slice(1, -1);
+    }
+    return JSON.stringify(resolved);
+}

package/dist/lint/audit-catalog.js

@@ -0,0 +1,36 @@
+/**
+ * The azure lexicon's `chant audit` catalog — metadata for the AZR* ARM
+ * post-synth rules. Contributed via `azurePlugin.auditCatalog()` (#687).
+ */
+import { auditRule, applyLineage } from "@intentius/chant/audit/catalog";
+import { azureAuditLineage } from "./audit-lineage.js";
+const AZ_SEC = { name: "Microsoft Cloud Security Benchmark", url: "https://learn.microsoft.com/en-us/security/benchmark/azure/" };
+export const azureAuditCatalog = {
+    AZR010: auditRule("AZR010", "report-only", "guidance", "Redundant dependsOn", "Remove dependsOn already implied by reference()/resourceId().", { category: "best-practice" }),
+    AZR011: auditRule("AZR011", "merge-worthy", "guidance", "Missing or invalid apiVersion", "Set a valid YYYY-MM-DD apiVersion on every resource.", { category: "correctness" }),
+    AZR012: auditRule("AZR012", "report-only", "guidance", "Deprecated API version", "Move to a current apiVersion.", { category: "best-practice" }),
+    AZR013: auditRule("AZR013", "merge-worthy", "guidance", "Resource missing location", "Add the required location property.", { category: "correctness" }),
+    AZR014: auditRule("AZR014", "merge-worthy", "guidance", "Storage account allows public blob access", "Set allowBlobPublicAccess to false.", { authority: [AZ_SEC] }),
+    AZR015: auditRule("AZR015", "merge-worthy", "guidance", "Storage account missing encryption", "Enable encryption services for data at rest.", { authority: [AZ_SEC] }),
+    AZR016: auditRule("AZR016", "report-only", "guidance", "Key Vault soft-delete not enabled", "Enable soft-delete.", { category: "best-practice" }),
+    AZR017: auditRule("AZR017", "report-only", "guidance", "Key Vault purge protection not enabled", "Enable purge protection.", { category: "best-practice" }),
+    AZR018: auditRule("AZR018", "report-only", "guidance", "SQL Server missing auditing", "Enable auditing for compliance and threat detection.", { category: "best-practice" }),
+    AZR019: auditRule("AZR019", "merge-worthy", "guidance", "SQL database missing TDE", "Enable Transparent Data Encryption.", { authority: [AZ_SEC] }),
+    AZR020: auditRule("AZR020", "report-only", "guidance", "App Service missing managed identity", "Enable a system- or user-assigned identity.", { category: "best-practice" }),
+    AZR021: auditRule("AZR021", "merge-worthy", "guidance", "App Service not HTTPS-only", "Set httpsOnly to true.", { authority: [AZ_SEC] }),
+    AZR022: auditRule("AZR022", "merge-worthy", "guidance", "App Service min TLS below 1.2", "Set minTlsVersion to 1.2+.", { authority: [AZ_SEC] }),
+    AZR023: auditRule("AZR023", "report-only", "guidance", "VM not using a managed disk", "Use a managed disk.", { category: "best-practice" }),
+    AZR024: auditRule("AZR024", "report-only", "guidance", "VM missing boot diagnostics", "Enable boot diagnostics.", { category: "best-practice" }),
+    AZR025: auditRule("AZR025", "report-only", "guidance", "AKS cluster missing RBAC", "Enable Kubernetes RBAC.", { category: "best-practice" }),
+    AZR026: auditRule("AZR026", "report-only", "guidance", "AKS cluster missing network policy", "Configure a networkPolicy.", { category: "best-practice" }),
+    AZR027: auditRule("AZR027", "merge-worthy", "guidance", "Container Registry admin user enabled", "Disable the admin user; use Azure AD / service principals.", { authority: [AZ_SEC] }),
+    AZR028: auditRule("AZR028", "report-only", "guidance", "Network interface missing NSG", "Associate an NSG to control traffic.", { category: "best-practice" }),
+    AZR029: auditRule("AZR029", "merge-worthy", "guidance", "Managed disk missing encryption", "Enable encryption for data at rest.", { authority: [AZ_SEC] }),
+    AZR030: auditRule("AZR030", "merge-worthy", "guidance", "Resource at unsupported template scope", "Move the resource to a project deployed at a scope its schema supports.", { category: "correctness" }),
+    // governance posture regressions.
+    AZR031: auditRule("AZR031", "merge-worthy", "guidance", "Policy assignment not enforced (DoNotEnforce)", "Set enforcementMode to Default so the assigned guardrail applies.", { authority: [AZ_SEC] }),
+    AZR032: auditRule("AZR032", "merge-worthy", "guidance", "Custom policy definition assigned nowhere", "Pair the policy definition with a policy assignment — unassigned it enforces nothing.", { authority: [AZ_SEC] }),
+    AZR033: auditRule("AZR033", "merge-worthy", "guidance", "Subscriptions may leave the tenant", "Set blockSubscriptionsLeavingTenant: true on the Microsoft.Subscription/policies resource.", { authority: [AZ_SEC] }),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(azureAuditCatalog, azureAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,71 @@
+export const azureAuditLineage = {
+    AZR010: [
+        { tool: "bicep-linter", rule: "no-unnecessary-dependson", url: "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter-rule-no-unnecessary-dependson", relation: "equivalent" },
+    ],
+    AZR011: [
+        { tool: "arm-ttk", rule: "apiVersions-Should-Be-Recent", url: "https://github.com/Azure/arm-ttk/blob/master/arm-ttk/testcases/deploymentTemplate/apiVersions-Should-Be-Recent.test.ps1", relation: "overlaps" },
+    ],
+    AZR012: [
+        { tool: "arm-ttk", rule: "apiVersions-Should-Be-Recent", url: "https://github.com/Azure/arm-ttk/blob/master/arm-ttk/testcases/deploymentTemplate/apiVersions-Should-Be-Recent.test.ps1", relation: "overlaps" },
+        { tool: "bicep-linter", rule: "use-recent-api-versions", url: "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter-rule-use-recent-api-versions", relation: "overlaps" },
+    ],
+    AZR014: [
+        { tool: "psrule-azure", rule: "Azure.Storage.BlobPublicAccess", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Storage.BlobPublicAccess/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_59", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+    ],
+    AZR016: [
+        { tool: "psrule-azure", rule: "Azure.KeyVault.SoftDelete", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SoftDelete/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_111", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Key Vault Not Recoverable", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/7c25f361-7c66-44bf-9b69-022acd5eb4bd/", relation: "overlaps" },
+    ],
+    AZR017: [
+        { tool: "psrule-azure", rule: "Azure.KeyVault.PurgeProtect", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.PurgeProtect/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_110", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Key Vault Not Recoverable", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/7c25f361-7c66-44bf-9b69-022acd5eb4bd/", relation: "overlaps" },
+    ],
+    AZR018: [
+        { tool: "psrule-azure", rule: "Azure.SQL.Auditing", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.SQL.Auditing/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_23", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "SQL Server Database Without Auditing", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/e055285c-bc01-48b4-8aa5-8a54acdd29df/", relation: "equivalent" },
+    ],
+    AZR019: [
+        { tool: "psrule-azure", rule: "Azure.SQL.TDE", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.SQL.TDE/", relation: "equivalent" },
+    ],
+    AZR020: [
+        { tool: "psrule-azure", rule: "Azure.AppService.ManagedIdentity", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.ManagedIdentity/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_71", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+    ],
+    AZR021: [
+        { tool: "psrule-azure", rule: "Azure.AppService.UseHTTPS", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.UseHTTPS/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_14", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Website Not Forcing HTTPS", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/488847ff-6031-487c-bf42-98fd6ac5c9a0/", relation: "equivalent" },
+    ],
+    AZR022: [
+        { tool: "psrule-azure", rule: "Azure.AppService.MinTLS", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.MinTLS/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_15", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Web App Not Using TLS Last Version", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/b5c851d5-00f1-43dc-a8de-3218fd6f71be/", relation: "equivalent" },
+    ],
+    AZR023: [
+        { tool: "psrule-azure", rule: "Azure.VM.UseManagedDisks", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.VM.UseManagedDisks/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_92", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+    ],
+    AZR025: [
+        { tool: "psrule-azure", rule: "Azure.AKS.UseRBAC", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.UseRBAC/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_5", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "AKS Cluster RBAC Disabled", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/9307a2ed-35c2-413d-94de-a1a0682c2158/", relation: "equivalent" },
+    ],
+    AZR026: [
+        { tool: "psrule-azure", rule: "Azure.AKS.NetworkPolicy", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.NetworkPolicy/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_7", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "AKS Cluster Network Policy Not Configured", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/25c0228e-4444-459b-a2df-93c7df40b7ed/", relation: "equivalent" },
+    ],
+    AZR027: [
+        { tool: "psrule-azure", rule: "Azure.ACR.AdminUser", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ACR.AdminUser/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_137", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+    ],
+    AZR029: [
+        { tool: "checkov", rule: "CKV_AZURE_2", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Azure Managed Disk Without Encryption", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/350f3955-b5be-436f-afaa-3d2be2fa6cdd/", relation: "equivalent" },
+        { tool: "psrule-azure", rule: "Azure.VM.ADE", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.VM.ADE/", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/arm-refs.js

@@ -0,0 +1,94 @@
+/**
+ * Shared utility for extracting ARM template resource references
+ * from template properties.
+ *
+ * Used by AZR010 (redundant DependsOn) and other post-synth checks.
+ *
+ * ARM templates use bracket expressions like [resourceId(...)],
+ * [reference(...)], and [concat(...)] to reference other resources.
+ */
+/**
+ * Parse a serialized ARM template from build output.
+ * Accepts either a raw string or a SerializerResult (extracts primary).
+ */
+export function parseArmTemplate(output) {
+    const raw = typeof output === "string" ? output : output.primary;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === "object" && parsed !== null) {
+            return parsed;
+        }
+    }
+    catch {
+        // Not valid JSON
+    }
+    return null;
+}
+/**
+ * Extract resource names referenced via bracket expressions in a value.
+ *
+ * Parses ARM bracket expressions like:
+ * - [resourceId('Microsoft.Storage/storageAccounts', 'myStorage')]
+ * - [reference('myStorage')]
+ * - [reference('myStorage').primaryEndpoints.blob]
+ *
+ * Returns the set of resource names found in these references.
+ */
+export function findArmResourceRefs(value) {
+    const refs = new Set();
+    walkArmValue(value, refs);
+    return refs;
+}
+/**
+ * Check if a string value is an ARM bracket expression.
+ */
+export function isBracketExpression(value) {
+    return typeof value === "string" && value.startsWith("[") && value.endsWith("]");
+}
+/**
+ * Extract resource names from an ARM bracket expression string.
+ *
+ * Handles:
+ * - [resourceId('Type', 'name')]  -> extracts 'name'
+ * - [reference('name')]           -> extracts 'name'
+ * - [reference('name').prop]      -> extracts 'name'
+ */
+export function extractRefsFromExpression(expr) {
+    const refs = [];
+    // Match resourceId('...', 'name') — extract the last quoted argument (the resource name)
+    const resourceIdPattern = /resourceId\s*\([^)]*,\s*'([^']+)'\s*\)/g;
+    let match;
+    while ((match = resourceIdPattern.exec(expr)) !== null) {
+        refs.push(match[1]);
+    }
+    // Match reference('name') — extract the name
+    const referencePattern = /reference\s*\(\s*'([^']+)'\s*\)/g;
+    while ((match = referencePattern.exec(expr)) !== null) {
+        refs.push(match[1]);
+    }
+    return refs;
+}
+function walkArmValue(value, refs) {
+    if (value === null || value === undefined)
+        return;
+    if (typeof value === "string") {
+        if (isBracketExpression(value)) {
+            for (const ref of extractRefsFromExpression(value)) {
+                refs.add(ref);
+            }
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            walkArmValue(item, refs);
+        }
+        return;
+    }
+    if (typeof value === "object") {
+        const obj = value;
+        for (const val of Object.values(obj)) {
+            walkArmValue(val, refs);
+        }
+    }
+}

package/dist/lint/post-synth/azr010.js

@@ -0,0 +1,45 @@
+/**
+ * AZR010: Redundant DependsOn
+ *
+ * Detects dependsOn entries that are already implied by reference() or
+ * resourceId() bracket expressions in the resource's properties. ARM
+ * automatically creates dependencies for these references, making
+ * explicit dependsOn redundant.
+ */
+import { parseArmTemplate, findArmResourceRefs, extractRefsFromExpression } from "./arm-refs.js";
+export const azr010 = {
+    id: "AZR010",
+    description: "Redundant dependsOn — target is already referenced via reference() or resourceId() in properties",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (!resource.dependsOn || resource.dependsOn.length === 0)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                // Find all refs in properties
+                const propertyRefs = findArmResourceRefs(resource.properties);
+                for (const dep of resource.dependsOn) {
+                    // dependsOn entries may be bracket expressions like [resourceId('Type', 'name')]
+                    // or plain resource names
+                    const depNames = dep.startsWith("[") ? extractRefsFromExpression(dep) : [dep];
+                    for (const depName of depNames) {
+                        if (propertyRefs.has(depName)) {
+                            diagnostics.push({
+                                checkId: "AZR010",
+                                severity: "warning",
+                                message: `Resource "${resourceName}" has redundant dependsOn "${depName}" — already referenced in properties`,
+                                entity: resourceName,
+                                lexicon: "azure",
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr011.js

@@ -0,0 +1,43 @@
+/**
+ * AZR011: Missing or Invalid API Version
+ *
+ * Checks that every ARM resource has a valid apiVersion field.
+ * The apiVersion must be a non-empty string matching the date format
+ * YYYY-MM-DD (optionally with a suffix like -preview).
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const API_VERSION_PATTERN = /^\d{4}-\d{2}-\d{2}(-preview|-privatepreview)?$/;
+export const azr011 = {
+    id: "AZR011",
+    description: "Missing or invalid apiVersion — every ARM resource must have a valid apiVersion in YYYY-MM-DD format",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                if (!resource.apiVersion) {
+                    diagnostics.push({
+                        checkId: "AZR011",
+                        severity: "error",
+                        message: `Resource "${resourceName}" (${resource.type}) is missing apiVersion`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+                else if (typeof resource.apiVersion !== "string" || !API_VERSION_PATTERN.test(resource.apiVersion)) {
+                    diagnostics.push({
+                        checkId: "AZR011",
+                        severity: "error",
+                        message: `Resource "${resourceName}" (${resource.type}) has invalid apiVersion "${resource.apiVersion}" — expected YYYY-MM-DD format`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr012.js

@@ -0,0 +1,41 @@
+/**
+ * AZR012: Deprecated API Version
+ *
+ * Warns when a resource uses an apiVersion older than 2023-01-01.
+ * Older API versions may lack features, security patches, and
+ * could be deprecated by Azure.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const MINIMUM_API_DATE = "2023-01-01";
+export const azr012 = {
+    id: "AZR012",
+    description: "Deprecated API version — apiVersion older than 2023 may lack features and security patches",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                if (typeof resource.apiVersion !== "string")
+                    continue;
+                // Extract the date portion (YYYY-MM-DD) ignoring any suffix like -preview
+                const dateMatch = resource.apiVersion.match(/^(\d{4}-\d{2}-\d{2})/);
+                if (!dateMatch)
+                    continue;
+                const apiDate = dateMatch[1];
+                if (apiDate < MINIMUM_API_DATE) {
+                    diagnostics.push({
+                        checkId: "AZR012",
+                        severity: "warning",
+                        message: `Resource "${resourceName}" (${resource.type}) uses outdated apiVersion "${resource.apiVersion}" — consider updating to a version from 2023 or later`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr013.js

@@ -0,0 +1,50 @@
+/**
+ * AZR013: Resource Missing Location
+ *
+ * Warns when an ARM resource does not have a location property.
+ * Most Azure resources require a location. Resources that are
+ * inherently global (e.g., Microsoft.Resources/deployments) are excluded.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+/**
+ * Resource types that do not require a location property.
+ * These are global or subscription-level resources.
+ */
+const LOCATION_EXEMPT_TYPES = new Set([
+    "Microsoft.Resources/deployments",
+    "Microsoft.Authorization/roleAssignments",
+    "Microsoft.Authorization/roleDefinitions",
+    "Microsoft.Authorization/policyAssignments",
+    "Microsoft.Authorization/policyDefinitions",
+    "Microsoft.Authorization/locks",
+    "Microsoft.Management/managementGroups",
+    "Microsoft.Subscription/aliases",
+]);
+export const azr013 = {
+    id: "AZR013",
+    description: "Resource missing location — most Azure resources require a location property",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                // Skip resource types that don't need location
+                if (LOCATION_EXEMPT_TYPES.has(resource.type))
+                    continue;
+                if (resource.location === undefined || resource.location === null || resource.location === "") {
+                    diagnostics.push({
+                        checkId: "AZR013",
+                        severity: "warning",
+                        message: `Resource "${resourceName}" (${resource.type}) is missing a location property`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/azr014.js

@@ -0,0 +1,49 @@
+/**
+ * AZR014: Public Blob Access Enabled
+ *
+ * Warns when a Storage Account has allowBlobPublicAccess set to true
+ * or when the property is missing (defaults to true in older API versions).
+ * Public blob access can expose data to the internet.
+ */
+import { parseArmTemplate } from "./arm-refs.js";
+const STORAGE_ACCOUNT_TYPE = "Microsoft.Storage/storageAccounts";
+export const azr014 = {
+    id: "AZR014",
+    description: "Public blob access enabled on storage account — disable allowBlobPublicAccess to prevent public data exposure",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [_lexicon, output] of ctx.outputs) {
+            const template = parseArmTemplate(output);
+            if (!template?.resources)
+                continue;
+            for (const resource of template.resources) {
+                if (resource.type !== STORAGE_ACCOUNT_TYPE)
+                    continue;
+                const resourceName = typeof resource.name === "string" ? resource.name : String(resource.name);
+                const props = resource.properties ?? {};
+                // allowBlobPublicAccess defaults to true in older API versions
+                // It should be explicitly set to false
+                const allowBlobPublicAccess = props.allowBlobPublicAccess;
+                if (allowBlobPublicAccess === true) {
+                    diagnostics.push({
+                        checkId: "AZR014",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" has allowBlobPublicAccess set to true — disable public blob access`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+                else if (allowBlobPublicAccess === undefined) {
+                    diagnostics.push({
+                        checkId: "AZR014",
+                        severity: "warning",
+                        message: `Storage account "${resourceName}" does not set allowBlobPublicAccess — explicitly set to false to prevent public access`,
+                        entity: resourceName,
+                        lexicon: "azure",
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};