@intentius/chant-lexicon-azure 0.124.31 → 0.124.33

package/dist/import/parser.js

@@ -0,0 +1,192 @@
+/**
+ * ARM template JSON parser — converts ARM templates to intermediate representation.
+ *
+ * Handles ARM bracket expressions: [resourceId(...)], [reference(...)],
+ * [parameters(...)], [variables(...)], [concat(...)], etc.
+ */
+import { BaseValueParser } from "@intentius/chant/import/base-parser";
+/**
+ * ARM template parser.
+ */
+export class ArmParser extends BaseValueParser {
+    // ARM expresses intrinsics as bracketed string expressions (e.g.
+    // "[resourceId(...)]"), not single-key objects, so there are no object-form
+    // intrinsics to dispatch during value walking.
+    dispatchIntrinsic() {
+        return null;
+    }
+    parse(content) {
+        const template = JSON.parse(content);
+        if (!template.resources || !Array.isArray(template.resources)) {
+            throw new Error("Invalid ARM template: missing resources array");
+        }
+        const parameters = [];
+        const resources = [];
+        // Parse parameters
+        if (template.parameters) {
+            for (const [name, param] of Object.entries(template.parameters)) {
+                const p = param;
+                parameters.push({
+                    name,
+                    type: mapArmParameterType(p.type),
+                    description: p.metadata?.description ?? p.description,
+                    defaultValue: p.defaultValue,
+                });
+            }
+        }
+        // Parse resources
+        for (const resource of template.resources) {
+            const r = resource;
+            const type = r.type;
+            const name = r.name;
+            // Collect all properties including resource-level fields
+            const properties = {};
+            // Resource-level fields
+            for (const field of ["location", "sku", "kind", "identity", "tags", "zones", "plan"]) {
+                if (r[field] !== undefined) {
+                    properties[field] = this.parseValue(r[field]);
+                }
+            }
+            // Nested properties
+            if (r.properties && typeof r.properties === "object") {
+                for (const [key, value] of Object.entries(r.properties)) {
+                    properties[key] = this.parseValue(value);
+                }
+            }
+            // Parse dependsOn
+            const dependsOn = r.dependsOn;
+            const deps = dependsOn?.map((d) => this.extractResourceName(d)) ?? [];
+            resources.push({
+                logicalId: name,
+                type,
+                properties,
+                // ResourceIR has no dedicated dependsOn field — preserve ARM dependencies in metadata.
+                ...(deps.length > 0 && { metadata: { dependsOn: deps } }),
+            });
+        }
+        return {
+            parameters,
+            resources,
+            metadata: {
+                format: "arm",
+                schema: template.$schema,
+                contentVersion: template.contentVersion,
+            },
+        };
+    }
+    /**
+     * Parse a value, handling ARM bracket expressions.
+     */
+    parseValue(value) {
+        if (typeof value === "string") {
+            return this.parseBracketExpression(value);
+        }
+        if (Array.isArray(value)) {
+            return value.map((v) => this.parseValue(v));
+        }
+        if (typeof value === "object" && value !== null) {
+            const result = {};
+            for (const [k, v] of Object.entries(value)) {
+                result[k] = this.parseValue(v);
+            }
+            return result;
+        }
+        return value;
+    }
+    /**
+     * Parse ARM bracket expressions like [resourceId(...)], [reference(...)], etc.
+     */
+    parseBracketExpression(value) {
+        if (!value.startsWith("[") || !value.endsWith("]"))
+            return value;
+        // Escaped bracket
+        if (value.startsWith("[["))
+            return value.slice(1);
+        const expr = value.slice(1, -1);
+        // resourceId(...)
+        const resourceIdMatch = expr.match(/^resourceId\((.+)\)$/);
+        if (resourceIdMatch) {
+            return { __intrinsic: "ResourceId", args: this.parseArgs(resourceIdMatch[1]) };
+        }
+        // reference(...)
+        const referenceMatch = expr.match(/^reference\((.+)\)$/);
+        if (referenceMatch) {
+            return { __intrinsic: "Reference", args: this.parseArgs(referenceMatch[1]) };
+        }
+        // parameters(...)
+        const parametersMatch = expr.match(/^parameters\('([^']+)'\)$/);
+        if (parametersMatch) {
+            return { __intrinsic: "Ref", name: parametersMatch[1] };
+        }
+        // concat(...)
+        const concatMatch = expr.match(/^concat\((.+)\)$/);
+        if (concatMatch) {
+            return { __intrinsic: "Concat", args: this.parseArgs(concatMatch[1]) };
+        }
+        // resourceGroup().location, resourceGroup().name, etc.
+        const rgMatch = expr.match(/^resourceGroup\(\)\.(\w+)$/);
+        if (rgMatch) {
+            return { __intrinsic: "ResourceGroup", property: rgMatch[1] };
+        }
+        // subscription().subscriptionId, etc.
+        const subMatch = expr.match(/^subscription\(\)\.(\w+)$/);
+        if (subMatch) {
+            return { __intrinsic: "Subscription", property: subMatch[1] };
+        }
+        // uniqueString(...)
+        const uniqueMatch = expr.match(/^uniqueString\((.+)\)$/);
+        if (uniqueMatch) {
+            return { __intrinsic: "UniqueString", args: this.parseArgs(uniqueMatch[1]) };
+        }
+        // Return raw expression as-is
+        return value;
+    }
+    /**
+     * Parse comma-separated args from a function call string.
+     */
+    parseArgs(argsStr) {
+        const args = [];
+        let depth = 0;
+        let current = "";
+        for (const char of argsStr) {
+            if (char === "(")
+                depth++;
+            if (char === ")")
+                depth--;
+            if (char === "," && depth === 0) {
+                args.push(current.trim().replace(/^'|'$/g, ""));
+                current = "";
+            }
+            else {
+                current += char;
+            }
+        }
+        if (current.trim()) {
+            args.push(current.trim().replace(/^'|'$/g, ""));
+        }
+        return args;
+    }
+    /**
+     * Extract a resource name from a dependsOn resourceId expression.
+     */
+    extractResourceName(dep) {
+        if (dep.startsWith("[")) {
+            // Try to extract from resourceId expression
+            const match = dep.match(/resourceId\([^,]+,\s*'([^']+)'\)/);
+            if (match)
+                return match[1];
+        }
+        return dep;
+    }
+}
+function mapArmParameterType(type) {
+    switch (type?.toLowerCase()) {
+        case "string": return "String";
+        case "int": return "Number";
+        case "bool": return "String";
+        case "array": return "CommaDelimitedList";
+        case "object": return "String";
+        case "securestring": return "String";
+        default: return "String";
+    }
+}

package/dist/index.js

@@ -0,0 +1,44 @@
+/**
+ * @intentius/chant-lexicon-azure — barrel export
+ *
+ * Azure Resource Manager lexicon for chant.
+ */
+// Typed Op step-builder wrappers (chant #1288 Stage 2) — azApply/azDelete/
+// azGroupEnsure/azGroupDelete/flociAzUp/flociAzDown with authoring-time
+// types derived from this lexicon's own *Args interfaces (see
+// ./op/builders.ts's module doc for why these live here rather than in
+// core). Opt-in: `@intentius/chant/op`'s same-named exports are core's
+// original untyped builders, unchanged.
+export { azApply, azDelete, azGroupEnsure, azGroupDelete, flociAzUp, flociAzDown } from "./op/builders.js";
+// --- Core ---
+export { defaultTags } from "./default-tags.js";
+export { deploymentScope, isDeploymentScope } from "./deploy-scopes.js";
+export { azureSerializer } from "./serializer.js";
+export { azurePlugin } from "./plugin.js";
+export { Parameter } from "./parameter.js";
+// Deep observation (#1086): the `az resource show` reader and the noise
+// rules it shares with core's normalization pass.
+export { observeResourcesDeepAzure, azureDeepNormalizationHooks, AZURE_READ_ONLY_NAMES, AZURE_SERVER_COMPUTED_NAMES, AZURE_SERVICE_DEFAULTS, } from "./deep-observe.js";
+// --- Intrinsics ---
+export { ResourceId, ResourceIdIntrinsic, Reference, ReferenceIntrinsic, Concat, ConcatIntrinsic, ResourceGroup, ResourceGroupIntrinsic, Subscription, SubscriptionIntrinsic, UniqueString, UniqueStringIntrinsic, Format, FormatIntrinsic, If, IfIntrinsic, ListKeys, ListKeysIntrinsic, } from "./intrinsics.js";
+// --- Pseudo-parameters ---
+export { Azure, ResourceGroupName, ResourceGroupLocation, ResourceGroupId, SubscriptionId, TenantId, DeploymentName, } from "./pseudo.js";
+// --- Re-exports from core ---
+export { isChildProject } from "@intentius/chant/child-project";
+export { stackOutput, isStackOutput } from "@intentius/chant/stack-output";
+export { LexiconOutput, output, isLexiconOutput } from "@intentius/chant/lexicon-output";
+// --- Generated resource classes ---
+export * from "./generated/index.js";
+// --- Composites ---
+export { StorageAccountSecure, VnetDefault, VmLinux, AppService, AksCluster, SqlDatabase, KeyVaultSecure, ContainerRegistrySecure, FunctionApp, ServiceBusPipeline, CosmosDatabase, ApplicationGateway, ContainerInstance, RedisCache, PrivateEndpoint, GovernanceFoundation, GovernanceBaseline, LocationRestriction, ActivityLogSink, } from "./composites/index.js";
+// Azure governance authoring: the desired-state config the Azure
+// external governance reconciler applies, and the typed landing-zone authoring layer.
+export { landingZoneConfig, locationRestriction, DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS, ACTIVITY_LOG_TO_LOG_ANALYTICS_DEFINITION_ID, FOUNDATION_MANAGEMENT_GROUPS, } from "./governance.js";
+// --- RBAC role constants ---
+export { StorageRoles, ComputeRoles, NetworkRoles, KeyVaultRoles, SqlRoles, ContainerRoles, AppServiceRoles, IdentityRoles, } from "./actions/index.js";
+// --- Codegen pipeline ---
+export { generate, writeGeneratedFiles } from "./codegen/generate.js";
+export { packageLexicon } from "./codegen/package.js";
+// --- Spec utilities ---
+export { fetchArmSchemas } from "./spec/fetch.js";
+export { parseArmSchema, armShortName, armServiceName } from "./spec/parse.js";

package/dist/integrity.json

@@ -1,13 +1,13 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "75b76ca101cd4281f2e5ef71bf40181bc0ef256800cbe3e985a817d64de8787d",
-    "meta.json": "8c7a1ea3cfaf39461d3e758fa2b0cbd70c7800fac736e56df8d14a3e07ef1840",
-    "types/index.d.ts": "b20aaa3eeb957a6a5833dcbf5fd99ce1365285eafd4b78dc9383371b1a9d4b61",
+    "manifest.json": "75da2d173ccd6370dd6b0574b09ce00ef7c611c3bf83b2bde013ea9d8625b239",
+    "meta.json": "d2521221ed616d882ded4296f0071685bd74e4b645d55dabc9685733c37dc419",
+    "types/index.d.ts": "29631032bda9533849178968290e65d72250eab0b8bab424f2d9ef9b4e8546a4",
     "rules/hardcoded-location.ts": "0b895449c8c94066e81721c46be24249231029fe13b471477456df5c4e45b8bf",
     "rules/nsg-wildcard.ts": "8f9d44833ba364778c05731f84c20f00734bb0d40d9fd0d91645965d18a258ae",
     "rules/storage-https.ts": "d340ba970bd9b35304bd7d288a9e99610a7677e6c56af4846305a98d4df0fbbc",
-    "rules/arm-refs.ts": "913317ef4f61d1a879f0f559bc3dfc00d73020f7c1106d2cb743acad1de4a00d",
+    "rules/arm-refs.ts": "1ff54e29511d5b0572586d64d7c5ca476a13f401f14f89b4d601b01aa6dde891",
     "rules/azr010.ts": "c61da411a3b325d49f2f790030f11aa4d518a671a23ff3d13be5206e2ddfedab",
     "rules/azr011.ts": "81b05ecaaf6e90a8afc692cd203d28eddf6126a3d7d9d4d4955e4aa6f2c7fa4c",
     "rules/azr012.ts": "e59ddbab64c0bddd2d65bd5cb66e976f858d86216825a18837653d14224a321e",
@@ -37,5 +37,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "00374ddfe2e11e4ab5f717b8d65951349635108e28e7d1c6afd177e5f31c1b2e"
+  "composite": "990e7a1acfe3ab9a04d7fb6de37a56774ed9a172cbc590ba4f1d35956d96700c"
 }

package/dist/intrinsics.js

@@ -0,0 +1,179 @@
+/**
+ * ARM template function intrinsics.
+ *
+ * Each intrinsic implements INTRINSIC_MARKER + toJSON() for serialization
+ * to ARM template bracket expressions: "[resourceId(...)]", "[concat(...)]", etc.
+ */
+var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+import { INTRINSIC_MARKER, resolveIntrinsicValue } from "@intentius/chant/intrinsic";
+/**
+ * resourceId(resourceType, name1, name2, ...) — returns a resource ID string.
+ */
+export class ResourceIdIntrinsic {
+    constructor(resourceType, ...names) {
+        this[_a] = true;
+        this.resourceType = resourceType;
+        this.names = names;
+    }
+    toJSON() {
+        const args = [
+            `'${this.resourceType}'`,
+            ...this.names.map((n) => serializeArg(n)),
+        ].join(", ");
+        return `[resourceId(${args})]`;
+    }
+}
+_a = INTRINSIC_MARKER;
+export function ResourceId(resourceType, ...names) {
+    return new ResourceIdIntrinsic(resourceType, ...names);
+}
+/**
+ * reference(name, apiVersion?) — returns the runtime state of a resource.
+ */
+export class ReferenceIntrinsic {
+    constructor(name, apiVersion) {
+        this[_b] = true;
+        this.name = name;
+        this.apiVersion = apiVersion;
+    }
+    toJSON() {
+        if (this.apiVersion) {
+            return `[reference('${this.name}', '${this.apiVersion}')]`;
+        }
+        return `[reference('${this.name}')]`;
+    }
+}
+_b = INTRINSIC_MARKER;
+export function Reference(name, apiVersion) {
+    return new ReferenceIntrinsic(name, apiVersion);
+}
+/**
+ * concat(value1, value2, ...) — concatenates strings.
+ */
+export class ConcatIntrinsic {
+    constructor(...values) {
+        this[_c] = true;
+        this.values = values;
+    }
+    toJSON() {
+        const args = this.values.map((v) => serializeArg(v)).join(", ");
+        return `[concat(${args})]`;
+    }
+}
+_c = INTRINSIC_MARKER;
+export function Concat(...values) {
+    return new ConcatIntrinsic(...values);
+}
+/**
+ * resourceGroup() — returns the current resource group object.
+ */
+export class ResourceGroupIntrinsic {
+    constructor() {
+        this[_d] = true;
+    }
+    toJSON() {
+        return "[resourceGroup()]";
+    }
+}
+_d = INTRINSIC_MARKER;
+export function ResourceGroup() {
+    return new ResourceGroupIntrinsic();
+}
+/**
+ * subscription() — returns the current subscription object.
+ */
+export class SubscriptionIntrinsic {
+    constructor() {
+        this[_e] = true;
+    }
+    toJSON() {
+        return "[subscription()]";
+    }
+}
+_e = INTRINSIC_MARKER;
+export function Subscription() {
+    return new SubscriptionIntrinsic();
+}
+/**
+ * uniqueString(value1, ...) — generates a deterministic hash string.
+ */
+export class UniqueStringIntrinsic {
+    constructor(...values) {
+        this[_f] = true;
+        this.values = values;
+    }
+    toJSON() {
+        const args = this.values.map((v) => serializeArg(v)).join(", ");
+        return `[uniqueString(${args})]`;
+    }
+}
+_f = INTRINSIC_MARKER;
+export function UniqueString(...values) {
+    return new UniqueStringIntrinsic(...values);
+}
+/**
+ * format(formatString, arg1, arg2, ...) — formats a string.
+ */
+export class FormatIntrinsic {
+    constructor(fmt, ...args) {
+        this[_g] = true;
+        this.fmt = fmt;
+        this.args = args;
+    }
+    toJSON() {
+        const allArgs = [`'${this.fmt}'`, ...this.args.map((a) => serializeArg(a))].join(", ");
+        return `[format(${allArgs})]`;
+    }
+}
+_g = INTRINSIC_MARKER;
+export function Format(fmt, ...args) {
+    return new FormatIntrinsic(fmt, ...args);
+}
+/**
+ * if(condition, trueValue, falseValue) — conditional expression.
+ */
+export class IfIntrinsic {
+    constructor(condition, trueValue, falseValue) {
+        this[_h] = true;
+        this.condition = condition;
+        this.trueValue = trueValue;
+        this.falseValue = falseValue;
+    }
+    toJSON() {
+        return `[if('${this.condition}', ${serializeArg(this.trueValue)}, ${serializeArg(this.falseValue)})]`;
+    }
+}
+_h = INTRINSIC_MARKER;
+export function If(condition, trueValue, falseValue) {
+    return new IfIntrinsic(condition, trueValue, falseValue);
+}
+/**
+ * listKeys(resourceId, apiVersion) — lists access keys for a resource.
+ */
+export class ListKeysIntrinsic {
+    constructor(resourceId, apiVersion) {
+        this[_j] = true;
+        this.resourceId = resourceId;
+        this.apiVersion = apiVersion;
+    }
+    toJSON() {
+        return `[listKeys(${serializeArg(this.resourceId)}, '${this.apiVersion}')]`;
+    }
+}
+_j = INTRINSIC_MARKER;
+export function ListKeys(resourceId, apiVersion) {
+    return new ListKeysIntrinsic(resourceId, apiVersion);
+}
+// --- Helpers ---
+function serializeArg(value) {
+    if (typeof value === "string")
+        return `'${value}'`;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    const resolved = resolveIntrinsicValue(value);
+    if (typeof resolved === "string" && resolved.startsWith("[") && resolved.endsWith("]")) {
+        // Nested ARM expression — strip outer brackets
+        return resolved.slice(1, -1);
+    }
+    return JSON.stringify(resolved);
+}

package/dist/lint/audit-catalog.js

@@ -0,0 +1,36 @@
+/**
+ * The azure lexicon's `chant audit` catalog — metadata for the AZR* ARM
+ * post-synth rules. Contributed via `azurePlugin.auditCatalog()` (#687).
+ */
+import { auditRule, applyLineage } from "@intentius/chant/audit/catalog";
+import { azureAuditLineage } from "./audit-lineage.js";
+const AZ_SEC = { name: "Microsoft Cloud Security Benchmark", url: "https://learn.microsoft.com/en-us/security/benchmark/azure/" };
+export const azureAuditCatalog = {
+    AZR010: auditRule("AZR010", "report-only", "guidance", "Redundant dependsOn", "Remove dependsOn already implied by reference()/resourceId().", { category: "best-practice" }),
+    AZR011: auditRule("AZR011", "merge-worthy", "guidance", "Missing or invalid apiVersion", "Set a valid YYYY-MM-DD apiVersion on every resource.", { category: "correctness" }),
+    AZR012: auditRule("AZR012", "report-only", "guidance", "Deprecated API version", "Move to a current apiVersion.", { category: "best-practice" }),
+    AZR013: auditRule("AZR013", "merge-worthy", "guidance", "Resource missing location", "Add the required location property.", { category: "correctness" }),
+    AZR014: auditRule("AZR014", "merge-worthy", "guidance", "Storage account allows public blob access", "Set allowBlobPublicAccess to false.", { authority: [AZ_SEC] }),
+    AZR015: auditRule("AZR015", "merge-worthy", "guidance", "Storage account missing encryption", "Enable encryption services for data at rest.", { authority: [AZ_SEC] }),
+    AZR016: auditRule("AZR016", "report-only", "guidance", "Key Vault soft-delete not enabled", "Enable soft-delete.", { category: "best-practice" }),
+    AZR017: auditRule("AZR017", "report-only", "guidance", "Key Vault purge protection not enabled", "Enable purge protection.", { category: "best-practice" }),
+    AZR018: auditRule("AZR018", "report-only", "guidance", "SQL Server missing auditing", "Enable auditing for compliance and threat detection.", { category: "best-practice" }),
+    AZR019: auditRule("AZR019", "merge-worthy", "guidance", "SQL database missing TDE", "Enable Transparent Data Encryption.", { authority: [AZ_SEC] }),
+    AZR020: auditRule("AZR020", "report-only", "guidance", "App Service missing managed identity", "Enable a system- or user-assigned identity.", { category: "best-practice" }),
+    AZR021: auditRule("AZR021", "merge-worthy", "guidance", "App Service not HTTPS-only", "Set httpsOnly to true.", { authority: [AZ_SEC] }),
+    AZR022: auditRule("AZR022", "merge-worthy", "guidance", "App Service min TLS below 1.2", "Set minTlsVersion to 1.2+.", { authority: [AZ_SEC] }),
+    AZR023: auditRule("AZR023", "report-only", "guidance", "VM not using a managed disk", "Use a managed disk.", { category: "best-practice" }),
+    AZR024: auditRule("AZR024", "report-only", "guidance", "VM missing boot diagnostics", "Enable boot diagnostics.", { category: "best-practice" }),
+    AZR025: auditRule("AZR025", "report-only", "guidance", "AKS cluster missing RBAC", "Enable Kubernetes RBAC.", { category: "best-practice" }),
+    AZR026: auditRule("AZR026", "report-only", "guidance", "AKS cluster missing network policy", "Configure a networkPolicy.", { category: "best-practice" }),
+    AZR027: auditRule("AZR027", "merge-worthy", "guidance", "Container Registry admin user enabled", "Disable the admin user; use Azure AD / service principals.", { authority: [AZ_SEC] }),
+    AZR028: auditRule("AZR028", "report-only", "guidance", "Network interface missing NSG", "Associate an NSG to control traffic.", { category: "best-practice" }),
+    AZR029: auditRule("AZR029", "merge-worthy", "guidance", "Managed disk missing encryption", "Enable encryption for data at rest.", { authority: [AZ_SEC] }),
+    AZR030: auditRule("AZR030", "merge-worthy", "guidance", "Resource at unsupported template scope", "Move the resource to a project deployed at a scope its schema supports.", { category: "correctness" }),
+    // governance posture regressions.
+    AZR031: auditRule("AZR031", "merge-worthy", "guidance", "Policy assignment not enforced (DoNotEnforce)", "Set enforcementMode to Default so the assigned guardrail applies.", { authority: [AZ_SEC] }),
+    AZR032: auditRule("AZR032", "merge-worthy", "guidance", "Custom policy definition assigned nowhere", "Pair the policy definition with a policy assignment — unassigned it enforces nothing.", { authority: [AZ_SEC] }),
+    AZR033: auditRule("AZR033", "merge-worthy", "guidance", "Subscriptions may leave the tenant", "Set blockSubscriptionsLeavingTenant: true on the Microsoft.Subscription/policies resource.", { authority: [AZ_SEC] }),
+};
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(azureAuditCatalog, azureAuditLineage);

package/dist/lint/audit-lineage.js

@@ -0,0 +1,71 @@
+export const azureAuditLineage = {
+    AZR010: [
+        { tool: "bicep-linter", rule: "no-unnecessary-dependson", url: "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter-rule-no-unnecessary-dependson", relation: "equivalent" },
+    ],
+    AZR011: [
+        { tool: "arm-ttk", rule: "apiVersions-Should-Be-Recent", url: "https://github.com/Azure/arm-ttk/blob/master/arm-ttk/testcases/deploymentTemplate/apiVersions-Should-Be-Recent.test.ps1", relation: "overlaps" },
+    ],
+    AZR012: [
+        { tool: "arm-ttk", rule: "apiVersions-Should-Be-Recent", url: "https://github.com/Azure/arm-ttk/blob/master/arm-ttk/testcases/deploymentTemplate/apiVersions-Should-Be-Recent.test.ps1", relation: "overlaps" },
+        { tool: "bicep-linter", rule: "use-recent-api-versions", url: "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter-rule-use-recent-api-versions", relation: "overlaps" },
+    ],
+    AZR014: [
+        { tool: "psrule-azure", rule: "Azure.Storage.BlobPublicAccess", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Storage.BlobPublicAccess/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_59", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+    ],
+    AZR016: [
+        { tool: "psrule-azure", rule: "Azure.KeyVault.SoftDelete", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.SoftDelete/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_111", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Key Vault Not Recoverable", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/7c25f361-7c66-44bf-9b69-022acd5eb4bd/", relation: "overlaps" },
+    ],
+    AZR017: [
+        { tool: "psrule-azure", rule: "Azure.KeyVault.PurgeProtect", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.KeyVault.PurgeProtect/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_110", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Key Vault Not Recoverable", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/7c25f361-7c66-44bf-9b69-022acd5eb4bd/", relation: "overlaps" },
+    ],
+    AZR018: [
+        { tool: "psrule-azure", rule: "Azure.SQL.Auditing", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.SQL.Auditing/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_23", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "SQL Server Database Without Auditing", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/e055285c-bc01-48b4-8aa5-8a54acdd29df/", relation: "equivalent" },
+    ],
+    AZR019: [
+        { tool: "psrule-azure", rule: "Azure.SQL.TDE", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.SQL.TDE/", relation: "equivalent" },
+    ],
+    AZR020: [
+        { tool: "psrule-azure", rule: "Azure.AppService.ManagedIdentity", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.ManagedIdentity/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_71", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+    ],
+    AZR021: [
+        { tool: "psrule-azure", rule: "Azure.AppService.UseHTTPS", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.UseHTTPS/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_14", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Website Not Forcing HTTPS", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/488847ff-6031-487c-bf42-98fd6ac5c9a0/", relation: "equivalent" },
+    ],
+    AZR022: [
+        { tool: "psrule-azure", rule: "Azure.AppService.MinTLS", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AppService.MinTLS/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_15", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Web App Not Using TLS Last Version", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/b5c851d5-00f1-43dc-a8de-3218fd6f71be/", relation: "equivalent" },
+    ],
+    AZR023: [
+        { tool: "psrule-azure", rule: "Azure.VM.UseManagedDisks", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.VM.UseManagedDisks/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_92", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+    ],
+    AZR025: [
+        { tool: "psrule-azure", rule: "Azure.AKS.UseRBAC", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.UseRBAC/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_5", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "AKS Cluster RBAC Disabled", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/9307a2ed-35c2-413d-94de-a1a0682c2158/", relation: "equivalent" },
+    ],
+    AZR026: [
+        { tool: "psrule-azure", rule: "Azure.AKS.NetworkPolicy", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.NetworkPolicy/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_7", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "AKS Cluster Network Policy Not Configured", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/25c0228e-4444-459b-a2df-93c7df40b7ed/", relation: "equivalent" },
+    ],
+    AZR027: [
+        { tool: "psrule-azure", rule: "Azure.ACR.AdminUser", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ACR.AdminUser/", relation: "equivalent" },
+        { tool: "checkov", rule: "CKV_AZURE_137", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+    ],
+    AZR029: [
+        { tool: "checkov", rule: "CKV_AZURE_2", url: "https://www.checkov.io/5.Policy%20Index/arm.html", relation: "equivalent" },
+        { tool: "kics", rule: "Azure Managed Disk Without Encryption", url: "https://docs.kics.io/latest/queries/azureresourcemanager-queries/azure/350f3955-b5be-436f-afaa-3d2be2fa6cdd/", relation: "equivalent" },
+        { tool: "psrule-azure", rule: "Azure.VM.ADE", url: "https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.VM.ADE/", relation: "overlaps" },
+    ],
+};

package/dist/lint/post-synth/arm-refs.d.ts

@@ -55,6 +55,7 @@ export declare function isBracketExpression(value: unknown): boolean;
  *
  * Handles:
  * - [resourceId('Type', 'name')]  -> extracts 'name'
+ * - [resourceId('Type', 'a', 'b')] -> extracts 'a/b'
  * - [reference('name')]           -> extracts 'name'
  * - [reference('name').prop]      -> extracts 'name'
  */

package/dist/lint/post-synth/arm-refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"arm-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/arm-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,GAAG,IAAI,CAWzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBhE"}
+{"version":3,"file":"arm-refs.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/arm-refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,GAAG,IAAI,CAWzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBhE"}