{"resources":{"bicep":{"id":"bicep","name":"bicep","fields":{"expression":{"name":"expression","type":"\u001bbicep.expression","title":"Parsed Bicep expression","desc":"Examine the structure of a single Bicep value expression broken into a queryable tree. The `kind` field classifies the node — `literal`, `functionCall`, `propertyAccess`, `symbolicRef`, `interpolation`, `ternary`, `array`, or `unknown` — and `raw` always holds the original source text. For a `functionCall`, `functionName` names the called function (`resourceId`, `concat`, `reference`, …) and `args` lists its parsed arguments. For a `propertyAccess` or `symbolicRef`, `target` is the root identifier and `path` is the accessor chain (for example `vnet.properties.subnets[0].id` yields target `vnet` and path `[\"properties\",\"subnets\",\"0\",\"id\"]`). For an `interpolation`, `segments` holds the alternating literal and embedded-expression parts of a `'...${expr}...'` string. This is structure only — values are never evaluated — so policies can ask questions like \"is this location a hardcoded literal?\" or \"does this name interpolate a parameter?\" without resolving the deployment.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"file":{"name":"file","type":"\u001bbicep.file","title":"Bicep source file","desc":"Examine a single .bicep file: its target scope (resourceGroup, subscription, managementGroup, tenant), declared parameters / variables / resources / modules / outputs, and the raw file content for pattern matching that the typed views can't express.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"files":{"name":"files","type":"\u0019\u001bbicep.file","title":"All Bicep source files found","provider":"go.mondoo.com/mql/v13/providers/bicep"},"function":{"name":"function","type":"\u001bbicep.function","title":"Bicep user-defined function declaration","desc":"Examine a `func name(p1 t1, p2 t2) returnType =\u003e expression` declaration: the function name, its parameters as a name-to-type map, the declared return type, the raw body expression after `=\u003e`, the `@description` text, and the full raw decorator list. Select a function by its `name` — for example `bicep.file.functions.where(name == \"buildName\")` — and read `parameters[\"prefix\"]` to get a parameter's type.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"import":{"name":"import","type":"\u001bbicep.import","title":"Bicep import statement","desc":"Examine an `import` statement in any of its forms: named imports (`import { typeA, funcB } from './shared.bicep'`), a wildcard namespace import (`import * as shared from './shared.bicep'`), or a bare provider import (`import 'az@2.0.0'`). The `source` field holds the `from` target or the bare provider string; `symbols` lists the named imports inside `{ }`; `namespace` holds the alias for a `* as \u003cns\u003e` import and `wildcard` flags that form. Select an import by its `source` — for example `bicep.file.imports.where(source == \"az@2.0.0\")`.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"module":{"name":"module","type":"\u001bbicep.module","title":"Bicep module reference","desc":"Examine a `module` declaration: symbolic name, source path or registry reference (br: / ts: flags break the source out by kind), scope, the parameter values passed in, conditional-deployment expression, description and decorators — the unit of cross-file Bicep composition.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"output":{"name":"output","type":"\u001bbicep.output","title":"Bicep output declaration","desc":"Examine an `output` statement: name, type, value expression, and @description — useful for spotting outputs that leak secrets or expose resource IDs unintentionally.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"paramFile":{"name":"paramFile","type":"\u001bbicep.paramFile","title":"Bicep parameter file","desc":"Examine a `.bicepparam` parameter file — the file that carries the actual parameter values used for a deployment. The `using` field names the template the values target (`'./main.bicep'`, `'none'`, or a registry/template-spec ref like `'br:...'`); `params` maps each `param \u003cname\u003e = \u003cvalue\u003e` assignment to its right-hand-side value text. Select a file by its `path` — for example `bicep.paramFiles.where(path == \"prod.bicepparam\")`.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"paramFiles":{"name":"paramFiles","type":"\u0019\u001bbicep.paramFile","title":"All Bicep parameter (.bicepparam) files found","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"parameter":{"name":"parameter","type":"\u001bbicep.parameter","title":"Bicep parameter declaration","desc":"Examine the name, type, default value, @description, @secure flag, @allowed values, and the full raw decorator list — used to flag missing @secure on credential-shaped parameters or unbounded @allowed sets.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"propertyExpression":{"name":"propertyExpression","type":"\u001bbicep.propertyExpression","title":"Scalar leaf inside a resource's properties or a module's params","desc":"Examine a single value buried inside a resource's `properties` object or a module's `params` object, flattened out of the nested dict so it can be queried directly. The `path` field is the dotted/indexed location of the value within the object — for example `encryption.keyVaultProperties.keyName` or `ipRules[0].action` — and `expression` is the parsed expression tree of the value at that path, carrying full symbol resolution (`referenceKind`, `referencedParameter`, …). Emitted by `bicep.resource.propertyExpressions` and `bicep.module.paramExpressions`, one per scalar leaf, in a stable order (map keys sorted, array indices preserved). See `bicep.expression`.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"resource":{"name":"resource","type":"\u001bbicep.resource","title":"Bicep resource declaration","desc":"Examine the symbolic name, Azure resource type and apiVersion, the resolved name and location expressions, the full properties body, the existing-resource flag, conditional-deployment expression, parent / dependsOn relationships, and decorators — the surface IaC policies match against to enforce Azure resource-shape rules.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"template":{"name":"template","type":"\u001bbicep.template","title":"Compiled ARM template (if available via JSON or bicep build)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"type":{"name":"type","type":"\u001bbicep.type","title":"Bicep user-defined type declaration","desc":"Examine a `type Name = \u003cdefinition\u003e` declaration: the type name, the raw right-hand-side definition text (a union like `'Standard_LRS' | 'Premium_LRS'`, an object type like `{ name: string, tier: sku }`, or a reference to another type), the `@description` text, whether the type is `@export()`ed for reuse from other files, and the full raw decorator list. Select a type by its `name` — for example `bicep.file.types.where(name == \"sku\")`.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"variable":{"name":"variable","type":"\u001bbicep.variable","title":"Bicep variable declaration","desc":"Examine the variable name, the raw value expression, and any @description decorator — useful for tracking how derived values flow into resource bodies.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true}},"title":"Bicep / ARM template","desc":"Top-level entry point for analyzing Azure Bicep source or compiled ARM JSON. Exposes the Bicep source files (parameters, variables, resources, modules, outputs) and, when available, the compiled ARM template — the surface for IaC policy checks of Azure infrastructure-as-code without deploying it.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.expression":{"id":"bicep.expression","name":"bicep.expression","fields":{"args":{"name":"args","type":"\u0019\u001bbicep.expression","title":"Parsed arguments of a functionCall node","provider":"go.mondoo.com/mql/v13/providers/bicep"},"functionName":{"name":"functionName","type":"\u0007","is_mandatory":true,"title":"Called function name for a functionCall node (empty otherwise)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Node kind","desc":"One of literal, functionCall, propertyAccess, symbolicRef, interpolation, ternary, array, or unknown.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"path":{"name":"path","type":"\u0019\u0007","is_mandatory":true,"title":"Accessor chain of a propertyAccess node","desc":"For example `vnet.properties.subnets[0].id` produces `[\"properties\",\"subnets\",\"0\",\"id\"]`. Empty for other kinds.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"raw":{"name":"raw","type":"\u0007","is_mandatory":true,"title":"Original source text of the expression","provider":"go.mondoo.com/mql/v13/providers/bicep"},"referenceKind":{"name":"referenceKind","type":"\u0007","title":"Declaration category the root identifier resolves to","desc":"One of parameter, variable, resource, module, or type — the kind of same-file declaration that `target` names — or empty when `target` is empty or doesn't match a declaration in the owning file (a built-in like `resourceGroup`, or a symbol brought in by `import`). Resolution is file-scoped; cross-file import resolution is handled elsewhere.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"referencedModule":{"name":"referencedModule","type":"\u001bbicep.module","title":"Module the root identifier resolves to, or null","desc":"Non-null only when `referenceKind` is module; the other referenced*() accessors are null in that case.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"referencedParameter":{"name":"referencedParameter","type":"\u001bbicep.parameter","title":"Parameter the root identifier resolves to, or null","desc":"Non-null only when `referenceKind` is parameter; the other referenced*() accessors are null in that case. Resolves the root identifier `target` (for example `myParam` in `'${myParam}'`) to the same-file `bicep.parameter` it names.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"referencedResource":{"name":"referencedResource","type":"\u001bbicep.resource","title":"Resource the root identifier resolves to, or null","desc":"Non-null only when `referenceKind` is resource; the other referenced*() accessors are null in that case. For a `propertyAccess` like `vnet.properties.subnets[0].id` the root identifier `vnet` resolves here, not the whole accessor chain.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"referencedType":{"name":"referencedType","type":"\u001bbicep.type","title":"User-defined type the root identifier resolves to, or null","desc":"Non-null only when `referenceKind` is type; the other referenced*() accessors are null in that case.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"referencedVariable":{"name":"referencedVariable","type":"\u001bbicep.variable","title":"Variable the root identifier resolves to, or null","desc":"Non-null only when `referenceKind` is variable; the other referenced*() accessors are null in that case.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"segments":{"name":"segments","type":"\u0019\u001bbicep.expression","title":"Alternating literal and embedded-expression parts of an interpolation node","provider":"go.mondoo.com/mql/v13/providers/bicep"},"target":{"name":"target","type":"\u0007","is_mandatory":true,"title":"Root identifier of a propertyAccess or symbolicRef node (empty otherwise)","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Parsed Bicep expression","desc":"Examine the structure of a single Bicep value expression broken into a queryable tree. The `kind` field classifies the node — `literal`, `functionCall`, `propertyAccess`, `symbolicRef`, `interpolation`, `ternary`, `array`, or `unknown` — and `raw` always holds the original source text. For a `functionCall`, `functionName` names the called function (`resourceId`, `concat`, `reference`, …) and `args` lists its parsed arguments. For a `propertyAccess` or `symbolicRef`, `target` is the root identifier and `path` is the accessor chain (for example `vnet.properties.subnets[0].id` yields target `vnet` and path `[\"properties\",\"subnets\",\"0\",\"id\"]`). For an `interpolation`, `segments` holds the alternating literal and embedded-expression parts of a `'...${expr}...'` string. This is structure only — values are never evaluated — so policies can ask questions like \"is this location a hardcoded literal?\" or \"does this name interpolate a parameter?\" without resolving the deployment.","min_provider_version":"13.1.2","defaults":"kind raw","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.file":{"id":"bicep.file","name":"bicep.file","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Raw file content","provider":"go.mondoo.com/mql/v13/providers/bicep"},"functions":{"name":"functions","type":"\u0019\u001bbicep.function","title":"User-defined function declarations","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"imports":{"name":"imports","type":"\u0019\u001bbicep.import","title":"Import statements","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"File-level metadata","desc":"Key/value pairs from `metadata \u003cname\u003e = '\u003cvalue\u003e'` statements. Only entries whose value is a literal single-quoted string are captured — expression- or object-valued metadata is skipped, the same way `bicep.resource.tags` skips expression-valued tags. Most real-world metadata is `description = '...'`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"modules":{"name":"modules","type":"\u0019\u001bbicep.module","title":"Module references","provider":"go.mondoo.com/mql/v13/providers/bicep"},"outputs":{"name":"outputs","type":"\u0019\u001bbicep.output","title":"Output declarations","provider":"go.mondoo.com/mql/v13/providers/bicep"},"parameters":{"name":"parameters","type":"\u0019\u001bbicep.parameter","title":"Parameter declarations","provider":"go.mondoo.com/mql/v13/providers/bicep"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"File path","provider":"go.mondoo.com/mql/v13/providers/bicep"},"resources":{"name":"resources","type":"\u0019\u001bbicep.resource","title":"Resource declarations","provider":"go.mondoo.com/mql/v13/providers/bicep"},"targetScope":{"name":"targetScope","type":"\u0007","is_mandatory":true,"title":"Target scope (resourceGroup, subscription, managementGroup, tenant)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"types":{"name":"types","type":"\u0019\u001bbicep.type","title":"User-defined type declarations","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"variables":{"name":"variables","type":"\u0019\u001bbicep.variable","title":"Variable declarations","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep source file","desc":"Examine a single .bicep file: its target scope (resourceGroup, subscription, managementGroup, tenant), declared parameters / variables / resources / modules / outputs, and the raw file content for pattern matching that the typed views can't express.","min_provider_version":"13.0.0","defaults":"path","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.function":{"id":"bicep.function","name":"bicep.function","fields":{"decorators":{"name":"decorators","type":"\u0019\u0007","is_mandatory":true,"title":"All decorators as raw strings","provider":"go.mondoo.com/mql/v13/providers/bicep"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description from @description decorator","provider":"go.mondoo.com/mql/v13/providers/bicep"},"expression":{"name":"expression","type":"\u0007","is_mandatory":true,"title":"Raw text of the `=\u003e ...` body expression","provider":"go.mondoo.com/mql/v13/providers/bicep"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Function name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"parameters":{"name":"parameters","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Parameters as a name-to-type map","provider":"go.mondoo.com/mql/v13/providers/bicep"},"returnType":{"name":"returnType","type":"\u0007","is_mandatory":true,"title":"Declared return type","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep user-defined function declaration","desc":"Examine a `func name(p1 t1, p2 t2) returnType =\u003e expression` declaration: the function name, its parameters as a name-to-type map, the declared return type, the raw body expression after `=\u003e`, the `@description` text, and the full raw decorator list. Select a function by its `name` — for example `bicep.file.functions.where(name == \"buildName\")` — and read `parameters[\"prefix\"]` to get a parameter's type.","min_provider_version":"13.1.2","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.import":{"id":"bicep.import","name":"bicep.import","fields":{"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Alias for a `* as \u003cns\u003e` import","desc":"Empty for named imports and bare provider imports.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"resolvedFunctions":{"name":"resolvedFunctions","type":"\u0019\u001bbicep.function","title":"User-defined functions this import brings in from the target file","desc":"For a named import (`import { buildName } from './shared.bicep'`) this is the subset of the target file's functions whose name appears in `symbols`. For a wildcard import (`import * as shared from './shared.bicep'`) it is all of the target file's functions. Empty when there is no resolvable target file.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"resolvedTypes":{"name":"resolvedTypes","type":"\u0019\u001bbicep.type","title":"User-defined types this import brings in from the target file","desc":"For a named import (`import { sku } from './shared.bicep'`) this is the subset of the target file's types whose name appears in `symbols`. For a wildcard import (`import * as shared from './shared.bicep'`) it is all of the target file's types. Empty when there is no resolvable target file.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Import source: the `from` target or the bare provider string","provider":"go.mondoo.com/mql/v13/providers/bicep"},"symbols":{"name":"symbols","type":"\u0019\u0007","is_mandatory":true,"title":"Named imports inside `{ }`","desc":"Empty for wildcard namespace imports and bare provider imports.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"targetFile":{"name":"targetFile","type":"\u001bbicep.file","title":"Local Bicep file this import pulls from","desc":"Resolves a relative `source` (for example `./shared.bicep`) against the directory of the file that declared the import and returns the matching Bicep file the scan already discovered, so you can traverse into its types, functions, and other declarations. Only scan-discovered files resolve; a bare provider import (for example `az@2.0.0`), a path that resolves outside the scanned root, or any otherwise unresolvable path returns null — the resolved path is never read directly from disk.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"wildcard":{"name":"wildcard","type":"\u0004","is_mandatory":true,"title":"Whether this is a `* as ns` wildcard import","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep import statement","desc":"Examine an `import` statement in any of its forms: named imports (`import { typeA, funcB } from './shared.bicep'`), a wildcard namespace import (`import * as shared from './shared.bicep'`), or a bare provider import (`import 'az@2.0.0'`). The `source` field holds the `from` target or the bare provider string; `symbols` lists the named imports inside `{ }`; `namespace` holds the alias for a `* as \u003cns\u003e` import and `wildcard` flags that form. Select an import by its `source` — for example `bicep.file.imports.where(source == \"az@2.0.0\")`.","min_provider_version":"13.1.2","defaults":"source","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.module":{"id":"bicep.module","name":"bicep.module","fields":{"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"title":"Condition expression","provider":"go.mondoo.com/mql/v13/providers/bicep"},"conditionTree":{"name":"conditionTree","type":"\u001bbicep.expression","title":"Parsed condition expression tree","desc":"Structured, queryable view of the module's `= if (\u003ccond\u003e)` deployment condition. Use it to ask which symbol or parameter gates the module (`symbolicRef` / `propertyAccess`) or which function evaluates it (`functionCall`). An unconditional module yields an `unknown` node with empty `raw`. See `bicep.expression`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"decorators":{"name":"decorators","type":"\u0019\u0007","is_mandatory":true,"title":"All decorators as raw strings","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/v13/providers/bicep"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description from @description decorator","min_provider_version":"13.0.1","provider":"go.mondoo.com/mql/v13/providers/bicep"},"isLoop":{"name":"isLoop","type":"\u0004","is_mandatory":true,"title":"Whether the module is deployed with a `for` loop","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"isRegistry":{"name":"isRegistry","type":"\u0004","is_mandatory":true,"title":"Whether this references a Bicep registry (br:)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"isTemplateSpec":{"name":"isTemplateSpec","type":"\u0004","is_mandatory":true,"title":"Whether this references a template spec (ts:)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopExpression":{"name":"loopExpression","type":"\u0007","is_mandatory":true,"title":"Raw collection expression the loop iterates (empty when not a loop)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopIndexVar":{"name":"loopIndexVar","type":"\u0007","is_mandatory":true,"title":"Loop index variable in the `(item, index)` form (empty otherwise)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopIterator":{"name":"loopIterator","type":"\u0007","is_mandatory":true,"title":"Loop item iteration variable (empty when not a loop)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Symbolic name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"paramExpressions":{"name":"paramExpressions","type":"\u0019\u001bbicep.propertyExpression","title":"Flattened expression trees of every scalar param leaf","desc":"Walks the `params` object passed to the module and emits one entry per scalar leaf, each carrying the dotted/indexed `path` to the value and a parsed `expression` tree with full symbol resolution. Use it to ask which arguments a module is fed — whether a param value hardcodes a literal, forwards a `@secure` parameter, references another resource, or calls a Bicep function — without manually digging through the nested `params` dict. Nested objects and arrays are descended into rather than emitted; every leaf (string, number, or boolean) becomes one entry. See `bicep.propertyExpression`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"params":{"name":"params","type":"\n","is_mandatory":true,"title":"Parameter values as dict","provider":"go.mondoo.com/mql/v13/providers/bicep"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope expression","provider":"go.mondoo.com/mql/v13/providers/bicep"},"scopeTree":{"name":"scopeTree","type":"\u001bbicep.expression","title":"Parsed scope expression tree","desc":"Structured, queryable view of the `scope` value. Use it to ask which function or symbol sets the module deployment scope — e.g. `resourceGroup('rg-name')` or `subscription()` (`functionCall`) or a referenced resource (`symbolicRef` / `propertyAccess`). See `bicep.expression`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Module source path or registry reference","provider":"go.mondoo.com/mql/v13/providers/bicep"},"target":{"name":"target","type":"\u001bbicep.file","title":"Target Bicep file this module references","desc":"Resolves a local module `source` (a relative path like `./modules/x.bicep` or `../shared/y.bicep`) to the `bicep.file` it points at, computed against the owning file's directory, so you can traverse into the module's `resources`, `parameters`, and `outputs`. Only files already discovered by the scan are resolved, and the same cached `bicep.file` is returned. A reference to a path outside the scanned root, a registry (`br:`) or template-spec (`ts:`) source, or any path that can't be resolved returns null.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep module reference","desc":"Examine a `module` declaration: symbolic name, source path or registry reference (br: / ts: flags break the source out by kind), scope, the parameter values passed in, conditional-deployment expression, description and decorators — the unit of cross-file Bicep composition.","min_provider_version":"13.0.0","defaults":"name source","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.output":{"id":"bicep.output","name":"bicep.output","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description from @description decorator","provider":"go.mondoo.com/mql/v13/providers/bicep"},"expression":{"name":"expression","type":"\u0007","is_mandatory":true,"title":"Value expression","provider":"go.mondoo.com/mql/v13/providers/bicep"},"expressionTree":{"name":"expressionTree","type":"\u001bbicep.expression","title":"Parsed expression tree","desc":"Structured, queryable view of the `expression` value. Use it to spot outputs that return a hardcoded literal, that call a specific Bicep function (`functionCall`), or that reference a resource property or a `@secure` parameter (`symbolicRef` / `propertyAccess` / `interpolation`). See `bicep.expression`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"isLoop":{"name":"isLoop","type":"\u0004","is_mandatory":true,"title":"Whether the value is built with a `for` loop","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopExpression":{"name":"loopExpression","type":"\u0007","is_mandatory":true,"title":"Raw collection expression the loop iterates (empty when not a loop)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopIndexVar":{"name":"loopIndexVar","type":"\u0007","is_mandatory":true,"title":"Loop index variable in the `(item, index)` form (empty otherwise)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopIterator":{"name":"loopIterator","type":"\u0007","is_mandatory":true,"title":"Loop item iteration variable (empty when not a loop)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Output name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"resolvedType":{"name":"resolvedType","type":"\u001bbicep.type","title":"User-defined type the `type` names, or null","desc":"Non-null only when `type` names a `bicep.type` declared in the same file. Null for a built-in type (`string`, `int`, `bool`, `object`, `array`, `secureString`, `secureObject`) or any name that doesn't match a same-file type declaration.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Output type","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep output declaration","desc":"Examine an `output` statement: name, type, value expression, and @description — useful for spotting outputs that leak secrets or expose resource IDs unintentionally.","min_provider_version":"13.0.0","defaults":"name type","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.paramFile":{"id":"bicep.paramFile","name":"bicep.paramFile","fields":{"content":{"name":"content","type":"\u0007","is_mandatory":true,"title":"Raw file content","provider":"go.mondoo.com/mql/v13/providers/bicep"},"params":{"name":"params","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Parameter assignments as a name-to-value map","desc":"Maps each `param \u003cname\u003e = \u003cvalue\u003e` to its right-hand-side value text, stored EXACTLY as written and NOT quote-stripped: a literal stays quoted (`'Standard_LRS'`) while an expression stays bare (`resourceGroup().location`, `readEnvironmentVariable('ADMIN_PW')`). This preserves the literal-vs-expression distinction that audits care about, and intentionally differs from `bicep.parameter.defaultValue`, which strips the surrounding quotes from literal values.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"File path","provider":"go.mondoo.com/mql/v13/providers/bicep"},"using":{"name":"using","type":"\u0007","is_mandatory":true,"title":"Target template referenced by the `using` statement","desc":"The value of `using '\u003ctarget\u003e'` — `'./main.bicep'`, `'none'`, or a registry/template-spec ref like `'br:...'`. Empty when no `using` statement is present.","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep parameter file","desc":"Examine a `.bicepparam` parameter file — the file that carries the actual parameter values used for a deployment. The `using` field names the template the values target (`'./main.bicep'`, `'none'`, or a registry/template-spec ref like `'br:...'`); `params` maps each `param \u003cname\u003e = \u003cvalue\u003e` assignment to its right-hand-side value text. Select a file by its `path` — for example `bicep.paramFiles.where(path == \"prod.bicepparam\")`.","min_provider_version":"13.1.2","defaults":"path","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.parameter":{"id":"bicep.parameter","name":"bicep.parameter","fields":{"allowed":{"name":"allowed","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed values from @allowed decorator","provider":"go.mondoo.com/mql/v13/providers/bicep"},"decorators":{"name":"decorators","type":"\u0019\u0007","is_mandatory":true,"title":"All decorators as raw strings","provider":"go.mondoo.com/mql/v13/providers/bicep"},"defaultValue":{"name":"defaultValue","type":"\u0007","is_mandatory":true,"title":"Default value expression (empty if required)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description from @description decorator","provider":"go.mondoo.com/mql/v13/providers/bicep"},"maxLength":{"name":"maxLength","type":"\u0005","is_mandatory":true,"title":"`@maxLength(n)` constraint","desc":"Applies to `string` and array parameters. Null when the decorator is not declared.","min_provider_version":"13.0.9","provider":"go.mondoo.com/mql/v13/providers/bicep"},"maxValue":{"name":"maxValue","type":"\u0005","is_mandatory":true,"title":"`@maxValue(n)` constraint","desc":"Applies to `int` parameters. Null when the decorator is not declared, which is distinct from an explicit `@maxValue(0)`.","min_provider_version":"13.0.9","provider":"go.mondoo.com/mql/v13/providers/bicep"},"minLength":{"name":"minLength","type":"\u0005","is_mandatory":true,"title":"`@minLength(n)` constraint","desc":"Applies to `string` and array parameters. Null when the decorator is not declared. Audits commonly require a non-null `minLength` on string parameters that hold passwords or other credential material.","min_provider_version":"13.0.9","provider":"go.mondoo.com/mql/v13/providers/bicep"},"minValue":{"name":"minValue","type":"\u0005","is_mandatory":true,"title":"`@minValue(n)` constraint","desc":"Applies to `int` parameters. Null when the decorator is not declared, which is distinct from an explicit `@minValue(0)`.","min_provider_version":"13.0.9","provider":"go.mondoo.com/mql/v13/providers/bicep"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Parameter name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"resolvedType":{"name":"resolvedType","type":"\u001bbicep.type","title":"User-defined type the `type` names, or null","desc":"Non-null only when `type` names a `bicep.type` declared in the same file (for example `param sku storageSku` resolves to the `storageSku` type). Null for a built-in type (`string`, `int`, `bool`, `object`, `array`, `secureString`, `secureObject`) or any name that doesn't match a same-file type declaration.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"secure":{"name":"secure","type":"\u0004","is_mandatory":true,"title":"Whether @secure decorator is present","provider":"go.mondoo.com/mql/v13/providers/bicep"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Type (string, int, bool, object, array, or user-defined)","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep parameter declaration","desc":"Examine the name, type, default value, @description, @secure flag, @allowed values, and the full raw decorator list — used to flag missing @secure on credential-shaped parameters or unbounded @allowed sets.","min_provider_version":"13.0.0","defaults":"name type","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.propertyExpression":{"id":"bicep.propertyExpression","name":"bicep.propertyExpression","fields":{"expression":{"name":"expression","type":"\u001bbicep.expression","title":"Parsed expression tree of the value at `path`","desc":"Structured, queryable view of the leaf value with symbol resolution (`referenceKind` / `referencedParameter` / …). Use it to ask whether the value hardcodes a literal, reads a `@secure` parameter, references another resource, or calls a Bicep function. See `bicep.expression`.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Dotted/indexed path to the value within the object","desc":"For example `encryption.keyVaultProperties.keyName` for a nested object key or `ipRules[0].action` for an array element.","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Scalar leaf inside a resource's properties or a module's params","desc":"Examine a single value buried inside a resource's `properties` object or a module's `params` object, flattened out of the nested dict so it can be queried directly. The `path` field is the dotted/indexed location of the value within the object — for example `encryption.keyVaultProperties.keyName` or `ipRules[0].action` — and `expression` is the parsed expression tree of the value at that path, carrying full symbol resolution (`referenceKind`, `referencedParameter`, …). Emitted by `bicep.resource.propertyExpressions` and `bicep.module.paramExpressions`, one per scalar leaf, in a stable order (map keys sorted, array indices preserved). See `bicep.expression`.","private":true,"min_provider_version":"13.1.2","defaults":"path","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.resource":{"id":"bicep.resource","name":"bicep.resource","fields":{"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"API version (e.g., \"2023-01-01\")","provider":"go.mondoo.com/mql/v13/providers/bicep"},"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"title":"Condition expression (empty if unconditional)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"conditionTree":{"name":"conditionTree","type":"\u001bbicep.expression","title":"Parsed condition expression tree","desc":"Structured, queryable view of the `= if (\u003ccond\u003e)` deployment condition. Use it to ask which symbol or parameter gates the resource (`symbolicRef` / `propertyAccess`) or which function evaluates it (`functionCall`). An unconditional resource yields an `unknown` node with empty `raw`. See `bicep.expression`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"decorators":{"name":"decorators","type":"\u0019\u0007","is_mandatory":true,"title":"Decorators","provider":"go.mondoo.com/mql/v13/providers/bicep"},"dependsOn":{"name":"dependsOn","type":"\u0019\u0007","is_mandatory":true,"title":"Dependencies (symbolic names from dependsOn)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"existing":{"name":"existing","type":"\u0004","is_mandatory":true,"title":"Whether this is an existing resource reference","provider":"go.mondoo.com/mql/v13/providers/bicep"},"isLoop":{"name":"isLoop","type":"\u0004","is_mandatory":true,"title":"Whether the resource is deployed with a `for` loop","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource location expression","provider":"go.mondoo.com/mql/v13/providers/bicep"},"locationTree":{"name":"locationTree","type":"\u001bbicep.expression","title":"Parsed location expression tree","desc":"Structured, queryable view of the `location` value. Use it to ask whether a location is a hardcoded literal (e.g. `'eastus'`) or derived from a function such as `resourceGroup().location` (`functionCall` / `propertyAccess`). See `bicep.expression`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopExpression":{"name":"loopExpression","type":"\u0007","is_mandatory":true,"title":"Raw collection expression the loop iterates (empty when not a loop)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopIndexVar":{"name":"loopIndexVar","type":"\u0007","is_mandatory":true,"title":"Loop index variable in the `(item, index)` form (empty otherwise)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopIterator":{"name":"loopIterator","type":"\u0007","is_mandatory":true,"title":"Loop item iteration variable (empty when not a loop)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name expression","provider":"go.mondoo.com/mql/v13/providers/bicep"},"nameTree":{"name":"nameTree","type":"\u001bbicep.expression","title":"Parsed name expression tree","desc":"Structured, queryable view of the `name` value. Use it to ask whether a resource name is a hardcoded literal, which Bicep function builds it (`functionCall`), or which parameters an interpolated name embeds (`interpolation` / `symbolicRef`). See `bicep.expression`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"parent":{"name":"parent","type":"\u0007","is_mandatory":true,"title":"Parent resource symbolic name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Resource body as dict","provider":"go.mondoo.com/mql/v13/providers/bicep"},"propertyExpressions":{"name":"propertyExpressions","type":"\u0019\u001bbicep.propertyExpression","title":"Flattened expression trees of every scalar property leaf","desc":"Walks the `properties` object and emits one entry per scalar leaf, each carrying the dotted/indexed `path` to the value (for example `encryption.keyVaultProperties.keyName` or `ipRules[0].action`) and a parsed `expression` tree with full symbol resolution. Use it to ask, for any property at any depth, whether a value hardcodes a literal, reads a `@secure` parameter, references another resource, or calls a Bicep function — without manually digging through the nested `properties` dict. Nested objects and arrays are descended into rather than emitted; every leaf (string, number, or boolean) becomes one entry. See `bicep.propertyExpression`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"resources":{"name":"resources","type":"\u0019\u001bbicep.resource","title":"Nested child resources declared inside this resource","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Scope expression (deploy target scope, e.g. resourceGroup(), subscription())","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"symbolicName":{"name":"symbolicName","type":"\u0007","is_mandatory":true,"title":"Symbolic name in the Bicep file","provider":"go.mondoo.com/mql/v13/providers/bicep"},"tags":{"name":"tags","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Resource tags","desc":"Key/value pairs from the `tags: { ... }` block in the resource body. Bicep expression-valued tags (`tags: tags`, `tags: { env: parameters('env') }`) are skipped — the map only contains entries whose value is a literal string. Empty when the resource has no static tags. Most Azure compliance frameworks require a baseline set of tags (owner, environment, cost-center) on every resource.","min_provider_version":"13.0.9","provider":"go.mondoo.com/mql/v13/providers/bicep"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Azure resource type (e.g., \"Microsoft.Storage/storageAccounts\")","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep resource declaration","desc":"Examine the symbolic name, Azure resource type and apiVersion, the resolved name and location expressions, the full properties body, the existing-resource flag, conditional-deployment expression, parent / dependsOn relationships, and decorators — the surface IaC policies match against to enforce Azure resource-shape rules.","min_provider_version":"13.0.0","defaults":"type symbolicName","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.template":{"id":"bicep.template","name":"bicep.template","fields":{"contentVersion":{"name":"contentVersion","type":"\u0007","title":"Content version","provider":"go.mondoo.com/mql/v13/providers/bicep"},"output":{"name":"output","type":"\u001bbicep.template.output","title":"Output in the compiled ARM template","desc":"Examine a single output declaration from the post-`bicep build` ARM JSON: its `type` and the `value` expression Azure Resource Manager returns after deployment. Select an output by its `name` — for example `bicep.template.outputs.where(name == \"endpoint\")` — to spot outputs that surface secrets or resource IDs.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"outputs":{"name":"outputs","type":"\u0019\u001bbicep.template.output","title":"Compiled outputs","provider":"go.mondoo.com/mql/v13/providers/bicep"},"parameter":{"name":"parameter","type":"\u001bbicep.template.parameter","title":"Parameter in the compiled ARM template","desc":"Examine a single parameter declaration from the post-`bicep build` ARM JSON: its `type`, the `defaultValue` when one is declared, the `allowedValues` constraint set, whether it is a secure type, and the `metadata` block. Select a parameter by its `name` — for example `bicep.template.parameters.where(name == \"adminPassword\")` — to flag credential-shaped parameters that aren't declared `securestring`/ `secureObject` or that lack an `allowedValues` allow-list.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"parameters":{"name":"parameters","type":"\u0019\u001bbicep.template.parameter","title":"Compiled parameters","provider":"go.mondoo.com/mql/v13/providers/bicep"},"resource":{"name":"resource","type":"\u001bbicep.template.resource","title":"Resource in the compiled ARM template","desc":"Examine the resolved Azure resource type, apiVersion, name, location, properties, dependsOn list, and the full ARM manifest for a single resource — the form Azure Resource Manager actually deploys.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"resources":{"name":"resources","type":"\u0019\u001bbicep.template.resource","title":"Compiled Azure resources","provider":"go.mondoo.com/mql/v13/providers/bicep"},"schema":{"name":"schema","type":"\u0007","title":"ARM schema URL","provider":"go.mondoo.com/mql/v13/providers/bicep"},"variable":{"name":"variable","type":"\u001bbicep.template.variable","title":"Variable in the compiled ARM template","desc":"Examine a single variable declaration from the post-`bicep build` ARM JSON. Select a variable by its `name` — for example `bicep.template.variables.where(name == \"storageName\")` — and read `value` for its resolved JSON shape.","provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"variables":{"name":"variables","type":"\u0019\u001bbicep.template.variable","title":"Compiled variables","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Compiled ARM template (from ARM JSON input)","desc":"Examine the resolved schema URL, content version, parameters, variables, resources, and outputs of an ARM template — the post-`bicep build` view, where expressions have been resolved and resources are listed flat. Use this for policy checks that need final values rather than Bicep-level expressions.","min_provider_version":"13.0.0","defaults":"schema","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.template.output":{"id":"bicep.template.output","name":"bicep.template.output","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Output name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"ARM output type","provider":"go.mondoo.com/mql/v13/providers/bicep"},"value":{"name":"value","type":"\n","is_mandatory":true,"title":"Output value expression/value (any JSON shape)","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Output in the compiled ARM template","desc":"Examine a single output declaration from the post-`bicep build` ARM JSON: its `type` and the `value` expression Azure Resource Manager returns after deployment. Select an output by its `name` — for example `bicep.template.outputs.where(name == \"endpoint\")` — to spot outputs that surface secrets or resource IDs.","min_provider_version":"13.1.2","defaults":"name type","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.template.parameter":{"id":"bicep.template.parameter","name":"bicep.template.parameter","fields":{"allowedValues":{"name":"allowedValues","type":"\u0019\n","is_mandatory":true,"title":"Allowed values from the ARM `allowedValues` array; empty when unconstrained","provider":"go.mondoo.com/mql/v13/providers/bicep"},"defaultValue":{"name":"defaultValue","type":"\n","is_mandatory":true,"title":"Default value, when the ARM parameter declares one (any JSON shape); null otherwise","provider":"go.mondoo.com/mql/v13/providers/bicep"},"metadata":{"name":"metadata","type":"\n","is_mandatory":true,"title":"The ARM `metadata` block, when present","provider":"go.mondoo.com/mql/v13/providers/bicep"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Parameter name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"secure":{"name":"secure","type":"\u0004","is_mandatory":true,"title":"Whether the ARM type is a secure type (securestring / secureObject)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"ARM parameter type","desc":"One of string, securestring, int, bool, object, secureObject, or array.","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Parameter in the compiled ARM template","desc":"Examine a single parameter declaration from the post-`bicep build` ARM JSON: its `type`, the `defaultValue` when one is declared, the `allowedValues` constraint set, whether it is a secure type, and the `metadata` block. Select a parameter by its `name` — for example `bicep.template.parameters.where(name == \"adminPassword\")` — to flag credential-shaped parameters that aren't declared `securestring`/ `secureObject` or that lack an `allowedValues` allow-list.","min_provider_version":"13.1.2","defaults":"name type","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.template.resource":{"id":"bicep.template.resource","name":"bicep.template.resource","fields":{"apiVersion":{"name":"apiVersion","type":"\u0007","is_mandatory":true,"title":"API version","provider":"go.mondoo.com/mql/v13/providers/bicep"},"condition":{"name":"condition","type":"\u0007","is_mandatory":true,"title":"ARM deployment condition expression; empty when the resource is unconditional","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"copyBatchSize":{"name":"copyBatchSize","type":"\u0005","is_mandatory":true,"title":"Batch size for a Serial `copy` loop; null when not set","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"copyCount":{"name":"copyCount","type":"\n","is_mandatory":true,"title":"Iteration count of the ARM `copy` block (an int or an ARM expression); null when not a copy loop","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"copyMode":{"name":"copyMode","type":"\u0007","is_mandatory":true,"title":"Iteration mode of the ARM `copy` block: \"Serial\" or \"Parallel\"; empty when not a copy loop or unspecified","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"copyName":{"name":"copyName","type":"\u0007","is_mandatory":true,"title":"Name of the ARM `copy` iteration block; empty when the resource is not copied","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"dependsOn":{"name":"dependsOn","type":"\u0019\u0007","is_mandatory":true,"title":"Dependencies","provider":"go.mondoo.com/mql/v13/providers/bicep"},"linkedTemplate":{"name":"linkedTemplate","type":"\u001bbicep.template","title":"Inline nested deployment template","desc":"For a `Microsoft.Resources/deployments` resource whose `properties.template` is an inline ARM template, returns that template as a `bicep.template` so you can traverse its parameters/variables/resources/outputs. Null for an external `templateLink` deployment (not resolvable offline) and for non-deployment resources.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"location":{"name":"location","type":"\u0007","is_mandatory":true,"title":"Resource location (resolved)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"manifest":{"name":"manifest","type":"\n","is_mandatory":true,"title":"Full manifest","provider":"go.mondoo.com/mql/v13/providers/bicep"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource name (resolved)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"properties":{"name":"properties","type":"\n","is_mandatory":true,"title":"Full resource properties as dict","provider":"go.mondoo.com/mql/v13/providers/bicep"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Azure resource type","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Resource in the compiled ARM template","desc":"Examine the resolved Azure resource type, apiVersion, name, location, properties, dependsOn list, and the full ARM manifest for a single resource — the form Azure Resource Manager actually deploys.","min_provider_version":"13.0.0","defaults":"type name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.template.variable":{"id":"bicep.template.variable","name":"bicep.template.variable","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Variable name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"value":{"name":"value","type":"\n","is_mandatory":true,"title":"Variable value (any JSON shape)","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Variable in the compiled ARM template","desc":"Examine a single variable declaration from the post-`bicep build` ARM JSON. Select a variable by its `name` — for example `bicep.template.variables.where(name == \"storageName\")` — and read `value` for its resolved JSON shape.","min_provider_version":"13.1.2","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.type":{"id":"bicep.type","name":"bicep.type","fields":{"decorators":{"name":"decorators","type":"\u0019\u0007","is_mandatory":true,"title":"All decorators as raw strings","provider":"go.mondoo.com/mql/v13/providers/bicep"},"definition":{"name":"definition","type":"\u0007","is_mandatory":true,"title":"Raw right-hand-side definition text (the part after `=`)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description from @description decorator","provider":"go.mondoo.com/mql/v13/providers/bicep"},"discriminator":{"name":"discriminator","type":"\u0007","is_mandatory":true,"title":"Discriminator key of a tagged union","desc":"The key captured from an `@discriminator('\u003ckey\u003e')` decorator (for example `kind` for `@discriminator('kind')`); empty when the type carries no discriminator decorator.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"exported":{"name":"exported","type":"\u0004","is_mandatory":true,"title":"Whether @export() is present","provider":"go.mondoo.com/mql/v13/providers/bicep"},"kind":{"name":"kind","type":"\u0007","is_mandatory":true,"title":"Classification of the definition","desc":"One of \"object\" (a `{ ... }` body), \"union\" (members joined by top-level `|`), \"array\" (a `[]`-suffixed or `[...]` tuple type), \"primitive\" (a built-in like string/int/bool/object/array/secureString/secureObject), or \"alias\" (a bare identifier naming another type).","provider":"go.mondoo.com/mql/v13/providers/bicep"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Type name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"properties":{"name":"properties","type":"\u0019\u001bbicep.type.property","title":"Properties of an object type","desc":"For an object definition like `{ name: string, tier: sku }` this lists one entry per property with its name and declared type. Empty for non-object types. See `bicep.type.property`.","provider":"go.mondoo.com/mql/v13/providers/bicep"},"property":{"name":"property","type":"\u001bbicep.type.property","title":"Property of a Bicep object type","desc":"Examine a single `name: type` member of an object-typed `bicep.type` definition. The `type` may itself name a user-defined type. Emitted by `bicep.type.properties`, one per declared property.","is_private":true,"provider":"go.mondoo.com/mql/v13/providers/bicep","is_implicit_resource":true},"unionMembers":{"name":"unionMembers","type":"\u0019\u0007","is_mandatory":true,"title":"Literal members of a union type","desc":"For example `['Standard_LRS', 'Premium_LRS']` for the definition `'Standard_LRS' | 'Premium_LRS'`; each member is preserved exactly as written, including its quotes. Empty for non-union types.","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep user-defined type declaration","desc":"Examine a `type Name = \u003cdefinition\u003e` declaration: the type name, the raw right-hand-side definition text (a union like `'Standard_LRS' | 'Premium_LRS'`, an object type like `{ name: string, tier: sku }`, or a reference to another type), the `@description` text, whether the type is `@export()`ed for reuse from other files, and the full raw decorator list. Select a type by its `name` — for example `bicep.file.types.where(name == \"sku\")`.","min_provider_version":"13.1.2","defaults":"name kind","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.type.property":{"id":"bicep.type.property","name":"bicep.type.property","fields":{"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Property name","provider":"go.mondoo.com/mql/v13/providers/bicep"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Declared type","desc":"The property's declared type as written; may itself name a user-defined type (for example `sku` in `tier: sku`).","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Property of a Bicep object type","desc":"Examine a single `name: type` member of an object-typed `bicep.type` definition. The `type` may itself name a user-defined type. Emitted by `bicep.type.properties`, one per declared property.","private":true,"min_provider_version":"13.1.2","defaults":"name type","provider":"go.mondoo.com/mql/v13/providers/bicep"},"bicep.variable":{"id":"bicep.variable","name":"bicep.variable","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description from @description decorator","provider":"go.mondoo.com/mql/v13/providers/bicep"},"expression":{"name":"expression","type":"\u0007","is_mandatory":true,"title":"Value expression (raw Bicep expression)","provider":"go.mondoo.com/mql/v13/providers/bicep"},"expressionTree":{"name":"expressionTree","type":"\u001bbicep.expression","title":"Parsed expression tree","desc":"Structured, queryable view of the `expression` value. Use it to ask whether a value is a hardcoded literal, which Bicep function builds it (`functionCall`), which symbolic resources or parameters it references (`symbolicRef` / `propertyAccess`), and which parameters an interpolated name string embeds. See `bicep.expression`.","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"isLoop":{"name":"isLoop","type":"\u0004","is_mandatory":true,"title":"Whether the value is built with a `for` loop","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopExpression":{"name":"loopExpression","type":"\u0007","is_mandatory":true,"title":"Raw collection expression the loop iterates (empty when not a loop)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopIndexVar":{"name":"loopIndexVar","type":"\u0007","is_mandatory":true,"title":"Loop index variable in the `(item, index)` form (empty otherwise)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"loopIterator":{"name":"loopIterator","type":"\u0007","is_mandatory":true,"title":"Loop item iteration variable (empty when not a loop)","min_provider_version":"13.1.2","provider":"go.mondoo.com/mql/v13/providers/bicep"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Variable name","provider":"go.mondoo.com/mql/v13/providers/bicep"}},"title":"Bicep variable declaration","desc":"Examine the variable name, the raw value expression, and any @description decorator — useful for tracking how derived values flow into resource bodies.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/v13/providers/bicep"}}}