Version 0.4.0

App Service

Function App redeployments now preserve required platform-managed configuration, preventing an otherwise successful infrastructure deployment from leaving an existing app unable to start.
Function Apps and Web Apps no longer overwrite optional HTTPS and client-affinity settings when those properties are omitted. Define them explicitly when Hulk should manage their values.
Dedicated App Service plans can host both Web Apps and Function Apps. Function-only hosting plans continue to reject Web Apps during validation.
Runtime definitions now use explicit, versioned values and Web Apps require an os value so Hulk can validate the selected runtime against the target platform before generating Bicep.
App Service Plan capacity, tier, operating-system, and hosting-type combinations are validated earlier and generate stable Bicep across repeated deployments.

Flex Consumption is now represented by a clear, first-class flex_settings definition instead of legacy application settings.
Flex definitions support a deployment container, instance memory, maximum instance count, HTTP concurrency, and always-ready instance configuration.
Hulk validates Flex-specific requirements, including Linux hosting, supported runtimes, deployment-container availability, and the absence of unsupported deployment slots.
Generated Flex templates configure identity-based storage access and the documented Function App deployment shape.

Added hulk check for a fast, local validation pass that resolves environments and modules, validates Hulk references, renders fresh Bicep in isolation, and compiles it when the Bicep CLI is available.
Added hulk plan for Azure-backed preflight validation using the subscription and resource group declared by the selected environment.
Added hulk plan --what-if to preview expected infrastructure changes without creating a deployment.
Added --require-bicep for CI workflows that must fail when generated Bicep cannot be compiled.
Added human-readable, JSON, and SARIF output formats so the same validation flow works in terminals, automation, and code-scanning tools.
hulk synth, hulk check, hulk plan, and hulk transpile now share the same project preparation path, reducing differences between local feedback and deployment output.

Generated output is staged and published atomically, so a failed transpilation or Bicep compilation does not replace the last valid .hulk directory.
Module paths are confined to the project directory, module cycles and duplicate resource identities are reported clearly, and invalid references fail before deployment.
Environment filtering is applied consistently to root and module resources before references are resolved.
Variable expansion now resolves nested environment placeholders consistently, including values selected from environment-specific variable maps.
Bicep string generation now handles interpolated expressions containing quoted values correctly.
API connection names that contain characters invalid in Bicep symbols are sanitized without changing their deployed resource names.
Parsing, module expansion, resource lookup, and output generation have been streamlined to reduce repeated work and memory use on larger projects.

Environment definitions now separate the canonical environment name from the resource-name abbr substituted into {env}.
Canonical names are used for CLI selection and variable-map keys, while supported abbreviations allow existing resource naming conventions to remain stable.
Environment names, abbreviations, duplicate definitions, and missing variable values now produce earlier, more actionable errors.

Hulk updates now require signed release metadata and verify the selected artifact's platform, size, checksum, and reported version before installation.
Refreshed