@apexops/capabilities 0.10.0-next.0

package/dist/index.d.ts

@@ -0,0 +1,17 @@
+export * from "./capability.js";
+export * from "./bound-envelope-transport.js";
+export * from "./command-plans.js";
+export * from "./design-capabilities.js";
+export * from "./encrypted-envelope-transport.js";
+export * from "./iac.js";
+export * from "./iac-generation.js";
+export * from "./iac-normalizers.js";
+export * from "./local-plan-transport.js";
+export * from "./native-iac-providers.js";
+export * from "./operations-placeholders.js";
+export * from "./pack-manager.js";
+export * from "./packs.js";
+export * from "./process-runner.js";
+export * from "./terraform-provider-schema.js";
+export * from "./terraform-registry-client.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC"}

package/dist/index.js

@@ -0,0 +1,17 @@
+export * from "./capability.js";
+export * from "./bound-envelope-transport.js";
+export * from "./command-plans.js";
+export * from "./design-capabilities.js";
+export * from "./encrypted-envelope-transport.js";
+export * from "./iac.js";
+export * from "./iac-generation.js";
+export * from "./iac-normalizers.js";
+export * from "./local-plan-transport.js";
+export * from "./native-iac-providers.js";
+export * from "./operations-placeholders.js";
+export * from "./pack-manager.js";
+export * from "./packs.js";
+export * from "./process-runner.js";
+export * from "./terraform-provider-schema.js";
+export * from "./terraform-registry-client.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC"}

package/dist/local-plan-transport.d.ts

@@ -0,0 +1,29 @@
+export interface LocalEncryptedPlanMetadata {
+    readonly implementation: "local-reference";
+    readonly algorithm: "aes-256-gcm";
+    readonly digest: string;
+    readonly recipient: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+}
+export interface LocalEncryptedPlan {
+    readonly metadata: LocalEncryptedPlanMetadata;
+    readonly iv: string;
+    readonly authTag: string;
+    readonly ciphertext: string;
+}
+export interface DecryptedPlanHandle {
+    readonly path: string;
+    dispose(): Promise<void>;
+}
+export declare class LocalEncryptedPlanTransport {
+    private readonly now;
+    constructor(now?: () => Date);
+    encrypt(plaintext: Uint8Array, key: Uint8Array, options: {
+        readonly recipient: string;
+        readonly ttlMs: number;
+    }): LocalEncryptedPlan;
+    decrypt(encrypted: LocalEncryptedPlan, key: Uint8Array, recipient: string): Buffer;
+    decryptToRestrictiveTemp(encrypted: LocalEncryptedPlan, key: Uint8Array, recipient: string): Promise<DecryptedPlanHandle>;
+}
+//# sourceMappingURL=local-plan-transport.d.ts.map

package/dist/local-plan-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-plan-transport.d.ts","sourceRoot":"","sources":["../src/local-plan-transport.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,iBAAiB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AA2BD,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAhC,YAA6B,GAAG,GAAE,MAAM,IAAuB,EAAI;IAEnE,OAAO,CACL,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,EACf,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAC9D,kBAAkB,CAuBpB;IAED,OAAO,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAkBjF;IAEK,wBAAwB,CAC5B,SAAS,EAAE,kBAAkB,EAC7B,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,CAAC,CAwB9B;CACF"}

package/dist/local-plan-transport.js

@@ -0,0 +1,101 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { chmod, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+function requireKey(key) {
+    if (key.byteLength !== 32) {
+        throw new TypeError("Local plan transport requires a caller-supplied 32-byte key");
+    }
+    return Buffer.from(key);
+}
+function digest(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function authenticatedMetadata(metadata) {
+    return Buffer.from(JSON.stringify({
+        implementation: metadata.implementation,
+        algorithm: metadata.algorithm,
+        digest: metadata.digest,
+        recipient: metadata.recipient,
+        createdAt: metadata.createdAt,
+        expiresAt: metadata.expiresAt,
+    }), "utf8");
+}
+export class LocalEncryptedPlanTransport {
+    now;
+    constructor(now = () => new Date()) {
+        this.now = now;
+    }
+    encrypt(plaintext, key, options) {
+        if (options.recipient.trim().length === 0 || options.ttlMs <= 0) {
+            throw new TypeError("Plan recipient and positive expiry are required");
+        }
+        const createdAt = this.now();
+        const metadata = {
+            implementation: "local-reference",
+            algorithm: "aes-256-gcm",
+            digest: digest(plaintext),
+            recipient: options.recipient,
+            createdAt: createdAt.toISOString(),
+            expiresAt: new Date(createdAt.getTime() + options.ttlMs).toISOString(),
+        };
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", requireKey(key), iv);
+        cipher.setAAD(authenticatedMetadata(metadata));
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        return {
+            metadata,
+            iv: iv.toString("base64"),
+            authTag: cipher.getAuthTag().toString("base64"),
+            ciphertext: ciphertext.toString("base64"),
+        };
+    }
+    decrypt(encrypted, key, recipient) {
+        if (encrypted.metadata.implementation !== "local-reference" || encrypted.metadata.algorithm !== "aes-256-gcm") {
+            throw new Error("Unsupported encrypted plan transport");
+        }
+        if (encrypted.metadata.recipient !== recipient) {
+            throw new Error("Encrypted plan recipient does not match the current authority");
+        }
+        if (new Date(encrypted.metadata.expiresAt).getTime() <= this.now().getTime()) {
+            throw new Error("Encrypted plan has expired");
+        }
+        const decipher = createDecipheriv("aes-256-gcm", requireKey(key), Buffer.from(encrypted.iv, "base64"));
+        decipher.setAAD(authenticatedMetadata(encrypted.metadata));
+        decipher.setAuthTag(Buffer.from(encrypted.authTag, "base64"));
+        const plaintext = Buffer.concat([decipher.update(Buffer.from(encrypted.ciphertext, "base64")), decipher.final()]);
+        if (digest(plaintext) !== encrypted.metadata.digest) {
+            throw new Error("Encrypted plan digest mismatch");
+        }
+        return plaintext;
+    }
+    async decryptToRestrictiveTemp(encrypted, key, recipient) {
+        const directory = await mkdtemp(join(tmpdir(), "apex-local-plan-"));
+        const path = join(directory, "saved.tfplan");
+        try {
+            await writeFile(path, this.decrypt(encrypted, key, recipient), { mode: 0o600, flag: "wx" });
+            await chmod(path, 0o600);
+            let disposed = false;
+            return {
+                path,
+                async dispose() {
+                    if (disposed)
+                        return;
+                    disposed = true;
+                    try {
+                        const bytes = await readFile(path);
+                        await writeFile(path, randomBytes(bytes.length), { mode: 0o600 });
+                    }
+                    finally {
+                        await rm(directory, { recursive: true, force: true });
+                    }
+                },
+            };
+        }
+        catch (error) {
+            await rm(directory, { recursive: true, force: true });
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=local-plan-transport.js.map

package/dist/local-plan-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-plan-transport.js","sourceRoot":"","sources":["../src/local-plan-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuBjC,SAAS,UAAU,CAAC,GAAe;IACjC,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAoC;IACjE,OAAO,MAAM,CAAC,IAAI,CAChB,IAAI,CAAC,SAAS,CAAC;QACb,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,EACF,MAAM,CACP,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,2BAA2B;IACT,GAAG;IAAhC,YAA6B,GAAG,GAAe,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;mBAAlC,GAAG;IAAkC,CAAC;IAEnE,OAAO,CACL,SAAqB,EACrB,GAAe,EACf,OAA+D;QAE/D,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAA+B;YAC3C,cAAc,EAAE,iBAAiB;YACjC,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC;YACzB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;SACvE,CAAC;QACF,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,OAAO;YACL,QAAQ;YACR,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,SAA6B,EAAE,GAAe,EAAE,SAAiB;QACvE,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,KAAK,iBAAiB,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YAC9G,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvG,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3D,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClH,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,SAA6B,EAC7B,GAAe,EACf,SAAiB;QAEjB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,OAAO;gBACL,IAAI;gBACJ,KAAK,CAAC,OAAO;oBACX,IAAI,QAAQ;wBAAE,OAAO;oBACrB,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;wBACnC,MAAM,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACpE,CAAC;4BAAS,CAAC;wBACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/native-iac-providers.d.ts

@@ -0,0 +1,96 @@
+import type { ApprovalEvidenceV1, DeploymentPreviewV1, ExecutionPlanAttestationV1, OperationRecordV1, ResourceInventoryV1 } from "@apexops/contracts";
+import { type BicepStackTarget, type CommandPlan } from "./command-plans.js";
+import { type CurrentDeploymentAuthority, type IacProvider, type ProviderExecutionEvidence, type PreviewRequest } from "./iac.js";
+import { normalizeAzureWhatIf } from "./iac-normalizers.js";
+import type { ProcessRunnerLike } from "./process-runner.js";
+import { LocalEncryptedPlanTransport, type LocalEncryptedPlan } from "./local-plan-transport.js";
+export interface NativeProviderRuntime {
+    readonly runner: ProcessRunnerLike;
+    readonly currentAuthority: () => Promise<CurrentDeploymentAuthority>;
+    readonly now?: () => Date;
+    readonly nextId?: () => string;
+    readonly timeoutMs?: number;
+    readonly maxOutputBytes?: number;
+    readonly bindingStore?: PreviewBindingStore;
+}
+export interface PreviewBindingStore {
+    save(previewHash: string, binding: PersistedPreviewBinding): Promise<void>;
+    load(previewHash: string): Promise<PersistedPreviewBinding | undefined>;
+    loadLatest?(projectId: string, runId: string, operation: "apply" | "destroy"): Promise<PersistedPreviewBinding | undefined>;
+}
+export interface EncryptedPlanArtifactStore {
+    put(reference: string, artifact: LocalEncryptedPlan): Promise<void>;
+    get(reference: string): Promise<LocalEncryptedPlan | undefined>;
+}
+export type PersistedPreviewBinding = BicepPreviewBinding | TerraformPreviewBinding;
+export interface NativeBicepProviderOptions extends NativeProviderRuntime {
+    readonly target: BicepStackTarget;
+}
+export interface TerraformNativeTarget {
+    readonly cwd: string;
+    readonly target: string;
+    readonly planPath: (request: PreviewRequest, operation: "apply" | "destroy") => string;
+    readonly lockfileHash: string;
+    readonly configHash: () => Promise<string>;
+}
+export type TerraformPlanAttestation = ExecutionPlanAttestationV1;
+export interface NativeTerraformProviderOptions extends NativeProviderRuntime {
+    readonly target: TerraformNativeTarget;
+    readonly keyProvider?: () => Promise<Uint8Array>;
+    readonly artifactStore?: EncryptedPlanArtifactStore;
+    readonly transport?: LocalEncryptedPlanTransport;
+}
+export interface BicepPreviewBinding {
+    readonly kind: "bicep";
+    readonly preview: DeploymentPreviewV1;
+    readonly providerBindingHash: string;
+    readonly templateHash: string;
+    readonly parametersHash: string;
+    readonly stackStateHash: string;
+}
+export interface TerraformPreviewBinding {
+    readonly kind: "terraform";
+    readonly preview: DeploymentPreviewV1;
+    readonly attestation: TerraformPlanAttestation;
+}
+declare abstract class NativeProviderBase {
+    #private;
+    protected readonly runner: ProcessRunnerLike;
+    protected readonly now: () => Date;
+    protected readonly nextId: () => string;
+    protected readonly currentAuthority: () => Promise<CurrentDeploymentAuthority>;
+    protected readonly bindingStore: PreviewBindingStore | undefined;
+    protected constructor(options: NativeProviderRuntime);
+    protected run(plan: CommandPlan): Promise<string>;
+    protected authorize(track: "bicep" | "terraform", operation: "apply" | "destroy", preview: DeploymentPreviewV1, approval: ApprovalEvidenceV1, suppliedAuthority: CurrentDeploymentAuthority, latestPreviewHash: string | undefined): Promise<CurrentDeploymentAuthority>;
+    protected record(operation: "apply" | "destroy", preview: DeploymentPreviewV1, approval: ApprovalEvidenceV1, authority: CurrentDeploymentAuthority, providerOperationId?: string, validatorIds?: readonly string[]): OperationRecordV1;
+    reconcile(operationId: string): Promise<OperationRecordV1 | undefined>;
+    executionEvidence(operationId: string): ProviderExecutionEvidence | undefined;
+    protected previewKey(request: PreviewRequest, operation: "apply" | "destroy"): string;
+    protected createPreview(track: "bicep" | "terraform", operation: "apply" | "destroy", request: PreviewRequest, normalized: ReturnType<typeof normalizeAzureWhatIf>, extra?: Partial<Pick<DeploymentPreviewV1, "artifactHash" | "stateLineage" | "stateSerial">>): DeploymentPreviewV1;
+}
+export declare class NativeBicepProvider extends NativeProviderBase implements IacProvider {
+    #private;
+    readonly track: "bicep";
+    constructor(options: NativeBicepProviderOptions);
+    validate(): Promise<readonly string[]>;
+    previewApply(request: PreviewRequest): Promise<DeploymentPreviewV1>;
+    previewDestroy(request: PreviewRequest): Promise<DeploymentPreviewV1>;
+    apply(preview: DeploymentPreviewV1, approval: ApprovalEvidenceV1, authority: CurrentDeploymentAuthority): Promise<OperationRecordV1>;
+    destroy(preview: DeploymentPreviewV1, approval: ApprovalEvidenceV1, authority: CurrentDeploymentAuthority): Promise<OperationRecordV1>;
+    inventory(projectId: string, runId: string): Promise<ResourceInventoryV1>;
+}
+export declare class NativeTerraformProvider extends NativeProviderBase implements IacProvider {
+    #private;
+    readonly track: "terraform";
+    constructor(options: NativeTerraformProviderOptions);
+    validate(): Promise<readonly string[]>;
+    previewApply(request: PreviewRequest): Promise<DeploymentPreviewV1>;
+    previewDestroy(request: PreviewRequest): Promise<DeploymentPreviewV1>;
+    apply(preview: DeploymentPreviewV1, approval: ApprovalEvidenceV1, authority: CurrentDeploymentAuthority): Promise<OperationRecordV1>;
+    destroy(preview: DeploymentPreviewV1, approval: ApprovalEvidenceV1, authority: CurrentDeploymentAuthority): Promise<OperationRecordV1>;
+    inventory(projectId: string, runId: string): Promise<ResourceInventoryV1>;
+    attestation(previewHash: string): TerraformPlanAttestation | undefined;
+}
+export {};
+//# sourceMappingURL=native-iac-providers.d.ts.map

package/dist/native-iac-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-iac-providers.d.ts","sourceRoot":"","sources":["../src/native-iac-providers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIL,KAAK,0BAA0B,EAC/B,KAAK,WAAW,EAChB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EAEL,oBAAoB,EAIrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,OAAO,EAAE,2BAA2B,EAAE,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;IACxE,UAAU,CAAC,CACT,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,OAAO,GAAG,SAAS,GAC7B,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;CACjE;AAED,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,GAAG,uBAAuB,CAAC;AAEpF,MAAM,WAAW,0BAA2B,SAAQ,qBAAqB;IACvE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,KAAK,MAAM,CAAC;IACvF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAElE,MAAM,WAAW,8BAA+B,SAAQ,qBAAqB;IAC3E,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,0BAA0B,CAAC;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;CAClD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;CAChD;AAkBD,uBAAe,kBAAkB;;IAC/B,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC7C,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;IACnC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;IACxC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAK/E,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAEjE,SAAS,aAAa,OAAO,EAAE,qBAAqB,EAQnD;IAED,UAAgB,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAStD;IAED,UAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,GAAG,WAAW,EAC5B,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,kBAAkB,EAC5B,iBAAiB,EAAE,0BAA0B,EAC7C,iBAAiB,EAAE,MAAM,GAAG,SAAS,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAsBrC;IAED,SAAS,CAAC,MAAM,CACd,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,0BAA0B,EACrC,mBAAmB,CAAC,EAAE,MAAM,EAC5B,YAAY,GAAE,SAAS,MAAM,EAAO,GACnC,iBAAiB,CAuBnB;IAEK,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAE3E;IAED,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAE5E;IAED,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAEpF;IAED,SAAS,CAAC,aAAa,CACrB,KAAK,EAAE,OAAO,GAAG,WAAW,EAC5B,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,EACnD,KAAK,GAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,cAAc,GAAG,cAAc,GAAG,aAAa,CAAC,CAAM,GAC9F,mBAAmB,CAuBrB;CACF;AAED,qBAAa,mBAAoB,SAAQ,kBAAmB,YAAW,WAAW;;IAChF,QAAQ,CAAC,KAAK,EAAG,OAAO,CAAU;IAKlC,YAAY,OAAO,EAAE,0BAA0B,EAmB9C;IAEK,QAAQ,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAG3C;IAEK,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAcxE;IAEK,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAW1E;IAEK,KAAK,CACT,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,0BAA0B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAE5B;IAEK,OAAO,CACX,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,0BAA0B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAE5B;IAEK,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAU9E;CA4GF;AAED,qBAAa,uBAAwB,SAAQ,kBAAmB,YAAW,WAAW;;IACpF,QAAQ,CAAC,KAAK,EAAG,WAAW,CAAU;IAQtC,YAAY,OAAO,EAAE,8BAA8B,EAMlD;IAEK,QAAQ,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAM3C;IAEK,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAExE;IAEK,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAE1E;IAEK,KAAK,CACT,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,0BAA0B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAE5B;IAEK,OAAO,CACX,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,0BAA0B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAE5B;IAEK,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuC9E;IAED,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAKrE;CAkKF"}