@apexops/capabilities 0.10.0-next.4 → 0.11.0-next.0

package/dist/native-iac-providers.js

@@ -1,11 +1,27 @@
 import { createHash, randomUUID } from "node:crypto";
-import { readFile, rm } from "node:fs/promises";
-import { isAbsolute, resolve } from "node:path";
+import { constants } from "node:fs";
+import { lstat, mkdir, mkdtemp, open, opendir, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { Value } from "@sinclair/typebox/value";
+import { hasValidPolicyValidation, NATIVE_VALIDATION_COMMANDS, calculateNativeValidationCommandHash, calculateNativeValidationReceiptHash, calculatePolicyValidationDigest, hasActionablePolicyMappings, hasValidNativeValidationReceipt, PolicyPropertyMapV1Schema, LogicalResourceManifestV1Schema, IacBindingV1Schema, } from "@apexops/contracts";
 import { BicepCommandAdapter, TerraformCommandAdapter, } from "./command-plans.js";
 import { authorizeDeploymentPreview, IacProviderError, sha256, } from "./iac.js";
 import { normalizeAzureStackResources, normalizeAzureWhatIf, normalizeTerraformPlan, parseJsonProcessOutput, selectAzureDeploymentStack, } from "./iac-normalizers.js";
 import { secretFreeProperties } from "./secret-redaction.js";
 import { LocalEncryptedPlanTransport } from "./local-plan-transport.js";
+import { validatePolicyProperties, validateStorageSecurityBindings, validateBicepResourceParity, validateBicepStorageDiagnostics, validateBicepStorageBaseline, } from "./policy-validation.js";
+export function nativePolicyValidationBinding(receipt) {
+    return {
+        track: receipt.track,
+        sourceHash: receipt.sourceHash,
+        policyMapHash: receipt.policyMapHash,
+        policyMapContentHash: receipt.policyMapContentHash,
+        logicalResourceManifestHash: receipt.logicalResourceManifestHash,
+        inputHash: receipt.inputHash,
+        receiptHash: receipt.receiptHash,
+    };
+}
 function terraformStateIdentity(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value))
         return {};
@@ -20,6 +36,120 @@ function terraformStateIdentity(value) {
 function terraformStateIdentityOutput(stdout) {
     return stdout.trim().length === 0 ? {} : terraformStateIdentity(parseJsonProcessOutput("terraform-state", stdout));
 }
+const maxGeneratedSourceBytes = 16 * 1024 * 1024;
+function pathEscapes(parent, child) {
+    const relation = relative(parent, child);
+    return relation === "" || relation === ".." || relation.startsWith(`..${sep}`) || isAbsolute(relation);
+}
+function sourceBindingError() {
+    return new IacProviderError("PREVIEW_HASH_MISMATCH", "Native preview source does not match the accepted generated tree");
+}
+async function readGeneratedSource(source, accepted, outputs = new Set()) {
+    try {
+        const rootPath = resolve(source.rootPath);
+        if (!isAbsolute(source.rootPath) || !/^[a-f0-9]{64}$/.test(source.treeHash))
+            throw sourceBindingError();
+        const rootStat = await lstat(rootPath);
+        if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
+            throw sourceBindingError();
+        }
+        const rootRealPath = await realpath(rootPath);
+        let bytes = 0;
+        let entries = 0;
+        const files = [];
+        const fileHashes = new Map();
+        const fileContents = new Map();
+        const visit = async (directory, depth) => {
+            if (depth > 64)
+                throw sourceBindingError();
+            const handle = await opendir(directory);
+            for await (const entry of handle) {
+                if (++entries > 4096)
+                    throw sourceBindingError();
+                const filePath = resolve(directory, entry.name);
+                if (pathEscapes(rootPath, filePath) || pathEscapes(rootRealPath, await realpath(filePath))) {
+                    throw sourceBindingError();
+                }
+                const metadata = await lstat(filePath);
+                if (metadata.isSymbolicLink() || (metadata.isFile() && metadata.nlink !== 1))
+                    throw sourceBindingError();
+                const path = relative(rootPath, filePath).split(sep).join("/");
+                const isAccepted = accepted?.paths.has(path) === true;
+                if (accepted !== undefined && !isAccepted && outputs.has(filePath)) {
+                    if (path === ".terraform" ? metadata.isDirectory() : metadata.isFile())
+                        continue;
+                    throw sourceBindingError();
+                }
+                if (metadata.isDirectory()) {
+                    await visit(filePath, depth + 1);
+                    continue;
+                }
+                if (!metadata.isFile() || metadata.size > maxGeneratedSourceBytes - bytes)
+                    throw sourceBindingError();
+                const input = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+                try {
+                    const opened = await input.stat();
+                    if (!opened.isFile() || opened.nlink !== 1)
+                        throw sourceBindingError();
+                    const chunks = [];
+                    for (;;) {
+                        const chunk = Buffer.alloc(Math.min(64 * 1024, maxGeneratedSourceBytes - bytes + 1));
+                        const { bytesRead } = await input.read(chunk);
+                        if (bytesRead === 0)
+                            break;
+                        bytes += bytesRead;
+                        if (bytes > maxGeneratedSourceBytes)
+                            throw sourceBindingError();
+                        chunks.push(chunk.subarray(0, bytesRead));
+                    }
+                    const buffer = Buffer.concat(chunks);
+                    const content = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(buffer);
+                    files.push({ path, content });
+                    fileHashes.set(path, createHash("sha256").update(buffer).digest("hex"));
+                    fileContents.set(path, buffer);
+                }
+                finally {
+                    await input.close();
+                }
+            }
+        };
+        await visit(rootPath, 0);
+        files.sort((left, right) => left.path.localeCompare(right.path));
+        if (sha256(files) !== source.treeHash)
+            throw sourceBindingError();
+        return {
+            rootPath,
+            treeHash: source.treeHash,
+            paths: new Set(files.map(({ path }) => path)),
+            fileHashes,
+            fileContents,
+        };
+    }
+    catch {
+        throw sourceBindingError();
+    }
+}
+export async function assertGeneratedSourceUnchanged(source) {
+    await readGeneratedSource(source);
+}
+async function bindGeneratedSource(request, cwd, templateFile, parametersFile, accepted, outputs) {
+    if (request.generatedSource === undefined)
+        return undefined;
+    const source = await readGeneratedSource({ ...request.generatedSource }, accepted, outputs);
+    if (resolve(cwd ?? process.cwd()) !== source.rootPath)
+        throw sourceBindingError();
+    if (templateFile !== undefined && resolve(source.rootPath, templateFile) !== resolve(source.rootPath, "main.bicep")) {
+        throw sourceBindingError();
+    }
+    for (const file of [templateFile, parametersFile]) {
+        if (file === undefined)
+            continue;
+        const path = relative(source.rootPath, resolve(source.rootPath, file)).split(sep).join("/");
+        if (!source.paths.has(path))
+            throw sourceBindingError();
+    }
+    return source;
+}
 class NativeProviderBase {
     runner;
     now;
@@ -29,6 +159,7 @@ class NativeProviderBase {
     #maxOutputBytes;
     #operations = new Map();
     #executionEvidence = new Map();
+    #policyValidations = new Map();
     bindingStore;
     constructor(options) {
         this.runner = options.runner;
@@ -49,6 +180,263 @@ class NativeProviderBase {
         });
         return result.stdout;
     }
+    async validateBoundSource(request, track, cwd, templateFile) {
+        if (request.generatedSource === undefined || cwd() === undefined)
+            throw sourceBindingError();
+        const generatedSource = { ...request.generatedSource };
+        const commands = NATIVE_VALIDATION_COMMANDS[track];
+        let receipt;
+        let policyInput;
+        let storageBindings;
+        let parityManifest;
+        let parityBinding;
+        let diagnosticsTargets;
+        try {
+            if (track === "bicep" && request.resourceParityBinding !== undefined) {
+                calculatePolicyValidationDigest(request.resourceParityBinding);
+                parityBinding = structuredClone(request.resourceParityBinding);
+                if (!Value.Check(IacBindingV1Schema, parityBinding) ||
+                    request.resourceParityManifest === undefined ||
+                    parityBinding.track !== track ||
+                    parityBinding.projectId !== request.projectId ||
+                    parityBinding.runId !== request.runId ||
+                    parityBinding.intentHash !== request.inputHash)
+                    throw new Error();
+            }
+            if (track === "bicep" && request.storageDiagnosticsTargets !== undefined) {
+                calculatePolicyValidationDigest(request.storageDiagnosticsTargets);
+                diagnosticsTargets = structuredClone(request.storageDiagnosticsTargets);
+                if (Object.keys(diagnosticsTargets).length > 1000)
+                    throw new Error();
+            }
+            if (track === "bicep" && request.resourceParityManifest !== undefined) {
+                calculatePolicyValidationDigest(request.resourceParityManifest);
+                parityManifest = structuredClone(request.resourceParityManifest);
+                if (!Value.Check(LogicalResourceManifestV1Schema, parityManifest) ||
+                    parityManifest.track !== track ||
+                    parityManifest.projectId !== request.projectId ||
+                    parityManifest.runId !== request.runId ||
+                    parityManifest.resources.length > 1000)
+                    throw new Error();
+            }
+            if (track === "bicep" && request.storageSecurityBindings !== undefined) {
+                calculatePolicyValidationDigest(request.storageSecurityBindings);
+                storageBindings = structuredClone(request.storageSecurityBindings);
+                if (Object.keys(storageBindings).length > 1000)
+                    throw new Error();
+            }
+            if (request.policyValidation !== undefined) {
+                calculatePolicyValidationDigest(request.policyValidation);
+                policyInput = structuredClone(request.policyValidation);
+                if (!Value.Check(PolicyPropertyMapV1Schema, policyInput.policyMap) ||
+                    calculatePolicyValidationDigest(policyInput.policyMap) !== request.policyHash ||
+                    policyInput.policyMap.projectId !== request.projectId ||
+                    policyInput.policyMap.runId !== request.runId)
+                    throw new Error();
+            }
+            const body = {
+                schemaVersion: "1.0.0",
+                projectId: request.projectId,
+                runId: request.runId,
+                track,
+                sourceHash: request.sourceHash,
+                treeHash: generatedSource.treeHash,
+                policyHash: request.policyHash,
+                inputHash: request.inputHash,
+                ...(policyInput !== undefined && !hasActionablePolicyMappings(policyInput.policyMap)
+                    ? {
+                        policyApplicability: {
+                            status: "no-actionable-mappings",
+                            policyMapContentHash: calculatePolicyValidationDigest(policyInput.policyMap),
+                        },
+                    }
+                    : {}),
+                outcome: "pass",
+                commands: commands.map((command) => ({
+                    validatorId: command.validatorId,
+                    commandHash: calculateNativeValidationCommandHash(command),
+                    exitCode: 0,
+                    signal: null,
+                    timedOut: false,
+                    outputTruncated: false,
+                })),
+            };
+            receipt = { ...body, receiptHash: calculateNativeValidationReceiptHash(body) };
+            if (!hasValidNativeValidationReceipt(receipt, body))
+                throw new Error();
+        }
+        catch {
+            throw new IacProviderError("NATIVE_VALIDATION_INPUT_INVALID", "Native validation inputs are invalid");
+        }
+        const source = await bindGeneratedSource({ generatedSource }, cwd(), templateFile);
+        if (source === undefined)
+            throw sourceBindingError();
+        if (track === "terraform") {
+            const cache = resolve(source.rootPath, ".terraform");
+            const existing = await lstat(cache).catch((error) => {
+                if (error.code === "ENOENT")
+                    return undefined;
+                throw sourceBindingError();
+            });
+            if (existing !== undefined)
+                throw sourceBindingError();
+        }
+        let scratchRoot;
+        try {
+            try {
+                scratchRoot = await mkdtemp(resolve(await realpath(tmpdir()), "apex-native-validation-"));
+                for (const path of source.paths) {
+                    const destination = resolve(scratchRoot, path);
+                    if (!destination.startsWith(`${scratchRoot}${sep}`))
+                        throw sourceBindingError();
+                    await mkdir(dirname(destination), { recursive: true, mode: 0o700 });
+                    await writeFile(destination, source.fileContents.get(path), { flag: "wx", mode: 0o600 });
+                }
+            }
+            catch {
+                throw sourceBindingError();
+            }
+            const scratch = await readGeneratedSource({ rootPath: scratchRoot, treeHash: source.treeHash });
+            const outputs = new Set();
+            if (track === "terraform") {
+                outputs.add(resolve(scratchRoot, ".terraform"));
+                outputs.add(resolve(scratchRoot, ".terraform.lock.hcl"));
+            }
+            const verify = async () => {
+                if (cwd() === undefined)
+                    throw sourceBindingError();
+                await bindGeneratedSource({ generatedSource }, cwd(), templateFile);
+                if (track === "terraform") {
+                    for (const path of [".terraform", ".terraform.lock.hcl"]) {
+                        if (source.paths.has(path))
+                            continue;
+                        const metadata = await lstat(resolve(source.rootPath, path)).catch((error) => {
+                            if (error.code === "ENOENT")
+                                return undefined;
+                            throw sourceBindingError();
+                        });
+                        if (metadata !== undefined)
+                            throw sourceBindingError();
+                    }
+                }
+                await readGeneratedSource(scratch, scratch, outputs);
+            };
+            let compiledTemplate;
+            for (const command of commands) {
+                await verify();
+                try {
+                    const result = await this.runner.run({
+                        executable: command.executable,
+                        args: [...command.args],
+                        cwd: scratchRoot,
+                        timeoutMs: this.#timeoutMs,
+                        maxOutputBytes: this.#maxOutputBytes,
+                    });
+                    if (result.exitCode !== 0 ||
+                        result.signal !== null ||
+                        result.timedOut !== false ||
+                        result.outputTruncated !== false)
+                        throw new Error();
+                    if (command.validatorId === "bicep:build")
+                        compiledTemplate = result.stdout;
+                }
+                catch {
+                    throw new IacProviderError("NATIVE_VALIDATION_FAILED", "Native validation command failed");
+                }
+                finally {
+                    await verify();
+                }
+            }
+            if (parityManifest !== undefined) {
+                receipt.resourceParity = validateBicepResourceParity({
+                    sourceHash: receipt.sourceHash,
+                    manifest: parityManifest,
+                    ...(parityBinding === undefined ? {} : { binding: parityBinding }),
+                    json: compiledTemplate ?? "",
+                });
+                const { receiptHash: previousHash, ...updated } = receipt;
+                if (!previousHash)
+                    throw sourceBindingError();
+                receipt.receiptHash = calculateNativeValidationReceiptHash(updated);
+            }
+            if (parityManifest !== undefined && parityBinding !== undefined) {
+                receipt.securityBaseline = validateBicepStorageBaseline({
+                    sourceHash: receipt.sourceHash,
+                    manifest: parityManifest,
+                    binding: parityBinding,
+                    json: compiledTemplate ?? "",
+                });
+                const { receiptHash: previousHash, ...updated } = receipt;
+                if (!previousHash)
+                    throw sourceBindingError();
+                receipt.receiptHash = calculateNativeValidationReceiptHash(updated);
+            }
+            if (diagnosticsTargets !== undefined) {
+                receipt.storageDiagnostics = Object.fromEntries(Object.entries(diagnosticsTargets).map(([logicalId, target]) => [
+                    logicalId,
+                    validateBicepStorageDiagnostics({
+                        ...target,
+                        sourceHash: receipt.sourceHash,
+                        json: compiledTemplate ?? "",
+                    }),
+                ]));
+                const { receiptHash: previousHash, ...updated } = receipt;
+                if (!previousHash)
+                    throw sourceBindingError();
+                receipt.receiptHash = calculateNativeValidationReceiptHash(updated);
+            }
+            if (track === "bicep" && policyInput !== undefined && hasActionablePolicyMappings(policyInput.policyMap)) {
+                let policyValidation;
+                try {
+                    policyValidation = validatePolicyProperties({
+                        ...policyInput,
+                        track,
+                        sourceHash: receipt.sourceHash,
+                        policyMapHash: receipt.policyHash,
+                        json: compiledTemplate ?? "",
+                    });
+                    if (policyValidation.outcome !== "pass")
+                        throw new Error();
+                }
+                catch {
+                    throw new IacProviderError("NATIVE_VALIDATION_FAILED", "Native policy property validation failed");
+                }
+                finally {
+                    await verify();
+                }
+                receipt.policyValidation = policyValidation;
+                const { receiptHash, ...updated } = receipt;
+                if (!receiptHash)
+                    throw new IacProviderError("NATIVE_VALIDATION_FAILED", "Native validation receipt is missing");
+                receipt = { ...updated, receiptHash: calculateNativeValidationReceiptHash(updated) };
+            }
+            if (storageBindings !== undefined && Object.keys(storageBindings).length > 0) {
+                const observations = validateStorageSecurityBindings({
+                    track,
+                    bindings: storageBindings,
+                    sourceHash: receipt.sourceHash,
+                    json: compiledTemplate ?? "",
+                });
+                const storageSecurity = Object.fromEntries(Object.entries(observations).map(([logicalId, observation]) => {
+                    return [logicalId, { ...observation, results: [...observation.results] }];
+                }));
+                await verify();
+                const { receiptHash, ...body } = receipt;
+                if (!receiptHash)
+                    throw new IacProviderError("NATIVE_VALIDATION_FAILED", "Native validation receipt is missing");
+                const updated = { ...body, storageSecurity };
+                receipt = { ...updated, receiptHash: calculateNativeValidationReceiptHash(updated) };
+            }
+            return receipt;
+        }
+        finally {
+            if (scratchRoot !== undefined) {
+                await rm(scratchRoot, { recursive: true, force: true }).catch(() => {
+                    throw sourceBindingError();
+                });
+            }
+        }
+    }
     async authorize(track, operation, preview, approval, suppliedAuthority, latestPreviewHash) {
         const authority = await this.currentAuthority();
         if (authority.head !== suppliedAuthority.head ||
@@ -100,6 +488,58 @@ class NativeProviderBase {
     executionEvidence(operationId) {
         return this.#executionEvidence.get(operationId);
     }
+    policyValidation(previewHash) {
+        const receipt = this.#policyValidations.get(previewHash);
+        return receipt === undefined ? undefined : structuredClone(receipt);
+    }
+    evaluatePolicy(track, request, json, blockers) {
+        const input = request.policyValidation;
+        if (input === undefined || !hasActionablePolicyMappings(input.policyMap))
+            return {};
+        const receipt = validatePolicyProperties({
+            ...input,
+            track,
+            sourceHash: request.iacHash,
+            policyMapHash: request.policyHash,
+            json,
+        });
+        if (receipt.projectId !== request.projectId || receipt.runId !== request.runId) {
+            blockers.push("Policy validation project/run does not match the preview");
+        }
+        for (const result of receipt.results) {
+            if (result.outcome !== "pass") {
+                blockers.push(`Policy validation mapping ${result.mappingIndex}: ${result.outcome} (${result.reason})`);
+            }
+        }
+        return {
+            policyValidation: receipt,
+            policyValidationBinding: nativePolicyValidationBinding(receipt),
+        };
+    }
+    rememberPolicy(preview, binding) {
+        if (binding.policyValidation !== undefined) {
+            this.#policyValidations.set(preview.previewHash, structuredClone(binding.policyValidation));
+        }
+    }
+    verifyPolicy(preview, binding) {
+        const receipt = binding.policyValidation;
+        const expected = binding.policyValidationBinding;
+        if (receipt === undefined && expected === undefined)
+            return;
+        if (receipt === undefined ||
+            expected === undefined ||
+            !hasValidPolicyValidation(receipt, expected) ||
+            receipt.receiptHash !== expected.receiptHash ||
+            receipt.track !== preview.track ||
+            receipt.sourceHash !== preview.iacHash ||
+            receipt.policyMapHash !== preview.policyHash ||
+            receipt.projectId !== preview.projectId ||
+            receipt.runId !== preview.runId ||
+            preview.operation !== "apply" ||
+            receipt.outcome !== "pass") {
+            throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Policy validation receipt does not match the preview");
+        }
+    }
     previewKey(request, operation) {
         return `${request.projectId}\u0000${request.runId}\u0000${operation}`;
     }
@@ -152,10 +592,26 @@ export class NativeBicepProvider extends NativeProviderBase {
         }
     }
     async validate() {
-        await this.run(this.#commands.validate(this.#target.templateFile, this.#target.cwd));
+        await this.#compiledTemplate();
         return [];
     }
+    async validateSource(request) {
+        return await this.validateBoundSource(request, this.track, () => this.#target.cwd, this.#target.templateFile);
+    }
     async previewApply(request) {
+        if (request.policyValidation !== undefined) {
+            try {
+                calculatePolicyValidationDigest(request.policyValidation);
+                request = { ...request, policyValidation: structuredClone(request.policyValidation) };
+            }
+            catch {
+                throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Bicep policy validation inputs are invalid");
+            }
+        }
+        const source = await bindGeneratedSource(request, this.#target.cwd, this.#target.templateFile, this.#target.parametersFile);
+        const policyInputs = request.policyValidation?.policyMap.mappings.length
+            ? await this.#inputHashes(source)
+            : undefined;
         const [stdout, stackResources] = await Promise.all([
             this.run(this.#commands.preview(this.#target)),
             this.#currentStackResources(),
@@ -166,14 +622,26 @@ export class NativeBicepProvider extends NativeProviderBase {
         if (unrepresented.length > 0) {
             normalized.blockers.push(`Group what-if cannot prove action-on-unmanage behavior for current stack resources: ${unrepresented.map(({ resourceId }) => resourceId).join(", ")}`);
         }
-        return await this.#bind(request, "apply", normalized, stackResources);
+        let policy = {};
+        if (policyInputs !== undefined) {
+            let compiled = "";
+            try {
+                compiled = await this.#compiledTemplate();
+            }
+            catch {
+                normalized.blockers.push("Policy validation compiler output is unavailable");
+            }
+            policy = this.evaluatePolicy(this.track, request, compiled, normalized.blockers);
+        }
+        return await this.#bind(request, "apply", normalized, stackResources, policy, policyInputs, source);
     }
     async previewDestroy(request) {
+        const source = await bindGeneratedSource(request, this.#target.cwd, this.#target.templateFile, this.#target.parametersFile);
         const resources = await this.#currentStackResources();
         return await this.#bind(request, "destroy", {
             changes: resources.map((resource) => ({ resourceId: resource.resourceId, action: "delete", material: true })),
             blockers: [],
-        }, resources);
+        }, resources, {}, undefined, source);
     }
     async apply(preview, approval, authority) {
         return await this.#execute("apply", preview, approval, authority);
@@ -192,21 +660,16 @@ export class NativeBicepProvider extends NativeProviderBase {
             resources: [...resources],
         };
     }
-    async #bind(request, operation, normalized, stackResources) {
-        const templateHash = await this.#rawFileHash(this.#target.templateFile);
-        const parametersHash = this.#target.parametersFile === undefined
-            ? createHash("sha256").update(Buffer.alloc(0)).digest("hex")
-            : await this.#rawFileHash(this.#target.parametersFile);
+    async #bind(request, operation, normalized, stackResources, policy = {}, policyInputs, source) {
+        if (source !== undefined)
+            await readGeneratedSource(source, source);
+        const { templateHash, parametersHash } = await this.#inputHashes(source);
+        if (policyInputs !== undefined &&
+            (policyInputs.templateHash !== templateHash || policyInputs.parametersHash !== parametersHash)) {
+            normalized.blockers.push("Bicep inputs changed during policy validation preview");
+        }
         const stackStateHash = sha256(stackResources);
-        const providerBindingHash = sha256({
-            resourceGroup: this.#target.resourceGroup,
-            stackName: this.#target.stackName,
-            actionOnUnmanage: this.#target.actionOnUnmanage,
-            denySettingsMode: this.#target.denySettingsMode,
-            templateHash,
-            parametersHash,
-            stackStateHash,
-        });
+        const providerBindingHash = this.#providerBindingHash(templateHash, parametersHash, stackStateHash, policy);
         const preview = this.createPreview(this.track, operation, request, normalized, {
             artifactHash: providerBindingHash,
         });
@@ -217,11 +680,49 @@ export class NativeBicepProvider extends NativeProviderBase {
             templateHash,
             parametersHash,
             stackStateHash,
+            ...policy,
         };
         this.#bindings.set(this.previewKey(request, operation), binding);
         await this.bindingStore?.save(preview.previewHash, binding);
+        this.rememberPolicy(preview, binding);
         return preview;
     }
+    #providerBindingHash(templateHash, parametersHash, stackStateHash, policy) {
+        return sha256({
+            resourceGroup: this.#target.resourceGroup,
+            stackName: this.#target.stackName,
+            actionOnUnmanage: this.#target.actionOnUnmanage,
+            denySettingsMode: this.#target.denySettingsMode,
+            templateHash,
+            parametersHash,
+            stackStateHash,
+            ...(policy.policyValidationBinding === undefined ? {} : { policyValidation: policy.policyValidationBinding }),
+        });
+    }
+    async #inputHashes(source) {
+        const fileHash = async (file) => {
+            if (source === undefined)
+                return await this.#rawFileHash(file);
+            const path = relative(source.rootPath, resolve(source.rootPath, file)).split(sep).join("/");
+            const hash = source.fileHashes.get(path);
+            if (hash === undefined)
+                throw sourceBindingError();
+            return hash;
+        };
+        return {
+            templateHash: await fileHash(this.#target.templateFile),
+            parametersHash: this.#target.parametersFile === undefined
+                ? createHash("sha256").update(Buffer.alloc(0)).digest("hex")
+                : await fileHash(this.#target.parametersFile),
+        };
+    }
+    async #compiledTemplate() {
+        return await this.run({
+            executable: "bicep",
+            args: ["build", this.#target.templateFile, "--stdout"],
+            ...(this.#target.cwd === undefined ? {} : { cwd: this.#target.cwd }),
+        });
+    }
     async #rawFileHash(path) {
         const filePath = isAbsolute(path) ? path : resolve(this.#target.cwd ?? process.cwd(), path);
         return createHash("sha256")
@@ -247,17 +748,23 @@ export class NativeBicepProvider extends NativeProviderBase {
         if (binding === undefined || binding.preview.previewHash !== preview.previewHash) {
             throw new IacProviderError("PREVIEW_HASH_MISMATCH", "No exact Bicep stack binding is available for this preview");
         }
-        const templateHash = await this.#rawFileHash(this.#target.templateFile);
-        const parametersHash = this.#target.parametersFile === undefined
-            ? createHash("sha256").update(Buffer.alloc(0)).digest("hex")
-            : await this.#rawFileHash(this.#target.parametersFile);
+        this.verifyPolicy(preview, binding);
+        if (binding.policyValidationBinding !== undefined &&
+            createHash("sha256")
+                .update(await this.#compiledTemplate())
+                .digest("hex") !== binding.policyValidationBinding.inputHash) {
+            throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Bicep compiler output changed after policy validation");
+        }
+        const { templateHash, parametersHash } = await this.#inputHashes();
         const stackStateHash = sha256(await this.#currentStackResources());
         if (templateHash !== binding.templateHash ||
             parametersHash !== binding.parametersHash ||
             stackStateHash !== binding.stackStateHash ||
-            preview.artifactHash !== binding.providerBindingHash) {
+            preview.artifactHash !== binding.providerBindingHash ||
+            preview.artifactHash !== this.#providerBindingHash(templateHash, parametersHash, stackStateHash, binding)) {
             throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Bicep stack inputs, configuration, or managed state changed after preview");
         }
+        this.rememberPolicy(preview, binding);
         const stdout = await this.run(operation === "apply" ? this.#commands.stackApply(this.#target) : this.#commands.stackDestroy(this.#target));
         let providerOperationId;
         if (stdout.trim().length > 0) {
@@ -289,6 +796,9 @@ export class NativeTerraformProvider extends NativeProviderBase {
         }
         return [];
     }
+    async validateSource(request) {
+        return await this.validateBoundSource(request, this.track, () => this.#target.cwd);
+    }
     async previewApply(request) {
         return await this.#preview(request, "apply");
     }
@@ -352,8 +862,39 @@ export class NativeTerraformProvider extends NativeProviderBase {
         if (this.#keyProvider === undefined || this.#artifactStore === undefined || this.bindingStore === undefined) {
             throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Terraform local/reference plan transport requires injected key, artifact, and binding stores");
         }
-        const planPath = this.#target.planPath(request, operation);
+        if (operation === "apply" && request.policyValidation !== undefined) {
+            try {
+                calculatePolicyValidationDigest(request.policyValidation);
+                request = { ...request, policyValidation: structuredClone(request.policyValidation) };
+            }
+            catch {
+                throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Terraform policy validation inputs are invalid");
+            }
+        }
+        const source = await bindGeneratedSource(request, this.#target.cwd);
+        const requestedPlanPath = this.#target.planPath(request, operation);
+        const planPath = source === undefined ? requestedPlanPath : resolve(source.rootPath, requestedPlanPath);
+        const outputs = new Set();
+        if (source !== undefined) {
+            const relativePlanPath = relative(source.rootPath, planPath).split(sep).join("/");
+            if (source.paths.has(relativePlanPath) ||
+                planPath === source.rootPath ||
+                [...source.paths].some((path) => path.startsWith(`${relativePlanPath}/`)) ||
+                /\.(?:tf|tfvars)(?:\.json)?$/i.test(planPath) ||
+                relativePlanPath === ".terraform.lock.hcl" ||
+                relativePlanPath === ".terraform" ||
+                relativePlanPath.startsWith(".terraform/") ||
+                [...source.paths].some((path) => path.startsWith(".terraform/"))) {
+                throw sourceBindingError();
+            }
+            outputs.add(planPath);
+            outputs.add(resolve(source.rootPath, ".terraform"));
+            outputs.add(resolve(source.rootPath, ".terraform.lock.hcl"));
+        }
         await this.run(this.#commands.init(this.#target.cwd, true));
+        const policyExpected = operation === "apply" && Boolean(request.policyValidation?.policyMap.mappings.length);
+        const initialConfigHash = policyExpected ? await this.#target.configHash() : undefined;
+        const initialLockfileHash = this.#target.lockfileHash;
         const stateIdentity = terraformStateIdentityOutput(await this.run(this.#commands.statePull(this.#target.cwd)));
         await this.run(this.#commands.preview(this.#target.cwd, planPath, operation === "destroy"));
         try {
@@ -361,6 +902,13 @@ export class NativeTerraformProvider extends NativeProviderBase {
             const planDigest = createHash("sha256").update(planBytes).digest("hex");
             const showOutput = await this.run(this.#commands.showJson(this.#target.cwd, planPath));
             const normalized = normalizeTerraformPlan(parseJsonProcessOutput("terraform-plan", showOutput));
+            const policy = policyExpected ? this.evaluatePolicy(this.track, request, showOutput, normalized.blockers) : {};
+            if (policyExpected &&
+                createHash("sha256")
+                    .update(await readFile(planPath))
+                    .digest("hex") !== planDigest) {
+                normalized.blockers.push("Terraform saved plan changed during policy validation preview");
+            }
             const authority = await this.currentAuthority();
             if (authority.ownerEpoch !== request.ownerEpoch ||
                 authority.head !== request.commit ||
@@ -373,14 +921,22 @@ export class NativeTerraformProvider extends NativeProviderBase {
                 ttlMs: request.ttlMs,
             });
             const artifactRef = `${request.projectId}/${request.runId}/${operation}/${planDigest}.tfplan.enc`;
-            await this.#artifactStore.put(artifactRef, encrypted);
             const configHash = await this.#target.configHash();
+            if (source !== undefined) {
+                if (resolve(this.#target.cwd) !== source.rootPath)
+                    throw sourceBindingError();
+                await readGeneratedSource(source, source, outputs);
+            }
+            if (policyExpected && (configHash !== initialConfigHash || this.#target.lockfileHash !== initialLockfileHash)) {
+                normalized.blockers.push("Terraform configuration changed during policy validation preview");
+            }
             const artifactHash = sha256({
                 planDigest,
                 configHash,
                 lockfileHash: this.#target.lockfileHash,
                 recipient: executionRecipient,
                 artifactRef,
+                ...(policy.policyValidationBinding === undefined ? {} : { policyValidation: policy.policyValidationBinding }),
             });
             const preview = this.createPreview(this.track, operation, request, normalized, {
                 artifactHash,
@@ -415,9 +971,11 @@ export class NativeTerraformProvider extends NativeProviderBase {
                 createdAt: createdAt.toISOString(),
                 expiresAt: preview.expiresAt,
             };
-            const binding = { kind: "terraform", preview, attestation };
+            const binding = { kind: "terraform", preview, attestation, ...policy };
+            await this.#artifactStore.put(artifactRef, encrypted);
             this.#bindings.set(this.previewKey(request, operation), binding);
             await this.bindingStore.save(preview.previewHash, binding);
+            this.rememberPolicy(preview, binding);
             return preview;
         }
         finally {
@@ -435,12 +993,16 @@ export class NativeTerraformProvider extends NativeProviderBase {
         if (binding === undefined) {
             throw new IacProviderError("PREVIEW_HASH_MISMATCH", "No exact saved plan is bound to this preview");
         }
+        this.verifyPolicy(preview, binding);
         if (binding.attestation.recipient !== authority.recipientIdentity) {
             throw new IacProviderError("APPROVAL_RECIPIENT_MISMATCH", "Saved plan recipient is not the current authority");
         }
         if (binding.attestation.configHash !== (await this.#target.configHash()) ||
             binding.attestation.lockfileHash !== this.#target.lockfileHash ||
             binding.attestation.inputHash !== preview.inputHash ||
+            binding.attestation.iacHash !== preview.iacHash ||
+            binding.attestation.policyHash !== preview.policyHash ||
+            binding.attestation.previewHash !== preview.previewHash ||
             binding.attestation.stateLineage !== preview.stateLineage ||
             binding.attestation.stateSerial !== preview.stateSerial) {
             throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Saved plan attestation does not match the preview");
@@ -456,10 +1018,12 @@ export class NativeTerraformProvider extends NativeProviderBase {
             lockfileHash: binding.attestation.lockfileHash,
             recipient: binding.attestation.recipient,
             artifactRef: binding.attestation.artifactRef,
+            ...(binding.policyValidationBinding === undefined ? {} : { policyValidation: binding.policyValidationBinding }),
         });
         if (preview.artifactHash !== providerArtifactHash) {
             throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Terraform provider binding hash does not match the preview");
         }
+        this.rememberPolicy(preview, binding);
         if (this.#keyProvider === undefined || this.#artifactStore === undefined) {
             throw new IacProviderError("PREVIEW_HASH_MISMATCH", "Terraform plan decryption dependencies are unavailable");
         }