@azure/provisioning-core 1.0.0-beta.1

package/dist/commonjs/constructs/resource/resource.js

@@ -0,0 +1,455 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var resource_exports = {};
+__export(resource_exports, {
+  Loop: () => Loop,
+  LoopedResource: () => LoopedResource,
+  Resource: () => Resource,
+  ResourceDeclaration: () => ResourceDeclaration,
+  createLoopedResource: () => createLoopedResource
+});
+module.exports = __toCommonJS(resource_exports);
+var import_provisioning_component = require("../provisioning-component.js");
+var import_expressions = require("../../expression/expressions.js");
+var import_ast_nodes = require("../../expression/ast-nodes.js");
+var import_naming_policy = require("../../naming/naming-policy.js");
+var import_resource_proxy = require("./resource-proxy.js");
+var import_resource_utils = require("./resource-utils.js");
+var import_shape_registry = require("../../shape/shape-registry.js");
+var import_resource_registry = require("./resource-registry.js");
+class ResourceDeclaration extends import_provisioning_component.ProvisioningComponent {
+  /**
+   * Brand marker for cross-realm `isResourceDeclaration()` checks. Uses
+   * `Symbol.for` so it survives multiple copies of `@azure/provisioning-core`.
+   * Inherited by every resource declaration implementation.
+   */
+  [import_resource_proxy.RESOURCE_DECLARATION_BRAND] = true;
+  // Not `readonly`: the ctor writes `this.state = data` once. TypeScript
+  // forbids subclass writes to a `readonly` parent field, so the
+  // immutability is a runtime contract (never reassigned after ctor)
+  // rather than a static one.
+  state;
+  /**
+   * Base constructor for every Bicep resource declaration.
+   *
+   * @remarks
+   *
+   * Responsibilities:
+   * 1. Register in the component tree (`super(context)`).
+   * 2. Enforce a deployment context ancestor.
+   * 3. Unwrap `context` if it's an indexed proxy from `.at(i)` /
+   *    `parent.at(loop.index)`, and stash `parentIndex` on `state` so the
+   *    serializer can emit `parent: parentSym[index]` on the child.
+   * 4. Inherit `condition` from the immediate parent resource
+   *    declaration when the caller doesn't supply one (Bicep requires
+   *    children of a conditional resource to share the same guard).
+   * 5. Populate `state` — existing arm records only identity fields;
+   *    deployable arm runs the naming policy and applies
+   *    `DeploymentContext` defaults for `location` / `tags` per the
+   *    shape descriptor.
+   *
+   * Subclasses supply the last mile, including their public handle behavior.
+   *
+   * @param namingRules - per-resource-type constraints for the naming
+   *   policy. `Resource` reads this reflectively off the concrete subclass
+   *   constructor; internal declaration implementations receive it from
+   *   the concrete resource constructor they represent.
+   */
+  constructor(context, props, options, namingRules) {
+    super(context);
+    if (!this.hasDeploymentContext()) {
+      throw new Error("Resource declaration must have a parent deployment context.");
+    }
+    const indexRef = context[import_resource_proxy.PROXY_INDEX_REF];
+    let parentIndex = void 0;
+    if (indexRef !== void 0) {
+      const rawParent = context[import_resource_proxy.INDEXED_PROXY_TARGET];
+      if (rawParent !== void 0) {
+        this.parent = rawParent;
+      }
+      parentIndex = indexRef;
+    }
+    const isExisting = props.existing === true;
+    const parent = this.parent;
+    const inheritedCondition = (0, import_resource_utils.isResourceDeclaration)(parent) ? parent.self.state["condition"] : void 0;
+    const explicitCondition = options?.condition;
+    const condition = explicitCondition !== void 0 && inheritedCondition !== void 0 ? (0, import_expressions.createBinaryExpression)("&&", inheritedCondition, explicitCondition) : explicitCondition ?? inheritedCondition;
+    const dependsOn = options?.dependsOn;
+    let data;
+    if (isExisting) {
+      if (props.name === void 0) {
+        throw new Error(`Resource ${props.type} marked as 'existing' but no 'name' was provided.`);
+      }
+      data = {
+        name: props.name,
+        type: props.type,
+        apiVersion: props.apiVersion,
+        existing: true,
+        scope: props.scope === void 0 ? void 0 : (0, import_expressions.unwrapExpression)(props.scope),
+        condition,
+        dependsOn
+      };
+      if (parentIndex !== void 0) {
+        data[import_resource_proxy.STATE_PARENT_INDEX] = parentIndex;
+      }
+    } else {
+      const {
+        name: _name,
+        type: _type,
+        apiVersion: _apiVersion,
+        existing: _existing,
+        scope: _scope,
+        ...userProps
+      } = props;
+      const ctx = this.deploymentContext;
+      data = {
+        name: (0, import_naming_policy.resolveResourceName)(
+          ctx.namingPolicy ?? import_naming_policy.namingRequiredPolicy,
+          props.name,
+          props.type,
+          namingRules
+        ),
+        type: props.type,
+        apiVersion: props.apiVersion,
+        condition,
+        dependsOn,
+        ...userProps
+      };
+      if (parentIndex !== void 0) {
+        data[import_resource_proxy.STATE_PARENT_INDEX] = parentIndex;
+      }
+      const shape = (0, import_shape_registry.getShape)(props.type, props.apiVersion, data);
+      if (shape !== void 0) {
+        const locationShape = shape.byJsName["location"];
+        if (locationShape !== void 0 && locationShape.readOnly !== true && data["location"] === void 0 && ctx.location !== void 0) {
+          data["location"] = ctx.location;
+        }
+        const tagsShape = shape.byJsName["tags"];
+        if (tagsShape !== void 0 && tagsShape.readOnly !== true && data["tags"] === void 0 && ctx.tags !== void 0 && Object.keys(ctx.tags).length > 0) {
+          data["tags"] = { ...ctx.tags };
+        }
+      }
+    }
+    this.state = data;
+  }
+  /**
+   * Core-internal escape hatch: exposes the raw `state` backing object to
+   * the proxy layer (`resource-proxy.ts`) so it can read/unwrap the
+   * declaration's data across module boundaries. Keyed by the
+   * module-scoped {@link RAW_RESOURCE_HANDLE} symbol, which is **not**
+   * exported from `@azure/provisioning-core`, so package consumers can't name it.
+   *
+   * `protected` (not `private`) because the accessors that read it use
+   * `Reflect.get` / structural casts that bypass TS visibility anyway;
+   * the modifier just keeps it off the public type surface. It can't be a
+   * `#private` field because the proxy layer lives in a different class.
+   *
+   * @internal
+   */
+  get [import_resource_proxy.RAW_RESOURCE_HANDLE]() {
+    return this.state;
+  }
+  get type() {
+    return this.state.type;
+  }
+  get apiVersion() {
+    return this.state.apiVersion;
+  }
+  get existing() {
+    return this.state.existing;
+  }
+  get condition() {
+    return this.state.condition;
+  }
+  get dependsOn() {
+    return this.state.dependsOn;
+  }
+  expr(...path) {
+    return (0, import_resource_proxy.createResourceMemberProxy)(
+      {
+        resource: this,
+        root: (0, import_resource_proxy.unwrapResourceHandle)(this)
+      },
+      path
+    );
+  }
+  setProperty(key, value) {
+    this.state[key] = (0, import_resource_proxy.normalizeAssignedValue)(value, this);
+  }
+}
+class Resource extends ResourceDeclaration {
+  /**
+   * Brand marker for cross-realm `isResource()` checks.
+   * Uses `Symbol.for` so it survives multiple copies of `@azure/provisioning-core`.
+   */
+  [import_resource_proxy.RESOURCE_BRAND] = true;
+  /**
+   * Register a {@link FlatModelShape} for this resource class's
+   * `(resourceType, apiVersion)` pair. Intended to be invoked from a
+   * `static {}` initializer in generated subclasses so the registration
+   * happens at module load.
+   *
+   * The static method reads `resourceType` and `apiVersion` off `this`
+   * (the subclass that called it), so callers don't repeat the literals.
+   */
+  static registerShape(shape, variantSelector) {
+    (0, import_shape_registry.registerShape)(this.resourceType, this.apiVersion, shape, variantSelector);
+  }
+  /**
+   * Register this class with the global resource registry so the
+   * deserializer can reconstruct instances of it (instead of falling
+   * back to base `Resource`) for matching `(resourceType, apiVersion)`
+   * pairs. Intended to be invoked from a `static {}` initializer in
+   * generated classes alongside {@link Resource.registerShape}.
+   *
+   * Pass an ordered discriminator path for concrete resource variants. A
+   * singleton is one segment (`name=signin`); model-discriminated resources
+   * may use `kind` or several nested segments. Omit for ordinary resources.
+   */
+  static register(variantSelector) {
+    (0, import_resource_registry.registerResource)(this, variantSelector);
+  }
+  /**
+   * Assemble the base-`Resource` constructor payload (the second `super(...)`
+   * argument) from the user-facing props. This is a **static "virtual"**:
+   * it runs before an instance exists (to compute the `super` argument), so
+   * it can't be an instance method — but it still dispatches through the
+   * calling constructor, so a subclass's override wins.
+   *
+   * Every emitter-generated resource overrides this to inject its fixed
+   * identity (`type` / `apiVersion`), the singleton `name`, and its explicit
+   * writable-field copy. Both ordinary construction and internal resource
+   * reconstruction funnel through this method so prop shaping remains
+   * consistent.
+   *
+   * This base default is the fallback used when the wrapped constructor is
+   * base `Resource` itself — the deserialize path for an unregistered
+   * `(type, apiVersion)` pair, where `type` / `apiVersion` are threaded in
+   * through `props` rather than read off statics. Keeping the default here
+   * guarantees the method is always present for internal reconstruction.
+   */
+  static buildResourceProps(props) {
+    const p = props ?? {};
+    return {
+      ...p,
+      type: p["type"] ?? this.resourceType,
+      apiVersion: p["apiVersion"] ?? this.apiVersion
+    };
+  }
+  /**
+   * Per-resource-type naming constraints, consumed by the active
+   * {@link NamingPolicy} when a resource is created without an explicit
+   * `name`. Generated CDK subclasses override this with a concrete value;
+   * the base default of `undefined` yields `MOST_RESTRICTIVE` behavior.
+   *
+   * This is type metadata, not user input, so it is kept off the public
+   * props surface and read reflectively in the constructor via
+   * `this.constructor` rather than being threaded through `ResourceProps`.
+   */
+  static namingRules;
+  _selfProxy;
+  constructor(context, props, options) {
+    super(
+      context,
+      props,
+      options,
+      // Naming rules live as a `protected static namingRules` field on
+      // each concrete resource subclass, not on the public props bag.
+      // Read reflectively off `new.target` (the most-derived class being
+      // instantiated) — `this.constructor` would work too but TS forbids
+      // touching `this` before `super()`. Static inheritance falls back
+      // to `Resource`'s `undefined` default when a subclass omits the
+      // field (e.g. singleton children). `resolveResourceName` (called
+      // inside `ResourceDeclaration`) treats `undefined` as
+      // `MOST_RESTRICTIVE`.
+      new.target.namingRules
+    );
+    const proxy = (0, import_resource_proxy.createResourceProxy)(this);
+    this._selfProxy = proxy;
+    const idx = context.children.indexOf(this);
+    if (idx >= 0) context.children[idx] = proxy;
+    return proxy;
+  }
+  get self() {
+    return this._selfProxy ?? this;
+  }
+  /**
+   * The Azure resource name as a Bicep symbolic-reference expression.
+   *
+   * The value is established at construction time (either user-supplied
+   * via `props.name` or filled in by the naming policy) and stored on
+   * `state.name`. The setter routes through `setProperty` so post-
+   * construction edits flow through the same proxy/expression machinery
+   * as any other property — useful when working with a base `Resource`
+   * reference and re-binding the name dynamically. Singleton subclasses
+   * override this getter to narrow the return type to the literal
+   * `Expression<"<singletonName>">`; non-singleton subclasses inherit
+   * this accessor pair as-is.
+   */
+  get name() {
+    return this.expr("name");
+  }
+  set name(value) {
+    this.setProperty("name", value);
+  }
+  get id() {
+    return this.expr("id");
+  }
+}
+class Loop {
+  collection;
+  itemVariable;
+  item;
+  batchSize;
+  // The default name assigned to `indexVariable` on first materialization,
+  // if the caller neither passed `{ indexVariable }` nor accessed `.index`.
+  #defaultIndexVariable;
+  #indexVariable;
+  #indexExpr;
+  #indexRequested = false;
+  constructor(collection, options) {
+    this.collection = collection;
+    this.itemVariable = options?.itemVariable ?? "item";
+    this.#defaultIndexVariable = "i";
+    if (options?.indexVariable !== void 0) {
+      this.#indexVariable = options.indexVariable;
+      this.#indexRequested = true;
+    }
+    if (options?.batchSize !== void 0) {
+      this.batchSize = options.batchSize;
+    }
+    this.item = (0, import_expressions.wrapExpression)((0, import_ast_nodes.symbolicValueExpressionNode)(this.itemVariable));
+  }
+  /**
+   * Name of the loop's index variable. Always defined — reading it
+   * materializes the default (`i`) if the caller neither passed
+   * `{ indexVariable }` nor accessed `.index` yet.
+   *
+   * Reading `.indexVariable` also marks the index as requested (same as
+   * reading `.index`), because a caller who wants the variable name is
+   * almost certainly going to use it. If the wire-omit optimization
+   * (bare `[for item in …]` with no index binding) matters, callers
+   * should gate on `.indexRequested` first before touching this getter.
+   */
+  get indexVariable() {
+    this.#indexRequested = true;
+    if (this.#indexVariable === void 0) {
+      this.#indexVariable = this.#defaultIndexVariable;
+    }
+    return this.#indexVariable;
+  }
+  /**
+   * Expression referencing the current iteration's index. Reading this the
+   * first time marks the index as requested, which causes the wire to
+   * include `indexVariable` on the `for-expression` node and the renderer
+   * to emit `[for (item, i) in …]`. Callers who never touch `.index` get
+   * the cleaner index-less form.
+   */
+  get index() {
+    this.#indexRequested = true;
+    if (this.#indexExpr === void 0) {
+      const name = this.indexVariable;
+      this.#indexExpr = (0, import_expressions.wrapExpression)((0, import_ast_nodes.symbolicValueExpressionNode)(name));
+    }
+    return this.#indexExpr;
+  }
+  /**
+   * Framework-internal signal used by `Resource.fromLoop` to decide
+   * whether the wire should include the index binding. `true` when the
+   * caller either supplied `{ indexVariable }` explicitly or has accessed
+   * `.index` / `.indexVariable` at least once. Not exported from
+   * `@azure/provisioning-core`.
+   *
+   * @internal
+   */
+  get indexRequested() {
+    return this.#indexRequested;
+  }
+}
+class LoopedResource extends ResourceDeclaration {
+  /**
+   * Cross-realm brand — same technique as the scalar `RESOURCE_BRAND`.
+   * Use {@link isLoopedResource} instead of `instanceof`
+   * when multiple copies of `@azure/provisioning-core` may be loaded.
+   */
+  [import_resource_proxy.LOOPED_RESOURCE_BRAND] = true;
+  /** Metadata describing the loop that produced this declaration. */
+  loop;
+  #wrappedCtor;
+  constructor(context, wrappedCtor, userProps, loop, options) {
+    const props = wrappedCtor.buildResourceProps.call(wrappedCtor, userProps);
+    super(
+      context,
+      props,
+      options,
+      wrappedCtor.namingRules
+    );
+    this.#wrappedCtor = wrappedCtor;
+    this.loop = {
+      collection: loop.collection,
+      itemVariable: loop.itemVariable,
+      ...loop.indexRequested ? { indexVariable: loop.indexVariable } : {},
+      ...loop.batchSize !== void 0 ? { batchSize: loop.batchSize } : {}
+    };
+  }
+  /**
+   * The concrete `Resource` subclass this looped declaration wraps.
+   * Used by query machinery to answer "which subclass is this looped
+   * resource" — the analogue of `instanceof T` for `LoopedResource<T>`.
+   *
+   * This is always the full subclass the user constructed via
+   * `Xxx.fromLoop(...)` — query identity matches on that class, and it is
+   * the prototype the `.at(i)` proxy uses to resolve ARM accessors.
+   */
+  get wrappedCtor() {
+    return this.#wrappedCtor;
+  }
+  /**
+   * Reference the element at `index`. Emits `sym[index].<...>` for
+   * subsequent property access.
+   *
+   * Returns the concrete resource type `T`. At runtime an indexed proxy is
+   * spliced over the full class prototype (`#wrappedCtor.prototype`):
+   * prototype getters that funnel through `this.expr(...)` (`.id`, `.name`,
+   * `.properties.*`, …) resolve rooted at `sym[index]`. A child created with
+   * `parent.at(i)` is stamped with that index for serialization.
+   */
+  at(index) {
+    return (0, import_resource_proxy.createIndexedResourceProxy)(this, index);
+  }
+}
+function createLoopedResource(wrappedCtor, loop, context, ...rest) {
+  const [userProps, options] = rest;
+  const LoopedCtor = LoopedResource;
+  return new LoopedCtor(
+    context,
+    wrappedCtor,
+    userProps,
+    loop,
+    options
+  );
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Loop,
+  LoopedResource,
+  Resource,
+  ResourceDeclaration,
+  createLoopedResource
+});
+//# sourceMappingURL=resource.js.map

package/dist/commonjs/constructs/resource/resource.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/constructs/resource/resource.ts"],
+  "sourcesContent": ["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport { ProvisioningComponent } from \"../provisioning-component.js\";\nimport {\n  createBinaryExpression,\n  unwrapExpression,\n  wrapExpression,\n  type Expression,\n  type ExpressionOrValue,\n} from \"../../expression/expressions.js\";\nimport type { ExpressionNode } from \"../../expression/ast-nodes.js\";\nimport { symbolicValueExpressionNode } from \"../../expression/ast-nodes.js\";\nimport type { PropertySegment } from \"../../types.js\";\nimport type { ResourceNamingRules } from \"../../naming/naming-rules.js\";\nimport { namingRequiredPolicy, resolveResourceName } from \"../../naming/naming-policy.js\";\nimport {\n  RAW_RESOURCE_HANDLE,\n  RESOURCE_BRAND,\n  RESOURCE_DECLARATION_BRAND,\n  LOOPED_RESOURCE_BRAND,\n  PROXY_INDEX_REF,\n  INDEXED_PROXY_TARGET,\n  STATE_PARENT_INDEX,\n  createIndexedResourceProxy,\n  createResourceMemberProxy,\n  createResourceProxy,\n  normalizeAssignedValue,\n  unwrapResourceHandle,\n} from \"./resource-proxy.js\";\nimport { isResourceDeclaration } from \"./resource-utils.js\";\nimport type { FlatModelShape } from \"../../shape/shape.js\";\nimport { getShape, registerShape as registerShapeInRegistry } from \"../../shape/shape-registry.js\";\nimport {\n  registerResource as registerResourceInRegistry,\n  type ResourceCtor,\n} from \"./resource-registry.js\";\nimport type { FlatVariantSelector } from \"./resource-type-registry.js\";\n\n// ---------------------------------------------------------------------------\n// Resource types\n// ---------------------------------------------------------------------------\n\n/**\n * A Bicep `scope:` expression. Used on `existing` resource references for\n * cross-RG / cross-subscription / cross-MG / cross-tenant lookups, and on\n * modules to set the nested deployment scope.\n *\n * Typed as `Expression<unknown>` because the natural producers are the\n * scope-function helpers in `fn` (`fn.resourceGroup(...)`,\n * `fn.subscription(...)`, `fn.managementGroup(...)`, `fn.tenant()`), all\n * of which return `Expression<TScope>` proxies. Narrowing further isn't\n * worthwhile today since the set of acceptable scope-producing\n * expressions isn't closed and Bicep validates the actual call shape\n * downstream.\n */\n// TODO: further narrow to allowed expression if possible?\nexport type ScopeExpression = Expression<unknown>;\n\n/**\n * Internal representation used to construct resource handle objects.\n * The proxy converts these into the public Resource shape.\n */\nexport interface ResourceState<TType extends string = string> {\n  name: ExpressionOrValue<string>;\n  readonly type: TType;\n  readonly apiVersion: string;\n  readonly existing?: boolean | undefined;\n  /**\n   * Optional Bicep `scope:` expression. Currently emitted only on `existing`\n   * resource references (e.g. `scope: resourceGroup('shared')` for a\n   * cross-RG lookup). Future scope-hoisted resource types may emit it on\n   * deployable resources too \u2014 for example, deploying a\n   * `Microsoft.Management/managementGroups` from a subscription-targeted\n   * file requires `scope: tenant()`. See `contributing/bicep/bicep-scope.md` section 2.2.\n   *\n   * For ordinary deployable resources this field is `undefined` \u2014 their\n   * deployment scope is determined by the file's `targetScope` (or by the\n   * containing `ResourceGroup` / module the resource lives in).\n   *\n   * Stored as a raw `ExpressionNode` (the user-facing `ScopeExpression`\n   * proxy is unwrapped at the constructor boundary, matching the\n   * \"`state` holds normalized raw nodes\" invariant that\n   * `normalizeAssignedValue` maintains for every other field).\n   */\n  readonly scope?: ExpressionNode | undefined;\n  readonly condition?: ExpressionOrValue<boolean> | undefined;\n}\n\n/**\n * Public-facing props for a reference to an existing (pre-deployed) Azure\n * resource. This is strictly narrower than the deployable resource props \u2014\n * Bicep `existing` declarations only accept `name` and optional `scope:`.\n *\n * Read-side access on the returned resource handle is unrestricted \u2014\n * `kv.properties.vaultUri`, `sa.id`, etc. all work and compile to symbolic\n * references that ARM resolves at deployment time.\n *\n * Symbolic parent/extension scopes are expressed by passing the parent\n * resource as the ProvisioningComponent `context` argument to the resource constructor\n * (with `{ existing: true }`), not via this `scope` field.\n */\nexport interface ExistingResourceProps {\n  /** Required. The actual Azure name of the existing resource. */\n  readonly name: ExpressionOrValue<string>;\n\n  /**\n   * Optional. The scope at which to look up the resource. Used when the\n   * resource lives outside the current deployment's scope (different RG,\n   * subscription, management group, or tenant).\n   *\n   * Pass a scope-function call expression (e.g. `resourceGroup(\"name\")`,\n   * `subscription()`, `managementGroup(\"mg\")`, `tenant()`).\n   */\n  readonly scope?: ScopeExpression;\n}\n\n/**\n * `ExistingResourceProps` for singleton child resources \u2014 `name` is omitted\n * because singleton children have a fixed name (e.g. `\"default\"`).\n */\nexport type SingletonExistingResourceProps = Omit<ExistingResourceProps, \"name\">;\n\n/**\n * Internal props accepted by the base `Resource` constructor. A loose\n * superset of both the deployable and existing public shapes \u2014 the runtime\n * constructor branches on `props.existing` to decide which fields are\n * honored. Generated CDK resource classes expose a discriminated union\n * `(Deployable & { existing?: false }) | (Existing & { existing: true })`;\n * passing `{ ...existingProps, existing: true }` selects the existing arm and\n * emits a Bicep `existing` reference instead of a new declaration.\n */\nexport interface ResourceProps<TType extends string> {\n  readonly name?: ExpressionOrValue<string> | undefined;\n  readonly apiVersion: string;\n  readonly type: TType;\n\n  readonly existing?: boolean;\n\n  /**\n   * Optional Bicep `scope:` value for an existing resource reference.\n   * Only honored when `existing === true`. Ignored on deployable resources\n   * (non-existing resources have no per-resource scope in Bicep).\n   */\n  readonly scope?: ScopeExpression;\n}\n\n/**\n * Optional third-argument bag passed to every resource constructor. Holds\n * authoring flags that affect how the resource declaration is emitted but are\n * not ARM-modeled properties of the resource body.\n *\n * Fields:\n * - `condition` \u2014 an `if(...)` guard on the declaration. A boolean\n *   expression (typically produced by `fn.eq`, `fn.and`, etc.) or a\n *   plain `boolean`. Bind it to a `const` to reuse the same predicate\n *   across multiple resources.\n *\n * `existing` is deliberately **not** an option \u2014 it is the discriminant of\n * the generated props union (`{ existing?: false } | { existing: true }`)\n * and lives on `props`. Routing it through options too would allow\n * contradictory settings between the two channels.\n *\n * `namingRules` is deliberately **not** an option either \u2014 it is\n * per-resource-type metadata declared as a `protected static namingRules`\n * field on each concrete `Resource` subclass and consumed by the base\n * constructor reflectively, so it stays off the user-facing surface.\n *\n */\nexport interface ResourceOptions {\n  readonly condition?: ExpressionOrValue<boolean>;\n  readonly dependsOn?: readonly ResourceDeclaration[];\n}\n\n/**\n * Shared base for resource declaration implementations.\n *\n * @remarks\n *\n * Both represent one Bicep resource declaration in the component tree and\n * share the same declaration-level state layout: identity fields\n * (`type`, `apiVersion`, `existing`), the `if(...)` guard (`condition`),\n * the optional cross-scope reference (`scope`), and the raw prop bag that\n * becomes the resource body.\n *\n * This class owns the common declaration state layout, raw-handle escape\n * hatch, and identity accessors. Subclasses supply their construction and\n * access behavior.\n */\nexport abstract class ResourceDeclaration<\n  TType extends string = string,\n> extends ProvisioningComponent {\n  /**\n   * Brand marker for cross-realm `isResourceDeclaration()` checks. Uses\n   * `Symbol.for` so it survives multiple copies of `@azure/provisioning-core`.\n   * Inherited by every resource declaration implementation.\n   */\n  readonly [RESOURCE_DECLARATION_BRAND] = true as const;\n\n  // Not `readonly`: the ctor writes `this.state = data` once. TypeScript\n  // forbids subclass writes to a `readonly` parent field, so the\n  // immutability is a runtime contract (never reassigned after ctor)\n  // rather than a static one.\n  protected state!: ResourceState<TType> & Record<string, unknown>;\n\n  /**\n   * Base constructor for every Bicep resource declaration.\n   *\n   * @remarks\n   *\n   * Responsibilities:\n   * 1. Register in the component tree (`super(context)`).\n   * 2. Enforce a deployment context ancestor.\n   * 3. Unwrap `context` if it's an indexed proxy from `.at(i)` /\n   *    `parent.at(loop.index)`, and stash `parentIndex` on `state` so the\n   *    serializer can emit `parent: parentSym[index]` on the child.\n   * 4. Inherit `condition` from the immediate parent resource\n   *    declaration when the caller doesn't supply one (Bicep requires\n   *    children of a conditional resource to share the same guard).\n   * 5. Populate `state` \u2014 existing arm records only identity fields;\n   *    deployable arm runs the naming policy and applies\n   *    `DeploymentContext` defaults for `location` / `tags` per the\n   *    shape descriptor.\n   *\n   * Subclasses supply the last mile, including their public handle behavior.\n   *\n   * @param namingRules - per-resource-type constraints for the naming\n   *   policy. `Resource` reads this reflectively off the concrete subclass\n   *   constructor; internal declaration implementations receive it from\n   *   the concrete resource constructor they represent.\n   */\n  constructor(\n    context: ProvisioningComponent,\n    props: ResourceProps<TType> & Record<string, unknown>,\n    options?: ResourceOptions,\n    namingRules?: ResourceNamingRules,\n  ) {\n    super(context);\n\n    if (!this.hasDeploymentContext()) {\n      throw new Error(\"Resource declaration must have a parent deployment context.\");\n    }\n\n    // If `context` is an indexed proxy returned by\n    // `LoopedResource.at(i)`, unwrap `this.parent`\n    // back to the raw parent so tree walks and symbol-map lookups continue\n    // to work, and capture the index so the serializer can emit\n    // `parent: parentSym[index]` on this child. The `ProvisioningComponent` constructor\n    // already pushed `this` into the correct children array (indexed proxy\n    // passes `.children` through to the raw parent's array), so nothing to\n    // fix up there.\n    //\n    // The index is recorded on the child's state (not the parent's) because\n    // siblings can have different indices \u2014 `new Child(p.at(0), \u2026)` and\n    // `new Child(p.at(1), \u2026)` both resolve `.parent` to the same raw parent,\n    // so the index that distinguishes them must be per-child.\n    const indexRef = (context as unknown as Record<symbol, unknown>)[PROXY_INDEX_REF];\n    let parentIndex: unknown = undefined;\n    if (indexRef !== undefined) {\n      const rawParent = (context as unknown as Record<symbol, unknown>)[INDEXED_PROXY_TARGET] as\n        ProvisioningComponent | undefined;\n      if (rawParent !== undefined) {\n        (this as unknown as { parent: ProvisioningComponent | undefined }).parent = rawParent;\n      }\n      parentIndex = indexRef;\n    }\n\n    // `existing` lives on `props` (it's the discriminant of the generated\n    // `{ existing?: false } | { existing: true }` union). `condition` is\n    // routed through `options`.\n    //\n    // Bicep requires a child of a conditional resource to itself be\n    // conditional on the same expression. When no explicit `condition` is\n    // supplied, inherit the immediate parent resource declaration's\n    // condition so the emitted template stays valid \u2014 child authoring\n    // shouldn't have to redundantly restate the parent's guard.\n    const isExisting = props.existing === true;\n    const parent = this.parent;\n    const inheritedCondition = isResourceDeclaration(parent)\n      ? (parent.self as unknown as { state: Record<string, unknown> }).state[\"condition\"]\n      : undefined;\n    const explicitCondition = options?.condition;\n    const condition =\n      explicitCondition !== undefined && inheritedCondition !== undefined\n        ? createBinaryExpression<boolean>(\"&&\", inheritedCondition, explicitCondition)\n        : (explicitCondition ?? (inheritedCondition as ExpressionOrValue<boolean> | undefined));\n    const dependsOn = options?.dependsOn;\n\n    let data: ResourceState<TType> & Record<string, unknown>;\n    if (isExisting) {\n      // Existing arm: only name + optional scope land in state. Any other\n      // keys on the props object are ignored \u2014 the deserialize path may pass\n      // them through, but they're never emitted on an `existing` resource.\n      if (props.name === undefined) {\n        throw new Error(`Resource ${props.type} marked as 'existing' but no 'name' was provided.`);\n      }\n      data = {\n        name: props.name,\n        type: props.type,\n        apiVersion: props.apiVersion,\n        existing: true,\n        scope: props.scope === undefined ? undefined : unwrapExpression(props.scope),\n        condition,\n        dependsOn,\n      };\n      if (parentIndex !== undefined) {\n        data[STATE_PARENT_INDEX] = parentIndex;\n      }\n    } else {\n      // Deployable arm: name flows through the naming policy; the keys\n      // handled explicitly here are stripped from the props bag, and\n      // every remaining key is copied verbatim into state as a user-\n      // authored property.\n      const {\n        name: _name,\n        type: _type,\n        apiVersion: _apiVersion,\n        existing: _existing,\n        scope: _scope,\n        ...userProps\n      } = props as ResourceProps<TType> & Record<string, unknown>;\n      const ctx = this.deploymentContext;\n      data = {\n        name: resolveResourceName(\n          ctx.namingPolicy ?? namingRequiredPolicy,\n          props.name,\n          props.type,\n          namingRules,\n        ),\n        type: props.type,\n        apiVersion: props.apiVersion,\n        condition,\n        dependsOn,\n        ...userProps,\n      };\n\n      if (parentIndex !== undefined) {\n        data[STATE_PARENT_INDEX] = parentIndex;\n      }\n\n      // Apply DeploymentContext defaults for `location` and `tags`, gated\n      // on the shape descriptor declaring those properties as writable.\n      // The TypeSpec model is the source of truth: a field marked\n      // readonly in the ARM contract (e.g. `location` on most child\n      // resources) is server-set, so propagating an inherited value\n      // would produce an invalid PUT body. Both fields are user-wins:\n      // if the user supplied a value, the inherited value is ignored\n      // entirely (no merge for tags either \u2014 explicit user tags fully\n      // replace inherited tags).\n      const shape = getShape(props.type, props.apiVersion, data);\n      if (shape !== undefined) {\n        const locationShape = shape.byJsName[\"location\"];\n        if (\n          locationShape !== undefined &&\n          locationShape.readOnly !== true &&\n          data[\"location\"] === undefined &&\n          ctx.location !== undefined\n        ) {\n          data[\"location\"] = ctx.location;\n        }\n        const tagsShape = shape.byJsName[\"tags\"];\n        if (\n          tagsShape !== undefined &&\n          tagsShape.readOnly !== true &&\n          data[\"tags\"] === undefined &&\n          ctx.tags !== undefined &&\n          Object.keys(ctx.tags).length > 0\n        ) {\n          data[\"tags\"] = { ...ctx.tags };\n        }\n      }\n    }\n\n    this.state = data;\n  }\n\n  /**\n   * Core-internal escape hatch: exposes the raw `state` backing object to\n   * the proxy layer (`resource-proxy.ts`) so it can read/unwrap the\n   * declaration's data across module boundaries. Keyed by the\n   * module-scoped {@link RAW_RESOURCE_HANDLE} symbol, which is **not**\n   * exported from `@azure/provisioning-core`, so package consumers can't name it.\n   *\n   * `protected` (not `private`) because the accessors that read it use\n   * `Reflect.get` / structural casts that bypass TS visibility anyway;\n   * the modifier just keeps it off the public type surface. It can't be a\n   * `#private` field because the proxy layer lives in a different class.\n   *\n   * @internal\n   */\n  protected get [RAW_RESOURCE_HANDLE](): ResourceState<TType> & Record<string, unknown> {\n    return this.state;\n  }\n\n  get type(): TType {\n    return this.state.type;\n  }\n\n  get apiVersion(): string {\n    return this.state.apiVersion;\n  }\n\n  get existing(): boolean | undefined {\n    return this.state.existing;\n  }\n\n  get condition(): ExpressionOrValue<boolean> | undefined {\n    return this.state.condition;\n  }\n\n  get dependsOn(): readonly ResourceDeclaration[] | undefined {\n    return this.state.dependsOn as readonly ResourceDeclaration[] | undefined;\n  }\n\n  protected expr<TValue>(...path: readonly PropertySegment[]): Expression<TValue> & TValue {\n    return createResourceMemberProxy(\n      {\n        resource: this as unknown as Resource,\n        root: unwrapResourceHandle(this as unknown as Resource) as unknown as Record<\n          string,\n          unknown\n        >,\n      },\n      path,\n    );\n  }\n\n  protected setProperty(key: string, value: unknown): void {\n    this.state[key] = normalizeAssignedValue(value, this as unknown as Resource);\n  }\n}\n\n/**\n * Base class for all Azure resources.\n *\n * @remarks\n * Resources are fully initialized at construction time. Pass a parent\n * `ProvisioningComponent` (typically a `Stack` or `ResourceGroup`) as the first\n * argument \u2014 the resource registers itself in the tree automatically.\n *\n * Properties use expression-backed proxies: reading `resource.name`\n * returns an `Expression` that compiles to a Bicep symbolic reference,\n * not a plain string. Use `this.expr()` in subclasses to create\n * property getters and `this.setProperty()` for setters.\n *\n * @example\n * ```typescript snippet:ignore\n * import { ResourceGroup, Stack } from \"@azure/provisioning-core\";\n * import { KeyVault } from \"@azure/provisioning-keyvault\";\n *\n * const stack = new Stack(\"my-app\", { targetScope: \"subscription\" });\n * const rg = new ResourceGroup(stack, { name: \"rg-my-app\", location: \"eastus\" });\n * const vault = new KeyVault(rg, {\n *   name: \"kv-my-app\",\n *   properties: {\n *     tenantId: \"11111111-1111-1111-1111-111111111111\",\n *     sku: { family: \"A\", name: \"standard\" },\n *   },\n * });\n *\n * // vault.name is an Expression, not a string\n * // vault.id compiles to resourceId(...)\n * ```\n */\nexport class Resource<TType extends string = string> extends ResourceDeclaration<TType> {\n  /**\n   * Brand marker for cross-realm `isResource()` checks.\n   * Uses `Symbol.for` so it survives multiple copies of `@azure/provisioning-core`.\n   */\n  readonly [RESOURCE_BRAND] = true as const;\n\n  /**\n   * Register a {@link FlatModelShape} for this resource class's\n   * `(resourceType, apiVersion)` pair. Intended to be invoked from a\n   * `static {}` initializer in generated subclasses so the registration\n   * happens at module load.\n   *\n   * The static method reads `resourceType` and `apiVersion` off `this`\n   * (the subclass that called it), so callers don't repeat the literals.\n   */\n  static registerShape(\n    this: { readonly resourceType: string; readonly apiVersion: string },\n    shape: FlatModelShape,\n    variantSelector?: FlatVariantSelector,\n  ): void {\n    registerShapeInRegistry(this.resourceType, this.apiVersion, shape, variantSelector);\n  }\n\n  /**\n   * Register this class with the global resource registry so the\n   * deserializer can reconstruct instances of it (instead of falling\n   * back to base `Resource`) for matching `(resourceType, apiVersion)`\n   * pairs. Intended to be invoked from a `static {}` initializer in\n   * generated classes alongside {@link Resource.registerShape}.\n   *\n   * Pass an ordered discriminator path for concrete resource variants. A\n   * singleton is one segment (`name=signin`); model-discriminated resources\n   * may use `kind` or several nested segments. Omit for ordinary resources.\n   */\n  protected static register(this: ResourceCtor, variantSelector?: FlatVariantSelector): void {\n    registerResourceInRegistry(this, variantSelector);\n  }\n\n  /**\n   * Assemble the base-`Resource` constructor payload (the second `super(...)`\n   * argument) from the user-facing props. This is a **static \"virtual\"**:\n   * it runs before an instance exists (to compute the `super` argument), so\n   * it can't be an instance method \u2014 but it still dispatches through the\n   * calling constructor, so a subclass's override wins.\n   *\n   * Every emitter-generated resource overrides this to inject its fixed\n   * identity (`type` / `apiVersion`), the singleton `name`, and its explicit\n   * writable-field copy. Both ordinary construction and internal resource\n   * reconstruction funnel through this method so prop shaping remains\n   * consistent.\n   *\n   * This base default is the fallback used when the wrapped constructor is\n   * base `Resource` itself \u2014 the deserialize path for an unregistered\n   * `(type, apiVersion)` pair, where `type` / `apiVersion` are threaded in\n   * through `props` rather than read off statics. Keeping the default here\n   * guarantees the method is always present for internal reconstruction.\n   */\n  protected static buildResourceProps(\n    props?: unknown,\n  ): ResourceProps<string> & Record<string, unknown> {\n    const p = (props as Record<string, unknown> | undefined) ?? {};\n    return {\n      ...p,\n      type:\n        (p[\"type\"] as string | undefined) ??\n        (this as unknown as { resourceType?: string }).resourceType,\n      apiVersion:\n        (p[\"apiVersion\"] as string | undefined) ??\n        (this as unknown as { apiVersion?: string }).apiVersion,\n    } as ResourceProps<string> & Record<string, unknown>;\n  }\n\n  /**\n   * Per-resource-type naming constraints, consumed by the active\n   * {@link NamingPolicy} when a resource is created without an explicit\n   * `name`. Generated CDK subclasses override this with a concrete value;\n   * the base default of `undefined` yields `MOST_RESTRICTIVE` behavior.\n   *\n   * This is type metadata, not user input, so it is kept off the public\n   * props surface and read reflectively in the constructor via\n   * `this.constructor` rather than being threaded through `ResourceProps`.\n   */\n  protected static namingRules?: ResourceNamingRules;\n\n  protected _selfProxy: this | undefined;\n\n  constructor(\n    context: ProvisioningComponent,\n    props: ResourceProps<TType> & Record<string, unknown>,\n    options?: ResourceOptions,\n  ) {\n    super(\n      context,\n      props,\n      options,\n      // Naming rules live as a `protected static namingRules` field on\n      // each concrete resource subclass, not on the public props bag.\n      // Read reflectively off `new.target` (the most-derived class being\n      // instantiated) \u2014 `this.constructor` would work too but TS forbids\n      // touching `this` before `super()`. Static inheritance falls back\n      // to `Resource`'s `undefined` default when a subclass omits the\n      // field (e.g. singleton children). `resolveResourceName` (called\n      // inside `ResourceDeclaration`) treats `undefined` as\n      // `MOST_RESTRICTIVE`.\n      (new.target as typeof Resource).namingRules,\n    );\n\n    const proxy = createResourceProxy(this as this & Resource<TType>);\n    this._selfProxy = proxy;\n\n    // Tricky part for the proxy implementation:\n    // ProvisioningComponent constructor pushed `this` (bare instance) into parent.children\n    // before the proxy existed. Swap it for the proxy so external consumers\n    // see proxy-backed handles (with property access, etc.) when iterating.\n    const idx = context.children.indexOf(this);\n    if (idx >= 0) context.children[idx] = proxy;\n\n    return proxy;\n  }\n\n  override get self(): this {\n    return this._selfProxy ?? this;\n  }\n\n  /**\n   * The Azure resource name as a Bicep symbolic-reference expression.\n   *\n   * The value is established at construction time (either user-supplied\n   * via `props.name` or filled in by the naming policy) and stored on\n   * `state.name`. The setter routes through `setProperty` so post-\n   * construction edits flow through the same proxy/expression machinery\n   * as any other property \u2014 useful when working with a base `Resource`\n   * reference and re-binding the name dynamically. Singleton subclasses\n   * override this getter to narrow the return type to the literal\n   * `Expression<\"<singletonName>\">`; non-singleton subclasses inherit\n   * this accessor pair as-is.\n   */\n  get name(): Expression<string> {\n    return this.expr(\"name\");\n  }\n  set name(value: ExpressionOrValue<string>) {\n    this.setProperty(\"name\", value);\n  }\n\n  get id(): Expression<string> {\n    return this.expr(\"id\");\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Loop\n// ---------------------------------------------------------------------------\n\n/**\n * Metadata describing a Bicep `[for \u2026 in \u2026]` loop and the concrete\n * variable names used inside it. Stored publicly on {@link LoopedResource.loop}\n * once a looped resource declaration has been created.\n */\nexport interface LoopContext {\n  readonly collection: unknown;\n  readonly itemVariable: string;\n  readonly indexVariable?: string;\n  readonly batchSize?: number;\n}\n\n/**\n * Options accepted by `new Loop(collection, options?)`. All fields are\n * optional overrides; the constructor supplies defaults. Derived from\n * {@link LoopContext} so there is exactly one source of truth for the\n * shape of loop metadata.\n */\nexport type LoopOptions = Partial<Omit<LoopContext, \"collection\">>;\n\n/**\n * Describes a Bicep `[for item in collection: ...]` loop as a plain data\n * object. Construct one and pass it to\n * `Ctor.fromLoop(loop, context, props, options?)` (e.g.\n * `StorageAccount.fromLoop(...)`) to expand a resource declaration into a\n * resource-copy loop.\n *\n * The item and index variable names default to `item` / `i`. Bicep\n * for-expressions bind their loop variables only within their own body,\n * so two sibling `[for item in xs: \u2026]` / `[for item in ys: \u2026]` in the\n * same file do **not** collide \u2014 each `item` is scoped to its own\n * expression. If you nest a `Loop` inside another loop's body (rare),\n * pass `{ itemVariable, indexVariable }` explicitly on the inner one to\n * disambiguate. `batchSize` on the loop renders as `@batchSize(n)` on\n * the resource that consumes it.\n *\n * The `indexVariable` name is always materialized on read (never\n * `undefined`), but whether the wire actually **records** it \u2014 and\n * therefore whether the renderer emits the `[for (item, i) in \u2026]` tuple\n * binding \u2014 is decided by whether anyone accessed `loop.index` (or the\n * caller supplied `{ indexVariable }` explicitly). A loop whose body\n * never mentions an index emits a bare `[for item in xs: \u2026]`.\n *\n * `Loop` instances are pure data \u2014 creating one has no side effect.\n */\nexport class Loop<T> {\n  readonly collection: ExpressionOrValue<T[]>;\n  readonly itemVariable: string;\n  readonly item: Expression<T>;\n  readonly batchSize?: number;\n\n  // The default name assigned to `indexVariable` on first materialization,\n  // if the caller neither passed `{ indexVariable }` nor accessed `.index`.\n  readonly #defaultIndexVariable: string;\n  #indexVariable: string | undefined;\n  #indexExpr: Expression<number> | undefined;\n  #indexRequested = false;\n\n  constructor(collection: ExpressionOrValue<T[]>, options?: LoopOptions) {\n    this.collection = collection;\n\n    this.itemVariable = options?.itemVariable ?? \"item\";\n    this.#defaultIndexVariable = \"i\";\n\n    if (options?.indexVariable !== undefined) {\n      // Explicit option counts as a request \u2014 the wire and renderer must\n      // honor the caller's chosen name whether or not they read `.index`.\n      this.#indexVariable = options.indexVariable;\n      this.#indexRequested = true;\n    }\n    if (options?.batchSize !== undefined) {\n      this.batchSize = options.batchSize;\n    }\n\n    this.item = wrapExpression(symbolicValueExpressionNode(this.itemVariable)) as Expression<T>;\n  }\n\n  /**\n   * Name of the loop's index variable. Always defined \u2014 reading it\n   * materializes the default (`i`) if the caller neither passed\n   * `{ indexVariable }` nor accessed `.index` yet.\n   *\n   * Reading `.indexVariable` also marks the index as requested (same as\n   * reading `.index`), because a caller who wants the variable name is\n   * almost certainly going to use it. If the wire-omit optimization\n   * (bare `[for item in \u2026]` with no index binding) matters, callers\n   * should gate on `.indexRequested` first before touching this getter.\n   */\n  get indexVariable(): string {\n    this.#indexRequested = true;\n    if (this.#indexVariable === undefined) {\n      this.#indexVariable = this.#defaultIndexVariable;\n    }\n    return this.#indexVariable;\n  }\n\n  /**\n   * Expression referencing the current iteration's index. Reading this the\n   * first time marks the index as requested, which causes the wire to\n   * include `indexVariable` on the `for-expression` node and the renderer\n   * to emit `[for (item, i) in \u2026]`. Callers who never touch `.index` get\n   * the cleaner index-less form.\n   */\n  get index(): Expression<number> {\n    this.#indexRequested = true;\n    if (this.#indexExpr === undefined) {\n      const name = this.indexVariable;\n      this.#indexExpr = wrapExpression(symbolicValueExpressionNode(name)) as Expression<number>;\n    }\n    return this.#indexExpr;\n  }\n\n  /**\n   * Framework-internal signal used by `Resource.fromLoop` to decide\n   * whether the wire should include the index binding. `true` when the\n   * caller either supplied `{ indexVariable }` explicitly or has accessed\n   * `.index` / `.indexVariable` at least once. Not exported from\n   * `@azure/provisioning-core`.\n   *\n   * @internal\n   */\n  get indexRequested(): boolean {\n    return this.#indexRequested;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// LoopedResource<T> \u2014 a Bicep for-expanded resource declaration as a real\n// ProvisioningComponent in the tree, sitting alongside scalar `Resource` under the same\n// `ResourceDeclaration` base.\n// ---------------------------------------------------------------------------\n\n/**\n * A `LoopedResource<T>` represents a single Bicep resource declaration\n * expanded across a loop (`[for x in xs: {...}]`). It is a real\n * `ProvisioningComponent` in the tree \u2014 one node per emitted declaration \u2014 and\n * exposes indexed access into individual iterations via\n * {@link LoopedResource.at}.\n *\n * @remarks\n *\n * Property access on a `LoopedResource` is deliberately not exposed at\n * the type level: pick an index (`at`) to obtain a proxy that emits\n * `sym[i].prop`. This mirrors Bicep's requirement that individual\n * iterations be accessed by index.\n *\n * `.at(i)` returns the concrete resource type `T`. The returned proxy\n * exposes the essential ARM surface \u2014 the property getters/setters that\n * funnel through `this.expr(...)` (`.id`, `.name`, `.sku`,\n * `.properties.*`, \u2026) rooted at `sym[i]` \u2014 as well as the child\n * accessors (`keyVault.secrets`, singleton getter/setters), which are\n * derived from the parent's `children` scoped to element `i`. To attach\n * per-iteration children, parent them to `parent.at(loop.index)` \u2014 e.g.\n * `Child.fromLoop(loop, parent.at(loop.index), ...)`.\n *\n * Projection over the loop (Bicep `map(sym, x => body)`) is tracked as\n * a follow-up effort \u2014 see the \"lambda + fn.map\" issue.\n */\nexport class LoopedResource<T extends Resource = Resource> extends ResourceDeclaration<T[\"type\"]> {\n  /**\n   * Cross-realm brand \u2014 same technique as the scalar `RESOURCE_BRAND`.\n   * Use {@link isLoopedResource} instead of `instanceof`\n   * when multiple copies of `@azure/provisioning-core` may be loaded.\n   */\n  readonly [LOOPED_RESOURCE_BRAND] = true as const;\n\n  /** Metadata describing the loop that produced this declaration. */\n  readonly loop: LoopContext;\n\n  readonly #wrappedCtor: new (\n    context: ProvisioningComponent,\n    props: unknown,\n    options?: ResourceOptions,\n  ) => T;\n\n  private constructor(\n    context: ProvisioningComponent,\n    wrappedCtor: new (\n      context: ProvisioningComponent,\n      props: unknown,\n      options?: ResourceOptions,\n    ) => T,\n    userProps: unknown,\n    loop: Loop<unknown>,\n    options?: ResourceOptions,\n  ) {\n    // The subclass constructor never runs for a looped row \u2014 only this\n    // shared `ResourceDeclaration` ctor does. To keep the scalar and\n    // looped construction paths from drifting, shape the props bag through\n    // the SAME static the scalar ctor uses: every `Resource` (sub)class\n    // inherits or overrides `buildResourceProps`, which returns the exact\n    // `super()` payload the scalar ctor passes \u2014 including the fixed `name`\n    // for singletons and any other prop shaping. (This is what fixes looped\n    // singletons losing their fixed `name`.)\n    //\n    // It is always present: base `Resource` \u2014 the deserialize fallback ctor\n    // for an unregistered `(type, apiVersion)` pair \u2014 supplies a default\n    // that threads `type` / `apiVersion` in from `userProps`. So there's no\n    // existence branch here.\n    const props = (\n      wrappedCtor as unknown as {\n        buildResourceProps: (props: unknown) => ResourceProps<T[\"type\"]> & Record<string, unknown>;\n      }\n    ).buildResourceProps.call(wrappedCtor, userProps);\n    super(\n      context,\n      props,\n      options,\n      (wrappedCtor as unknown as { namingRules?: ResourceNamingRules }).namingRules,\n    );\n    this.#wrappedCtor = wrappedCtor;\n    // Snapshot the loop metadata at declaration time. `indexVariable` is\n    // recorded only if the index was requested by now \u2014 either the caller\n    // supplied `{ indexVariable }` or read `loop.index` / `loop.indexVariable`\n    // before this declaration. Reading `loop.index` (e.g. via\n    // `parent.at(loop.index)`) marks the live loop so descendant\n    // declarations (which snapshot the same loop afterwards) pick up the\n    // binding, while this declaration's own for-expression stays index-less.\n    this.loop = {\n      collection: loop.collection,\n      itemVariable: loop.itemVariable,\n      ...(loop.indexRequested ? { indexVariable: loop.indexVariable } : {}),\n      ...(loop.batchSize !== undefined ? { batchSize: loop.batchSize } : {}),\n    };\n  }\n\n  /**\n   * The concrete `Resource` subclass this looped declaration wraps.\n   * Used by query machinery to answer \"which subclass is this looped\n   * resource\" \u2014 the analogue of `instanceof T` for `LoopedResource<T>`.\n   *\n   * This is always the full subclass the user constructed via\n   * `Xxx.fromLoop(...)` \u2014 query identity matches on that class, and it is\n   * the prototype the `.at(i)` proxy uses to resolve ARM accessors.\n   */\n  get wrappedCtor(): new (\n    context: ProvisioningComponent,\n    props: unknown,\n    options?: ResourceOptions,\n  ) => T {\n    return this.#wrappedCtor;\n  }\n\n  /**\n   * Reference the element at `index`. Emits `sym[index].<...>` for\n   * subsequent property access.\n   *\n   * Returns the concrete resource type `T`. At runtime an indexed proxy is\n   * spliced over the full class prototype (`#wrappedCtor.prototype`):\n   * prototype getters that funnel through `this.expr(...)` (`.id`, `.name`,\n   * `.properties.*`, \u2026) resolve rooted at `sym[index]`. A child created with\n   * `parent.at(i)` is stamped with that index for serialization.\n   */\n  at(index: ExpressionOrValue<number>): T {\n    // `this` is a `ResourceDeclaration`; the handle derives the subclass\n    // prototype from `this.wrappedCtor`. The explicit type argument pins\n    // the return type, which TypeScript can't otherwise resolve from the\n    // deferred polymorphic `this`.\n    return createIndexedResourceProxy<LoopedResource<T>>(this, index);\n  }\n}\n\n/** @internal */\nexport function createLoopedResource<T extends Resource, C extends ProvisioningComponent, P, Item>(\n  wrappedCtor: new (context: C, props: P, options?: ResourceOptions) => T,\n  loop: Loop<Item>,\n  context: C,\n  ...rest: undefined extends P\n    ? [props?: P, options?: ResourceOptions]\n    : [props: P, options?: ResourceOptions]\n): LoopedResource<T> {\n  const [userProps, options] = rest as [P?, ResourceOptions?];\n  // `LoopedResource`'s ctor is private; access via cast because this module\n  // owns both the declaration and its internal construction boundary.\n  const LoopedCtor = LoopedResource as unknown as new <U extends Resource>(\n    context: ProvisioningComponent,\n    wrappedCtor: new (\n      context: ProvisioningComponent,\n      props: unknown,\n      options?: ResourceOptions,\n    ) => U,\n    userProps: unknown,\n    loop: Loop<unknown>,\n    options?: ResourceOptions,\n  ) => LoopedResource<U>;\n  return new LoopedCtor(\n    context,\n    wrappedCtor as new (\n      context: ProvisioningComponent,\n      props: unknown,\n      options?: ResourceOptions,\n    ) => T,\n    userProps,\n    loop,\n    options,\n  );\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,oCAAsC;AACtC,yBAMO;AAEP,uBAA4C;AAG5C,2BAA0D;AAC1D,4BAaO;AACP,4BAAsC;AAEtC,4BAAmE;AACnE,+BAGO;AAyJA,MAAe,4BAEZ,oDAAsB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9B,CAAU,gDAA0B,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BV,YACE,SACA,OACA,SACA,aACA;AACA,UAAM,OAAO;AAEb,QAAI,CAAC,KAAK,qBAAqB,GAAG;AAChC,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AAeA,UAAM,WAAY,QAA+C,qCAAe;AAChF,QAAI,cAAuB;AAC3B,QAAI,aAAa,QAAW;AAC1B,YAAM,YAAa,QAA+C,0CAAoB;AAEtF,UAAI,cAAc,QAAW;AAC3B,QAAC,KAAkE,SAAS;AAAA,MAC9E;AACA,oBAAc;AAAA,IAChB;AAWA,UAAM,aAAa,MAAM,aAAa;AACtC,UAAM,SAAS,KAAK;AACpB,UAAM,yBAAqB,6CAAsB,MAAM,IAClD,OAAO,KAAuD,MAAM,WAAW,IAChF;AACJ,UAAM,oBAAoB,SAAS;AACnC,UAAM,YACJ,sBAAsB,UAAa,uBAAuB,aACtD,2CAAgC,MAAM,oBAAoB,iBAAiB,IAC1E,qBAAsB;AAC7B,UAAM,YAAY,SAAS;AAE3B,QAAI;AACJ,QAAI,YAAY;AAId,UAAI,MAAM,SAAS,QAAW;AAC5B,cAAM,IAAI,MAAM,YAAY,MAAM,IAAI,mDAAmD;AAAA,MAC3F;AACA,aAAO;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,MAAM,MAAM;AAAA,QACZ,YAAY,MAAM;AAAA,QAClB,UAAU;AAAA,QACV,OAAO,MAAM,UAAU,SAAY,aAAY,qCAAiB,MAAM,KAAK;AAAA,QAC3E;AAAA,QACA;AAAA,MACF;AACA,UAAI,gBAAgB,QAAW;AAC7B,aAAK,wCAAkB,IAAI;AAAA,MAC7B;AAAA,IACF,OAAO;AAKL,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,OAAO;AAAA,QACP,GAAG;AAAA,MACL,IAAI;AACJ,YAAM,MAAM,KAAK;AACjB,aAAO;AAAA,QACL,UAAM;AAAA,UACJ,IAAI,gBAAgB;AAAA,UACpB,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,QACF;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,YAAY,MAAM;AAAA,QAClB;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAEA,UAAI,gBAAgB,QAAW;AAC7B,aAAK,wCAAkB,IAAI;AAAA,MAC7B;AAWA,YAAM,YAAQ,gCAAS,MAAM,MAAM,MAAM,YAAY,IAAI;AACzD,UAAI,UAAU,QAAW;AACvB,cAAM,gBAAgB,MAAM,SAAS,UAAU;AAC/C,YACE,kBAAkB,UAClB,cAAc,aAAa,QAC3B,KAAK,UAAU,MAAM,UACrB,IAAI,aAAa,QACjB;AACA,eAAK,UAAU,IAAI,IAAI;AAAA,QACzB;AACA,cAAM,YAAY,MAAM,SAAS,MAAM;AACvC,YACE,cAAc,UACd,UAAU,aAAa,QACvB,KAAK,MAAM,MAAM,UACjB,IAAI,SAAS,UACb,OAAO,KAAK,IAAI,IAAI,EAAE,SAAS,GAC/B;AACA,eAAK,MAAM,IAAI,EAAE,GAAG,IAAI,KAAK;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,KAAe,yCAAmB,IAAoD;AACpF,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,OAAc;AAChB,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,IAAI,aAAqB;AACvB,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,IAAI,WAAgC;AAClC,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,IAAI,YAAoD;AACtD,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEA,IAAI,YAAwD;AAC1D,WAAO,KAAK,MAAM;AAAA,EACpB;AAAA,EAEU,QAAgB,MAA+D;AACvF,eAAO;AAAA,MACL;AAAA,QACE,UAAU;AAAA,QACV,UAAM,4CAAqB,IAA2B;AAAA,MAIxD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEU,YAAY,KAAa,OAAsB;AACvD,SAAK,MAAM,GAAG,QAAI,8CAAuB,OAAO,IAA2B;AAAA,EAC7E;AACF;AAkCO,MAAM,iBAAgD,oBAA2B;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtF,CAAU,oCAAc,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW5B,OAAO,cAEL,OACA,iBACM;AACN,8BAAAA,eAAwB,KAAK,cAAc,KAAK,YAAY,OAAO,eAAe;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,OAAiB,SAA6B,iBAA6C;AACzF,iCAAAC,kBAA2B,MAAM,eAAe;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,OAAiB,mBACf,OACiD;AACjD,UAAM,IAAK,SAAiD,CAAC;AAC7D,WAAO;AAAA,MACL,GAAG;AAAA,MACH,MACG,EAAE,MAAM,KACR,KAA8C;AAAA,MACjD,YACG,EAAE,YAAY,KACd,KAA4C;AAAA,IACjD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,OAAiB;AAAA,EAEP;AAAA,EAEV,YACE,SACA,OACA,SACA;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAUC,WAA+B;AAAA,IAClC;AAEA,UAAM,YAAQ,2CAAoB,IAA8B;AAChE,SAAK,aAAa;AAMlB,UAAM,MAAM,QAAQ,SAAS,QAAQ,IAAI;AACzC,QAAI,OAAO,EAAG,SAAQ,SAAS,GAAG,IAAI;AAEtC,WAAO;AAAA,EACT;AAAA,EAEA,IAAa,OAAa;AACxB,WAAO,KAAK,cAAc;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,IAAI,OAA2B;AAC7B,WAAO,KAAK,KAAK,MAAM;AAAA,EACzB;AAAA,EACA,IAAI,KAAK,OAAkC;AACzC,SAAK,YAAY,QAAQ,KAAK;AAAA,EAChC;AAAA,EAEA,IAAI,KAAyB;AAC3B,WAAO,KAAK,KAAK,IAAI;AAAA,EACvB;AACF;AAmDO,MAAM,KAAQ;AAAA,EACV;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAIA;AAAA,EACT;AAAA,EACA;AAAA,EACA,kBAAkB;AAAA,EAElB,YAAY,YAAoC,SAAuB;AACrE,SAAK,aAAa;AAElB,SAAK,eAAe,SAAS,gBAAgB;AAC7C,SAAK,wBAAwB;AAE7B,QAAI,SAAS,kBAAkB,QAAW;AAGxC,WAAK,iBAAiB,QAAQ;AAC9B,WAAK,kBAAkB;AAAA,IACzB;AACA,QAAI,SAAS,cAAc,QAAW;AACpC,WAAK,YAAY,QAAQ;AAAA,IAC3B;AAEA,SAAK,WAAO,uCAAe,8CAA4B,KAAK,YAAY,CAAC;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,IAAI,gBAAwB;AAC1B,SAAK,kBAAkB;AACvB,QAAI,KAAK,mBAAmB,QAAW;AACrC,WAAK,iBAAiB,KAAK;AAAA,IAC7B;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,QAA4B;AAC9B,SAAK,kBAAkB;AACvB,QAAI,KAAK,eAAe,QAAW;AACjC,YAAM,OAAO,KAAK;AAClB,WAAK,iBAAa,uCAAe,8CAA4B,IAAI,CAAC;AAAA,IACpE;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,IAAI,iBAA0B;AAC5B,WAAO,KAAK;AAAA,EACd;AACF;AAkCO,MAAM,uBAAsD,oBAA+B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhG,CAAU,2CAAqB,IAAI;AAAA;AAAA,EAG1B;AAAA,EAEA;AAAA,EAMD,YACN,SACA,aAKA,WACA,MACA,SACA;AAcA,UAAM,QACJ,YAGA,mBAAmB,KAAK,aAAa,SAAS;AAChD;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACC,YAAiE;AAAA,IACpE;AACA,SAAK,eAAe;AAQpB,SAAK,OAAO;AAAA,MACV,YAAY,KAAK;AAAA,MACjB,cAAc,KAAK;AAAA,MACnB,GAAI,KAAK,iBAAiB,EAAE,eAAe,KAAK,cAAc,IAAI,CAAC;AAAA,MACnE,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACtE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,IAAI,cAIG;AACL,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,GAAG,OAAqC;AAKtC,eAAO,kDAA8C,MAAM,KAAK;AAAA,EAClE;AACF;AAGO,SAAS,qBACd,aACA,MACA,YACG,MAGgB;AACnB,QAAM,CAAC,WAAW,OAAO,IAAI;AAG7B,QAAM,aAAa;AAWnB,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IAKA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "names": ["registerShapeInRegistry", "registerResourceInRegistry"]
+}