@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/container-inspection.mjs

@@ -0,0 +1,75 @@
+import {PROVIDER_REGION_PATTERNS,validProviderRegion} from './deployment-region.mjs';
+import {containerContract} from './container-contracts.mjs';
+import {resourceAddress} from './identifiers.mjs';
+import {inspectContainerSecurity} from './container-security-inspection.mjs';
+// Inspect emitted configuration independently of the allocation compiler. Exact
+// quantity conversion is explicit; no platform default or rounded value is proof.
+const bytes=value=>{
+ if(typeof value!=='string')return NaN;
+ const match=/^(\d+(?:\.\d+)?)(Mi|Gi|M|G)$/.exec(value);
+ return match?Number(match[1])*({Mi:1048576,Gi:1073741824,M:1000000,G:1000000000}[match[2]]):NaN;
+};
+export function inspectContainerConfiguration(node,row,config,plan,add,{root=config,scope=null}={}){
+ const contract=containerContract(node);if(!contract)return;
+ const cloud=node.data.provider,name=resourceAddress(node.id),settings=node.data.config||{},resource=config.resource||{};
+ const fail=message=>add('container-constraint-mismatch',message,node.id);
+ if(row.address!==name)fail('The resource schedule changed the canonical container identity.');
+ const expectedResources=new Set(['terraform_data.review_gate',contract.type+'.'+name,...(cloud==='aws'?['aws_ecs_cluster','aws_cloudwatch_log_group','aws_iam_role','aws_iam_role_policy','aws_ecs_task_definition'].map(type=>type+'.'+name).concat('aws_iam_role.'+name+'_task'):cloud==='gcp'?['google_service_account.'+name]:[])]);
+ for(const [type,entries]of Object.entries(resource))for(const id of Object.keys(entries)){if(!expectedResources.delete(type+'.'+id))fail('The supplied-image unit contains a managed resource outside its reviewed ownership footprint.');}
+ if(expectedResources.size)fail('The supplied-image unit is missing a required owned resource or review gate.');
+ const expectedData=cloud==='aws'?['aws_subnet','aws_security_group','aws_partition']:cloud==='azure'?['azurerm_container_app_environment']:cloud==='ibm'?['ibm_code_engine_project']:[];
+ for(const [type,entries]of Object.entries(config.data||{}))for(const id of Object.keys(entries))if(!expectedData.includes(type)||id!==name)fail('The supplied-image unit queries data outside its reviewed existing-system boundary.');
+ const body=resource[contract.type]?.[name];if(!body)return;
+ const rawRegion=settings.region,selected=rawRegion&&rawRegion!=='To be selected'&&validProviderRegion(cloud,rawRegion)?rawRegion:null;
+ const expectedValidation='${can(regex('+JSON.stringify(PROVIDER_REGION_PATTERNS[cloud])+', var.region))'+(selected?' && var.region == '+JSON.stringify(selected):'')+'}';
+ if(config.variable?.region?.default!==(selected??undefined)||config.variable?.region?.validation?.condition!==expectedValidation)fail('The deployment region input does not preserve the accepted placement and supported identifier contract.');
+ if(rawRegion&&rawRegion!=='To be selected'&&!selected&&!(plan.gapDetails||[]).some(g=>g.componentIds?.includes(node.id)&&g.id.endsWith('-region')))fail('Unsupported placement was discarded instead of remaining blocking scope.');
+ const rootName=key=>scope?scope.module+'__'+key:key,rootRef=key=>'${var.'+rootName(key)+'}';
+ const candidates=root.provider?.[contract.provider],providers=Array.isArray(candidates)?candidates:[candidates],provider=providers.find(p=>p&&(scope?p.alias===scope.module:!p.alias));
+ inspectContainerSecurity(cloud,name,config,provider,rootRef,fail);
+ if(!provider||cloud!=='azure'&&provider.region!==rootRef('region'))fail('The native provider is not bound to its own delivery-unit region input.');
+ if(cloud==='azure'&&provider?.subscription_id!==rootRef('subscription_id'))fail('The Azure lookup and application lost their owned subscription input.');
+ if(cloud==='gcp'&&provider?.project!==rootRef('project_id'))fail('The Google provider lost its reviewed project input.');
+ for(const [type,entries]of Object.entries(resource))if(type!=='terraform_data')for(const item of Object.values(entries)){
+  if(item.provider!==undefined&&item.provider!==contract.provider)fail('A container resource overrides its owned provider configuration.');
+  if(cloud==='aws'&&item.region!==undefined&&item.region!=='${var.region}')fail('A container resource overrides its owned deployment region.');
+ }
+ const conditions=body.lifecycle?.precondition||[],has=condition=>Array.isArray(conditions)&&conditions.some(rule=>rule.condition===condition);
+ if(cloud==='aws')for(const [type,key]of [['aws_subnet','subnets'],['aws_security_group','security_groups']]){
+  const lookup=config.data?.[type]?.[name];
+  if(!lookup||lookup.for_each!=='${toset(var.'+name+'_'+key+')}'||lookup.id!=='${each.value}'||Object.keys(lookup).some(key=>!['for_each','id','provider'].includes(key))||lookup.provider!==undefined&&lookup.provider!=='aws'||body.network_configuration?.[key]!=='${var.'+name+'_'+key+'}')fail('An AWS network lookup or service no longer follows its exact existing network inputs.');
+  if(!has('${alltrue([for item in values(data.'+type+'.'+name+') : item.vpc_id == var.'+name+'_vpc_id])}'))fail('The AWS existing network lost its native VPC membership check.');
+ }
+ if(cloud==='gcp'&&body.location!=='${var.region}')fail('Cloud Run location no longer uses the accepted unit region.');
+ if(cloud==='azure'){
+  const existing=config.data?.azurerm_container_app_environment?.[name];
+  if(!existing||existing.name!=='${try(split("/", var.environment_id)[8], "invalid")}'||existing.resource_group_name!=='${try(split("/", var.environment_id)[4], "invalid")}'||existing.provider!==undefined&&existing.provider!=='azurerm'||body.container_app_environment_id!=='${var.environment_id}')fail('The Azure existing-environment lookup no longer follows the exact selected resource ID.');
+  if(!has('${lower(replace(data.azurerm_container_app_environment.'+name+'.location, " ", "")) == var.region}')||!has('${lower(data.azurerm_container_app_environment.'+name+'.id) == lower(var.environment_id)}'))fail('The Azure existing environment lost its native region or subscription/resource-ID check.');
+ }
+ if(cloud==='ibm'){
+  const existing=config.data?.ibm_code_engine_project?.[name];
+  if(!existing||existing.project_id!=='${var.code_engine_project_id}'||existing.provider!==undefined&&existing.provider!=='ibm'||body.project_id!=='${var.code_engine_project_id}')fail('The IBM existing-project lookup no longer follows the reviewed project ID.');
+  if(!has('${data.ibm_code_engine_project.'+name+'.region == var.region}')||!has('${data.ibm_code_engine_project.'+name+'.account_id == var.account_id}'))fail('The IBM existing project lost its native region or account check.');
+ }
+
+ let actualMemory,privateIngress,explicitIdentity;
+ if(cloud==='aws'){
+  const task=resource.aws_ecs_task_definition?.[name];actualMemory=Number(task?.memory)*1048576;
+  privateIngress=body.network_configuration?.assign_public_ip===false;
+  explicitIdentity=!!resource.aws_iam_role?.[name]&&!!resource.aws_iam_role?.[name+'_task']&&task?.execution_role_arn==='${aws_iam_role.'+name+'.arn}'&&task?.task_role_arn==='${aws_iam_role.'+name+'_task.arn}';
+  if(settings.logRetentionDays!=null&&resource.aws_cloudwatch_log_group?.[name]?.retention_in_days!==settings.logRetentionDays)fail('CloudWatch retention does not retain the explicit finite setting.');
+ }else if(cloud==='azure'){
+  actualMemory=bytes(body.template?.container?.memory);privateIngress=body.ingress?.external_enabled===false;explicitIdentity=body.identity?.type==='SystemAssigned';
+ }else if(cloud==='gcp'){
+  actualMemory=bytes(body.template?.containers?.resources?.limits?.memory);privateIngress=body.ingress==='INGRESS_TRAFFIC_INTERNAL_ONLY';explicitIdentity=!!resource.google_service_account?.[name]&&body.template?.service_account==='${google_service_account.'+name+'.email}';
+ }else if(cloud==='ibm'){
+  actualMemory=bytes(body.scale_memory_limit);privateIngress=body.managed_domain_mappings==='local';explicitIdentity=body.run_service_account==='none';
+ }
+ if(!privateIngress)fail('The private supplied-image contract gained public or implicit ingress.');
+ if(!explicitIdentity)fail('The supplied-image contract lost its explicit scoped runtime identity.');
+ const memoryBlocked=(plan.gapDetails||[]).some(g=>g.componentIds?.includes(node.id)&&/container-setting-.*-(memoryMb|containerMemoryBytes)$/.test(g.id));
+ if(!memoryBlocked){
+  const targets=[...(settings.containerMemoryBytes==null?[]:[settings.containerMemoryBytes]),...(settings.memoryMb==null?[]:[settings.memoryMb*1048576])];
+  if(targets.some(expected=>actualMemory!==expected))fail('Emitted container memory does not exactly retain the explicit byte quantity.');
+ }
+}

package/src/container-runtime.mjs

@@ -0,0 +1,30 @@
+import {runtimeSettings} from './runtime-settings.mjs';
+const MiB=2**20,GiB=2**30;
+// Exact quantities: never round client memory to a provider's size tier. CPU is
+// a proposed compatible allocation, not an inferred CPU/performance requirement.
+export function containerRuntime(node){
+ const provider=node.data.provider,settings=runtimeSettings(node.data.config),gaps=[];
+ const defaults={aws:512*MiB,azure:GiB,gcp:512*MiB,ibm:1e9};
+ const explicit=settings.containerMemoryBytes??(settings.memoryMb==null?null:settings.memoryMb*MiB);
+ const conflict=settings.containerMemoryBytes!=null&&settings.memoryMb!=null&&settings.containerMemoryBytes!==settings.memoryMb*MiB;
+ const bytes=explicit??defaults[provider];let memory,cpu,executionEnvironment;
+ if(provider==='aws'){
+  const gib=bytes/GiB;
+  const tier=bytes===512*MiB?256:Number.isInteger(gib)&&gib>=1?(gib<=2?256:gib<=4?512:gib<=8?1024:gib<=16?2048:gib<=30?4096:gib<=60&&gib%4===0?8192:gib<=120&&gib%8===0?16384:gib===244?32768:null):null;
+  if(tier){memory=String(bytes/MiB);cpu=String(tier);}
+ }else if(provider==='azure'){
+  // Existing environment has no declared workload-profile contract yet. Use the
+  // combinations valid for Consumption-only environments, rather than assume it.
+  if(bytes>=512*MiB&&bytes<=4*GiB&&bytes%(512*MiB)===0){memory=String(bytes/GiB)+'Gi';cpu=bytes/GiB/2;}
+ }else if(provider==='gcp'){
+  if(bytes>=128*MiB&&bytes<=32*GiB&&bytes%MiB===0){memory=String(bytes/MiB)+'Mi';cpu=String(bytes<=4*GiB?1:bytes<=8*GiB?2:bytes<=16*GiB?4:bytes<=24*GiB?6:8);executionEnvironment=bytes<512*MiB?'EXECUTION_ENVIRONMENT_GEN1':'EXECUTION_ENVIRONMENT_GEN2';}
+ }else if(provider==='ibm'){
+  const sizes=new Map([[250e6,'0.125'],[500e6,'0.25'],[1e9,'0.5'],[2e9,'0.5'],[4e9,'1'],[8e9,'2'],[12e9,'6'],[16e9,'4'],[20e9,'10'],[24e9,'6'],[32e9,'8'],[40e9,'10'],[48e9,'12']]);
+  if(sizes.has(bytes)){memory=String(bytes/1e9)+'G';cpu=sizes.get(bytes);}
+ }
+ if(conflict)gaps.push({key:'containerMemoryBytes',value:settings.containerMemoryBytes,reason:'conflicts with the preserved memoryMb requirement (MiB); resolve the conflicting quantities without discarding either'});
+ if(memory==null&&!conflict)gaps.push({key:settings.containerMemoryBytes==null?'memoryMb':'containerMemoryBytes',value:explicit,reason:'has no exact supported memory/CPU mapping in the selected provider/environment contract; no rounding or provider substitution was performed'});
+ // The old finite log-retention field is explicitly a CloudWatch contract.
+ for(const [key,value]of Object.entries(settings))if(!['memoryMb','containerMemoryBytes'].includes(key)&&!(key==='logRetentionDays'&&provider==='aws'))gaps.push({key,value,reason:'is not implemented by this supplied-image footprint; implement and validate the required behavior before applying'});
+ return {requestedMemoryBytes:explicit,memoryBytes:memory==null?defaults[provider]:bytes,memory:memory??({aws:'512',azure:'1Gi',gcp:'512Mi',ibm:'1G'}[provider]),cpu:cpu??({aws:'256',azure:0.5,gcp:'1',ibm:'0.5'}[provider]),executionEnvironment:executionEnvironment||'EXECUTION_ENVIRONMENT_GEN2',logRetentionDays:settings.logRetentionDays??30,gaps};
+}

package/src/container-security-inspection.mjs

@@ -0,0 +1,49 @@
+// Independent supplied-image security/lifecycle contract, expressed from native
+// artifact semantics. Do not import the compiler or trust schedule metadata.
+const canonical=value=>JSON.stringify(normalize(value));
+function normalize(value){
+ if(Array.isArray(value))return value.map(normalize).sort((a,b)=>JSON.stringify(a).localeCompare(JSON.stringify(b)));
+ return value&&typeof value==='object'?Object.fromEntries(Object.keys(value).sort().map(key=>[key,normalize(value[key])])):value;
+}
+const parse=value=>{try{return JSON.parse(value);}catch{return null;}};
+export function inspectContainerSecurity(cloud,name,config,provider,rootRef,fail){
+ const resources=config.resource||{},ref=(type,key)=>'${'+type+'.'+name+'.'+key+'}';
+ const providerKeys={aws:['region','allowed_account_ids','alias'],azure:['features','subscription_id','alias'],gcp:['region','project','alias'],ibm:['region','alias']}[cloud];
+ if(Object.keys(provider||{}).some(key=>!providerKeys.includes(key)))fail('The provider gained configuration outside its reviewed destination/credential-chain contract.');
+ const imageGuard='${can(regex("@sha256:[0-9a-f]{64}$", var.'+name+'_image))}';
+ if(config.variable?.[name+'_image']?.validation?.condition!==imageGuard)fail('The supplied-image input lost its immutable digest requirement.');
+ for(const [type,entries]of Object.entries(resources))if(type!=='terraform_data')for(const item of Object.values(entries)){
+  if(item.lifecycle?.prevent_destroy!==true||item.lifecycle.ignore_changes!==undefined)fail('A managed supplied-image resource lost destruction protection or hides configuration changes.');
+  if(item.count!==undefined||item.for_each!==undefined)fail('A supplied-image resource changed its reviewed instance ownership.');
+  if(!item.depends_on?.includes('terraform_data.review_gate'))fail('A supplied-image resource bypasses its review gate.');
+  if(cloud==='gcp'&&item.project!==undefined&&item.project!=='${var.project_id}')fail('A Google resource overrides the delivery-unit project.');
+ }
+ if(cloud==='gcp'&&resources.google_cloud_run_v2_service?.[name]?.deletion_protection!==true)fail('Cloud Run lost its native deletion protection.');
+ if(cloud!=='aws')return;
+ if(canonical(provider?.allowed_account_ids)!==canonical([rootRef('account_id')]))fail('The AWS provider lost its explicit account boundary.');
+ const partition=ref('data.aws_partition','partition'),lookup=config.data?.aws_partition?.[name];
+ if(!lookup||Object.keys(lookup).length)fail('AWS partition metadata must come from the owned native provider without query overrides.');
+ const trust={Version:'2012-10-17',Statement:[{Effect:'Allow',Principal:{Service:'ecs-tasks.amazonaws.com'},Action:'sts:AssumeRole',Condition:{StringEquals:{'aws:SourceAccount':'${var.account_id}'},ArnLike:{'aws:SourceArn':'arn:'+partition+':ecs:${var.region}:${var.account_id}:*'}}}]};
+ for(const id of [name,name+'_task']){
+  const role=resources.aws_iam_role?.[id];
+  if(canonical(parse(role?.assume_role_policy))!==canonical(trust)||role?.managed_policy_arns!==undefined||role?.inline_policy!==undefined)fail('An ECS role gained unreviewed trust, attachments or inline application permissions.');
+ }
+ const policy=resources.aws_iam_role_policy?.[name];
+ const expected={Version:'2012-10-17',Statement:[{Effect:'Allow',Action:['ecr:GetAuthorizationToken'],Resource:'*'},{Effect:'Allow',Action:['ecr:BatchCheckLayerAvailability','ecr:GetDownloadUrlForLayer','ecr:BatchGetImage'],Resource:'${var.'+name+'_repository_arn}'},{Effect:'Allow',Action:['logs:CreateLogStream','logs:PutLogEvents'],Resource:ref('aws_cloudwatch_log_group','arn')+':*'}]};
+ if(policy?.role!==ref('aws_iam_role','id')||canonical(parse(policy?.policy))!==canonical(expected))fail('ECS execution permissions no longer match exact image-pull and owned-log-stream scope.');
+ const repositoryValidation=config.variable?.[name+'_repository_arn']?.validation?.condition;
+ if(repositoryValidation!=='${can(regex("^arn:(aws|aws-cn|aws-us-gov):ecr:([a-z]{2}-[a-z]+|us-gov-[a-z]+)-[0-9]{1,2}:[0-9]{12}:repository/[a-z0-9][a-z0-9._/-]{0,255}$", var.'+name+'_repository_arn))}')fail('The ECR input no longer excludes wildcard repository grants.');
+ const repositoryRegion='try(split(":",var.'+name+'_repository_arn)[3],"")';
+ if(!policy?.lifecycle?.precondition?.some(p=>p.condition==='${startswith(var.'+name+'_repository_arn,"arn:'+partition+':ecr:") && (startswith('+repositoryRegion+',"cn-") ? "aws-cn" : startswith('+repositoryRegion+',"us-gov-") ? "aws-us-gov" : "aws") == data.aws_partition.'+name+'.partition}'))fail('The ECR grant lost its native deployment-partition/region-family check.');
+ const service=resources.aws_ecs_service?.[name],task=resources.aws_ecs_task_definition?.[name];
+ if(!service?.lifecycle?.precondition?.some(p=>p.condition==='${data.aws_partition.'+name+'.partition == (startswith(var.region,"cn-") ? "aws-cn" : startswith(var.region,"us-gov-") ? "aws-us-gov" : "aws")}'))fail('The native provider partition no longer agrees with the selected supported region family.');
+ if(service?.cluster!==ref('aws_ecs_cluster','id')||service?.task_definition!==ref('aws_ecs_task_definition','arn')||service?.launch_type!=='FARGATE'||service?.enable_execute_command===true)fail('The ECS service lost its owned task/cluster or gained remote execution.');
+ if(task?.network_mode!=='awsvpc'||canonical(task?.requires_compatibilities)!==canonical(['FARGATE']))fail('The task lost its explicit Fargate network contract.');
+ const containers=parse(task?.container_definitions);
+ if(!Array.isArray(containers)||containers.length!==1)fail('The supplied-image task gained unreviewed containers.');
+ else{
+  const container=containers[0];
+  if(container.image!=='${var.'+name+'_image}'||Object.keys(container).some(key=>!['name','image','essential','portMappings','logConfiguration'].includes(key)))fail('The task changed its image or gained unreviewed runtime inputs.');
+  if(container.logConfiguration?.logDriver!=='awslogs'||container.logConfiguration.options?.['awslogs-group']!==ref('aws_cloudwatch_log_group','name')||container.logConfiguration.options?.['awslogs-region']!=='${var.region}')fail('Container logs no longer use the owned log group and region.');
+ }
+}

package/src/container-terraform.mjs

@@ -0,0 +1,109 @@
+import {declaredRegion,PROVIDER_REGION_PATTERNS} from './deployment-region.mjs';
+import {containerRuntime} from './container-runtime.mjs';
+import ibmProviderLock from './runtime/invoice-ibm-provider-lock.json' with {type:'json'};
+import {CONTAINER_SERVICES,containerContract} from './container-contracts.mjs';
+import {existingReferenceFiles} from './existing-references.mjs';
+import {generationProviders} from './generation-provider.mjs';
+import {incompleteTerraform} from './incomplete-terraform.mjs';
+import {CLOUD_PROVIDER_LOCKS} from './cloud-provider-locks.mjs';
+const v=n=>'${var.'+n+'}',ref=(type,n,key)=>'${'+type+'.'+n+'.'+key+'}';
+export function containerTerraform(project,plan,environment='staging'){
+ const providers=generationProviders(project),cloud=providers[0],d=CONTAINER_SERVICES[cloud];
+ if(providers.length!==1||!d)return incompleteTerraform(project,plan,environment);
+ const nodes=project.nodes.filter(containerContract),regions=[...new Set(nodes.map(node=>declaredRegion(node).region).filter(Boolean))];
+ if(regions.length>1)throw Error('Distinct placements require separate composed delivery units; no region was substituted.');
+ const selectedRegion=regions[0];
+ const variable={review_approved:{type:'bool',default:false},region:{type:'string',nullable:false,description:'Explicitly reviewed provider region; no default destination.'}};
+ const examples={review_approved:false,region:{aws:'ap-southeast-2',azure:'australiaeast',gcp:'australia-southeast1',ibm:'au-syd'}[cloud]};
+ if(selectedRegion){variable.region.default=selectedRegion;examples.region=selectedRegion;}
+ variable.region.description=selectedRegion?'Configured region from the current design; review approval is still required. Regenerate the design to change placement.':'Required canonical region; no deployment destination has been chosen by this package.';
+ variable.region.validation={condition:'${can(regex('+JSON.stringify(PROVIDER_REGION_PATTERNS[cloud])+', var.region))'+(selectedRegion?' && var.region == '+JSON.stringify(selectedRegion):'')+'}',error_message:'Use the supported canonical region and preserve the configured placement; change the design to change its destination.'};
+ const input=(name,description,example)=>{variable[name]={type:'string',nullable:false,description,validation:{condition:'${length(trimspace(var.'+name+')) > 0}',error_message:'Supply a reviewed nonempty value.'}};examples[name]=example;return v(name);};
+ const provider={[d.provider]:{region:v('region')}};
+ if(cloud==='azure')provider.azurerm={features:{},subscription_id:input('subscription_id','Reviewed Azure subscription.','11111111-1111-1111-1111-111111111111')};
+ if(cloud==='gcp')provider.google={region:v('region'),project:input('project_id','Existing destination Google Cloud project.','reviewed-project')};
+ if(cloud==='aws')provider.aws.allowed_account_ids=[input('account_id','Expected AWS account; provider refuses another account.','123456789012')];
+ const resource={terraform_data:{review_gate:{input:{design_revision:project.revision,environment},lifecycle:{precondition:[{condition:'${var.review_approved && length(local.unfinished_work) == 0}',error_message:'Review inputs and resolve all required implementations before applying.'}]}}}},data={},outputs={},tests=[],mockData=[];
+ const add=(type,name,body)=>((resource[type]||={})[name]={...body,lifecycle:{...body.lifecycle,prevent_destroy:true},depends_on:['terraform_data.review_gate',...(body.depends_on||[])]});
+ for(const node of nodes){
+  const n=plan.rows.find(r=>r.id===node.id).address,runtime=containerRuntime(node);
+  const name=input(n+'_name','Reviewed unique deployment name; application source is supplied separately.','architect-app-'+(nodes.indexOf(node)+1));
+  variable[n+'_name'].validation={condition:'${can(regex("^[a-z][a-z0-9-]{4,28}[a-z0-9]$", var.'+n+'_name))}',error_message:'Use a unique lowercase name of 6–30 letters, digits or hyphens, starting with a letter.'};
+  const image=input(n+'_image','Reviewed immutable Linux container image digest. No model-generated application code is implied.','registry.example.com/architect@sha256:'+'0'.repeat(64));
+  variable[n+'_image'].validation={condition:'${can(regex("@sha256:[0-9a-f]{64}$", var.'+n+'_image))}',error_message:'Pin the reviewed application image with its SHA-256 digest.'};
+  if(cloud==='gcp'){
+   add('google_service_account',n,{account_id:name,display_name:'Application runtime identity'});
+   add(d.type,n,{name,location:v('region'),deletion_protection:true,ingress:'INGRESS_TRAFFIC_INTERNAL_ONLY',template:{execution_environment:runtime.executionEnvironment,service_account:ref('google_service_account',n,'email'),scaling:{min_instance_count:0,max_instance_count:2},containers:{image,ports:{container_port:8080},resources:{limits:{cpu:runtime.cpu,memory:runtime.memory}},startup_probe:{tcp_socket:{port:8080}}}}});
+   outputs[n+'_uri']={value:ref(d.type,n,'uri')};
+  }else if(cloud==='azure'){
+   const environmentId=input('environment_id','Exact existing Container Apps environment resource ID; its native ID and region are checked.','/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/reviewed-rg/providers/Microsoft.App/managedEnvironments/reviewed-env');
+   variable.environment_id.validation={condition:'${can(regex("(?i)^/subscriptions/[0-9a-f-]{36}/resourcegroups/[^/]+/providers/microsoft[.]app/managedenvironments/[^/]+$", var.environment_id))}',error_message:'Supply the full existing managed environment ARM resource ID.'};
+   data.azurerm_container_app_environment||={};data.azurerm_container_app_environment[n]={name:'${try(split("/", var.environment_id)[8], "invalid")}',resource_group_name:'${try(split("/", var.environment_id)[4], "invalid")}'};
+   add(d.type,n,{name,resource_group_name:input('resource_group_name','Existing destination application resource group.','reviewed-rg'),container_app_environment_id:environmentId,revision_mode:'Single',identity:{type:'SystemAssigned'},template:{min_replicas:0,max_replicas:2,container:{name:'application',image,cpu:runtime.cpu,memory:runtime.memory,readiness_probe:{transport:'TCP',port:8080},liveness_probe:{transport:'TCP',port:8080}}},ingress:{external_enabled:false,target_port:8080,transport:'http',traffic_weight:{latest_revision:true,percentage:100}},lifecycle:{prevent_destroy:true,precondition:[{condition:'${lower(replace(data.azurerm_container_app_environment.'+n+'.location, " ", "")) == var.region}',error_message:'The existing environment is outside the configured region.'},{condition:'${lower(data.azurerm_container_app_environment.'+n+'.id) == lower(var.environment_id)}',error_message:'The existing environment lookup resolved a different subscription or resource ID.'}]}});
+   mockData.push('mock_data "azurerm_container_app_environment" { defaults = '+JSON.stringify({id:examples.environment_id,location:examples.region})+' }');
+   for(const mutation of ['region','identity']){
+    const values={id:examples.environment_id,location:examples.region};
+    if(mutation==='region')values.location=examples.region==='westus2'?'australiaeast':'westus2';else values.id=examples.environment_id.replace('11111111-1111-1111-1111-111111111111','22222222-2222-2222-2222-222222222222');
+    tests.push('run "'+n+'_reject_existing_environment_'+mutation+'" {\n command = plan\n override_data {\n target = data.azurerm_container_app_environment.'+n+'\n values = '+JSON.stringify(values)+'\n }\n expect_failures = [azurerm_container_app.'+n+']\n}');
+   }
+
+   outputs[n+'_id']={value:ref(d.type,n,'id')};
+  }else if(cloud==='ibm'){
+   const projectId=input('code_engine_project_id','Exact existing Code Engine project ID; its native account and region are checked.','11111111-1111-1111-1111-111111111111');
+   input('account_id','Expected existing IBM account ID; reject a project belonging to another account.','11111111111111111111111111111111');
+   variable.account_id.validation={condition:'${can(regex("^[0-9a-f]{32}$", var.account_id))}',error_message:'Supply the expected 32-character IBM account ID.'};
+   data.ibm_code_engine_project||={};data.ibm_code_engine_project[n]={project_id:projectId};
+   add(d.type,n,{project_id:projectId,name,image_reference:image,image_port:8080,managed_domain_mappings:'local',run_service_account:'none',scale_min_instances:0,scale_max_instances:2,scale_cpu_limit:runtime.cpu,scale_memory_limit:runtime.memory,lifecycle:{prevent_destroy:true,precondition:[{condition:'${data.ibm_code_engine_project.'+n+'.region == var.region}',error_message:'The existing Code Engine project is outside the configured region.'},{condition:'${data.ibm_code_engine_project.'+n+'.account_id == var.account_id}',error_message:'The existing Code Engine project belongs to another account.'}]}});
+   mockData.push('mock_data "ibm_code_engine_project" { defaults = '+JSON.stringify({id:examples.code_engine_project_id,region:examples.region,account_id:examples.account_id})+' }');
+   for(const mutation of ['region','identity']){
+    const values={id:examples.code_engine_project_id,region:examples.region,account_id:examples.account_id};
+    if(mutation==='region')values.region=examples.region==='eu-de'?'au-syd':'eu-de';else values.account_id='22222222222222222222222222222222';
+    tests.push('run "'+n+'_reject_existing_project_'+mutation+'" {\n command = plan\n override_data {\n target = data.ibm_code_engine_project.'+n+'\n values = '+JSON.stringify(values)+'\n }\n expect_failures = [ibm_code_engine_app.'+n+']\n}');
+   }
+
+   outputs[n+'_id']={value:ref(d.type,n,'id')};
+  }else{
+   variable.account_id.validation={condition:'${can(regex("^[0-9]{12}$", var.account_id))}',error_message:'Supply the expected 12-digit AWS account ID.'};
+   data.aws_partition||={};data.aws_partition[n]={};
+   const partition=ref('data.aws_partition',n,'partition'),examplePartition=examples.region.startsWith('cn-')?'aws-cn':examples.region.startsWith('us-gov-')?'aws-us-gov':'aws';
+   const partitionCheck='${data.aws_partition.'+n+'.partition == (startswith(var.region,"cn-") ? "aws-cn" : startswith(var.region,"us-gov-") ? "aws-us-gov" : "aws")}';
+   mockData.push('mock_data "aws_partition" { defaults = '+JSON.stringify({partition:examplePartition})+' }');
+   const assume=JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Principal:{Service:'ecs-tasks.amazonaws.com'},Action:'sts:AssumeRole',Condition:{StringEquals:{'aws:SourceAccount':v('account_id')},ArnLike:{'aws:SourceArn':'arn:'+partition+':ecs:'+v('region')+':'+v('account_id')+':*'}}}]});
+   add('aws_ecs_cluster',n,{name});add('aws_cloudwatch_log_group',n,{name:input(n+'_log_group','Explicit log group name.','/architect/application'),retention_in_days:runtime.logRetentionDays});
+   add('aws_iam_role',n,{assume_role_policy:assume});add('aws_iam_role',n+'_task',{assume_role_policy:assume});
+   add('aws_iam_role_policy',n,{role:ref('aws_iam_role',n,'id'),policy:JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Action:['ecr:GetAuthorizationToken'],Resource:'*'},{Effect:'Allow',Action:['ecr:BatchCheckLayerAvailability','ecr:GetDownloadUrlForLayer','ecr:BatchGetImage'],Resource:input(n+'_repository_arn','Exact ECR repository ARN for the supplied private image.','arn:aws:ecr:ap-southeast-2:123456789012:repository/architect')},{Effect:'Allow',Action:['logs:CreateLogStream','logs:PutLogEvents'],Resource:ref('aws_cloudwatch_log_group',n,'arn')+':*'}]})});
+   variable[n+'_repository_arn'].validation={condition:'${can(regex("^arn:(aws|aws-cn|aws-us-gov):ecr:([a-z]{2}-[a-z]+|us-gov-[a-z]+)-[0-9]{1,2}:[0-9]{12}:repository/[a-z0-9][a-z0-9._/-]{0,255}$", var.'+n+'_repository_arn))}',error_message:'Supply one explicit ECR repository ARN in a supported partition, without wildcards.'};
+   const repositoryRegion='try(split(":",var.'+n+'_repository_arn)[3],"")';
+   resource.aws_iam_role_policy[n].lifecycle.precondition=[{condition:'${startswith(var.'+n+'_repository_arn,"arn:'+partition+':ecr:") && (startswith('+repositoryRegion+',"cn-") ? "aws-cn" : startswith('+repositoryRegion+',"us-gov-") ? "aws-us-gov" : "aws") == data.aws_partition.'+n+'.partition}',error_message:'The image repository ARN and its region family must belong to the native deployment partition.'}];
+   examples[n+'_repository_arn']='arn:'+examplePartition+':ecr:'+examples.region+':123456789012:repository/architect';
+   add('aws_ecs_task_definition',n,{family:name,network_mode:'awsvpc',requires_compatibilities:['FARGATE'],cpu:runtime.cpu,memory:runtime.memory,execution_role_arn:ref('aws_iam_role',n,'arn'),task_role_arn:ref('aws_iam_role',n+'_task','arn'),container_definitions:JSON.stringify([{name:'application',image,essential:true,portMappings:[{containerPort:8080,protocol:'tcp'}],logConfiguration:{logDriver:'awslogs',options:{'awslogs-group':ref('aws_cloudwatch_log_group',n,'name'),'awslogs-region':v('region'),'awslogs-stream-prefix':'application'}}}])});
+   input(n+'_vpc_id','Exact existing VPC shared by the selected subnets and security groups.','vpc-11111111111111111');
+   variable[n+'_vpc_id'].validation={condition:'${can(regex("^vpc-([0-9a-f]{8}|[0-9a-f]{17})$", var.'+n+'_vpc_id))}',error_message:'Supply the exact existing VPC ID.'};
+   for(const [key,prefix]of [['subnets','subnet'],['security_groups','sg']]){
+    variable[n+'_'+key]={type:'list(string)',nullable:false,validation:{condition:'${length(var.'+n+'_'+key+') > 0 && length(distinct(var.'+n+'_'+key+')) == length(var.'+n+'_'+key+') && alltrue([for id in var.'+n+'_'+key+' : can(regex("^'+prefix+'-([0-9a-f]{8}|[0-9a-f]{17})$", id))])}',error_message:'Supply distinct existing '+key+' IDs; network access policy requires separate review.'}};examples[n+'_'+key]=[prefix+'-11111111111111111'];
+   }
+   data.aws_subnet||={};data.aws_subnet[n]={for_each:'${toset(var.'+n+'_subnets)}',id:'${each.value}'};
+   data.aws_security_group||={};data.aws_security_group[n]={for_each:'${toset(var.'+n+'_security_groups)}',id:'${each.value}'};
+   add(d.type,n,{name,cluster:ref('aws_ecs_cluster',n,'id'),task_definition:ref('aws_ecs_task_definition',n,'arn'),desired_count:1,launch_type:'FARGATE',platform_version:'1.4.0',network_configuration:{subnets:v(n+'_subnets'),security_groups:v(n+'_security_groups'),assign_public_ip:false},depends_on:['aws_iam_role_policy.'+n],lifecycle:{precondition:['aws_subnet','aws_security_group'].map(type=>({condition:'${alltrue([for item in values(data.'+type+'.'+n+') : item.vpc_id == var.'+n+'_vpc_id])}',error_message:'Selected existing network resources must belong to the configured VPC.'}))}});outputs[n+'_id']={value:ref(d.type,n,'id')};
+   mockData.push(...['aws_subnet','aws_security_group'].map(type=>'mock_data "'+type+'" { defaults = '+JSON.stringify({vpc_id:examples[n+'_vpc_id']})+' }'));
+   resource.aws_ecs_service[n].lifecycle.precondition.push({condition:partitionCheck,error_message:'The provider partition does not match the selected supported region family.'});
+   const foreignPartition=examplePartition==='aws'?'aws-cn':'aws';
+   tests.push('run "'+n+'_reject_foreign_repository_partition" {\n command = plan\n variables { '+n+'_repository_arn = '+JSON.stringify(examples[n+'_repository_arn'].replace('arn:'+examplePartition+':','arn:'+foreignPartition+':'))+' }\n expect_failures = [aws_iam_role_policy.'+n+']\n}');
+   tests.push('run "'+n+'_reject_foreign_provider_partition" {\n command = plan\n override_data {\n target = data.aws_partition.'+n+'\n values = {partition = '+JSON.stringify(foreignPartition)+'}\n }\n expect_failures = [aws_iam_role_policy.'+n+']\n}');
+   const foreignRepository='arn:'+foreignPartition+':ecr:'+(foreignPartition==='aws-cn'?'cn-north-1':'eu-west-1')+':123456789012:repository/architect';
+   tests.push('run "'+n+'_reject_partition_region_mismatch" {\n command = plan\n variables { '+n+'_repository_arn = '+JSON.stringify(foreignRepository)+' }\n override_data {\n target = data.aws_partition.'+n+'\n values = {partition = '+JSON.stringify(foreignPartition)+'}\n }\n expect_failures = [aws_ecs_service.'+n+']\n}');
+   for(const [type,key]of [['aws_subnet','subnets'],['aws_security_group','security_groups']])tests.push('run "'+n+'_reject_foreign_'+type+'" {\n command = plan\n override_data {\n target = data.'+type+'.'+n+'['+JSON.stringify(examples[n+'_'+key][0])+']\n values = {vpc_id = "vpc-22222222222222222"}\n }\n expect_failures = [aws_ecs_service.'+n+']\n}');
+  }
+  const imagePath={aws:`jsondecode(aws_ecs_task_definition.${n}.container_definitions)[0].image`,azure:`azurerm_container_app.${n}.template[0].container[0].image`,gcp:`google_cloud_run_v2_service.${n}.template[0].containers[0].image`,ibm:`ibm_code_engine_app.${n}.image_reference`}[cloud];
+  const privateCondition={aws:`aws_ecs_service.${n}.network_configuration[0].assign_public_ip == false`,azure:`azurerm_container_app.${n}.ingress[0].external_enabled == false`,gcp:`google_cloud_run_v2_service.${n}.ingress == "INGRESS_TRAFFIC_INTERNAL_ONLY"`,ibm:`ibm_code_engine_app.${n}.managed_domain_mappings == "local"`}[cloud];
+  tests.push(`run "${n}_security" {\n command = plan\n assert {\n condition = ${imagePath} == var.${n}_image\n error_message = "Use the reviewed immutable image."\n }\n assert {\n condition = ${privateCondition}\n error_message = "Unrequested public exposure is forbidden."\n }\n}\nrun "${n}_reject_mutable_image" {\n command = plan\n variables { ${n}_image = "registry.example.com/app:latest" }\n expect_failures = [var.${n}_image]\n}`);
+  tests.push(`run "${n}_footprint" {\n command = plan\n assert {\n condition = ${d.type}.${n}.name == var.${n}_name\n error_message = "Container service name must use the reviewed input."\n }\n}`);
+ }
+ if(nodes.length>1&&mockData.length)throw Error('Existing-system test contracts require one independently scoped unit.');
+ tests.push('run "invalid_region_blocked" {\n command = plan\n variables { region = "Sydney (proposed)" }\n expect_failures = [var.region]\n}');
+ if(selectedRegion)tests.push('run "changed_accepted_region_blocked" {\n command = plan\n variables { region = '+JSON.stringify({aws:'us-east-1',azure:'westus2',gcp:'us-central1',ibm:'eu-de'}[cloud]===selectedRegion?{aws:'ap-southeast-2',azure:'australiaeast',gcp:'australia-southeast1',ibm:'au-syd'}[cloud]:{aws:'us-east-1',azure:'westus2',gcp:'us-central1',ibm:'eu-de'}[cloud])+' }\n expect_failures = [var.region]\n}');
+ const gaps=[...plan.gapDetails.map(g=>g.id),...(environment==='production'?['production-state-and-operations-review-required']:[])];
+ const config={terraform:{required_version:'>= 1.7.0, < 2.0.0',required_providers:{[d.provider]:{source:d.source,version:d.version}}},provider,variable,locals:{unfinished_work:gaps},...(Object.keys(data).length?{data}:{}),resource,output:outputs};
+ const values=Object.entries({...examples,review_approved:true}).map(([k,val])=>k+' = '+JSON.stringify(val)).join('\n');
+ return {'.gitignore':'.terraform/\n*.tfstate*\n*.tfplan\n*.tfvars\n*.tfvars.json\n!deployment.tfvars.json.example\n',...existingReferenceFiles(project),...(CLOUD_PROVIDER_LOCKS[cloud]?{'.terraform.lock.hcl':cloud==='ibm'?ibmProviderLock.lock:CLOUD_PROVIDER_LOCKS[cloud]}:{}),'main.tf.json':JSON.stringify(config,null,2),'resource-schedule.json':JSON.stringify(plan,null,2),'deployment.tfvars.json.example':JSON.stringify(examples,null,2),'tests/container.tftest.hcl':`mock_provider "${d.provider}" {\n${mockData.join('\n')}\n}\nvariables {\n${values}\n}\n${tests.join('\n')}\nrun "unapproved_blocked" {\n command = plan\n variables { review_approved = false }\n expect_failures = [terraform_data.review_gate]\n}\n`,'README.md':`# ${d.service} container footprint\n\nA native deployment footprint for an explicitly selected, supplied Linux application image listening on port 8080. Pin and build the real application image before use. This compiler does not implement application authentication, payments, durable memory or unspecified connections. It never packages the local loopback sidecar as a hosted application.\n\nMemory requirements use config.containerMemoryBytes as an exact integer quantity; legacy memoryMb retains MiB semantics (1048576 bytes). Provider-native allocation is literal in main.tf.json. Compatible CPU allocation is an engineering proposal, not measured performance. Decimal IBM GB is not GiB. Unsupported exact sizes, conflicting quantities and other unimplemented settings remain in resource-schedule.json and block review approval; no rounding or provider fallback is performed. Azure uses combinations valid for Consumption-only environments until an explicit workload-profile contract is implemented.\n\nConfigured canonical regions are retained as validated inputs. A configured value can still be a proposal: generation does not accept requirements or decisions, and review_approved remains false. Changing that destination requires changing and regenerating the design; unresolved regions have no deployment default. Identifier syntax is not regional service availability or a residency/compliance claim. Azure reads the existing managed environment to check its native location and exact resource ID/subscription; IBM reads the existing project to check its native region and account. These are read-only references, not imports or replacement resources. Mock data in local tests is an explicit fixture, not an observed cloud environment. Parent composition gates can defer child data reads until apply; unit mock plans exercise the checks with resolved fixture data. No account plan or apply is performed by these local checks.\n\nManaged native resources retain prevent_destroy. Terraform rejects their destruction or replacement while these lifecycle rules remain in configuration; removing the resource or editing its configuration can remove that protection. Image revisions that require replacement need a separately reviewed lifecycle change and plan. This is not a backup, state lock or migration mechanism.\n\n${cloud==='aws'?'AWS reads exactly the selected existing subnets and security groups in the configured provider region and checks that they share the supplied VPC. It does not create or modify those networks. VPC membership and no public task IP do not prove route, firewall, egress or end-to-end access policy. Review those policies and local connection tests separately, including shared-VPC ownership. ECS role trust is scoped to the configured source account and regional ECS ARN; execution permissions cover only image retrieval and owned log streams. Native aws_partition metadata supplies the ARN partition for commercial, China and GovCloud region families. Native guards reject region-family and ECR repository partition mismatches. This does not establish regional service availability or cross-partition application/network integration. Other adapters retain their separate partition policies. The application task role has no application-data grants.':''}\n\nIngress is private; public website routing and user authentication are separate contracts. Runtime identity has no application-data grants. Existing network/environment/project prerequisites must be reviewed; image-pull and platform logging configuration must be verified for the destination. Azure and IBM private-registry credentials require a separate secret integration. No credentials belong in this directory.\n\nUse Terraform 1.7+, copy deployment.tfvars.json.example to a private inputs file, supply every reviewed input and image digest, run terraform init -backend=false, terraform validate and terraform test. Mock tests inspect configuration only. An authorized account plan, real image startup checks, access tests, rollback and approval are required before deployment. Production remains blocked pending state and operational review.\n`};
+}

package/src/conversation.mjs

@@ -0,0 +1,17 @@
+// Conversation belongs to the project file, without changing the design revision.
+export function conversationMessages(project, fallback = []) {
+  const messages = project.extensions?.conversation?.messages;
+  return Array.isArray(messages) && messages.length ? cleanMessages(messages) : fallback;
+}
+function cleanMessages(messages) {
+  return messages.filter(m => m && ['user','assistant'].includes(m.role) && typeof m.text === 'string').map(m => ({
+    role:m.role, text:m.text,
+    ...(typeof m.activityId==='string'&&/^[a-f0-9-]{36}$/.test(m.activityId)?{activityId:m.activityId}:{}),
+    ...(m.requestId?{requestId:String(m.requestId).slice(0,100)}:{}),
+    ...(['queued','processing','complete','superseded','failed','cancelled'].includes(m.workState)?{workState:m.workState}:{}),
+    ...(Array.isArray(m.attachments) && m.attachments.length ? {attachments:m.attachments.filter(a=>a && typeof a === "object").map(a=>({id:String(a.id || a.name),name:String(a.name || 'Attachment'),mime:String(a.mime || ''),originalNotSaved:true}))} : {}),
+  }));
+}
+export function withConversation(project, messages) {
+  return {...project, extensions:{...project.extensions, conversation:{version:1,messages:cleanMessages(messages)}}};
+}