@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/cross-cloud-storage.mjs

@@ -0,0 +1,100 @@
+import {resourceAddress} from './identifiers.mjs';
+import {incompleteTerraform} from './incomplete-terraform.mjs';
+import {existingReference,existingReferenceFiles} from './existing-references.mjs';
+import {CLOUD_PROVIDER_LOCKS} from './cloud-provider-locks.mjs';
+// Narrow native storage contracts; this does not imply general provider coverage.
+const definitions={azure:{name:'Azure Blob Storage',provider:'azurerm',source:'hashicorp/azurerm',version:'4.81.0',types:['azurerm_storage_account','azurerm_storage_container','azurerm_role_definition','azurerm_role_assignment']},gcp:{name:'Google Cloud Storage',provider:'google',source:'hashicorp/google',version:'7.46.2',types:['google_storage_bucket','google_storage_bucket_iam_member']},ibm:{name:'IBM Cloud Object Storage',provider:'ibm',source:'IBM-Cloud/ibm',version:'1.89.0',types:['ibm_cos_bucket','ibm_iam_service_policy']}};
+const address=resourceAddress;
+export const hasCrossCloud=project=>project.nodes.some(n=>n.data.kind!=='note'&&['azure','gcp','ibm'].includes(n.data.provider)&&n.data.implementation==='private-object-storage');
+export function crossCloudPlan(project){
+ const nodes=project.nodes.filter(n=>n.data.kind!=='note'),providers=[...new Set(nodes.filter(n=>n.data.origin!=='existing').map(n=>n.data.provider))];
+ const provider=providers.length===1?providers[0]:null,definition=definitions[provider];
+ const stores=nodes.filter(n=>definition&&n.data.provider===provider&&n.data.origin!=='existing'&&n.data.implementation==='private-object-storage'&&String(n.data.service||n.data.label)===definition.name);
+ const actors=nodes.filter(n=>n.data.provider==='tools'&&n.data.origin==='existing'&&n.data.binding==='cloud-storage-principal');
+ const connections=project.edges.filter(e=>e.access==='storage-object-admin'&&actors.some(a=>a.id===e.source)&&stores.some(n=>n.id===e.target));
+ const gapDetails=[];
+ if(actors.length!==1)gapDetails.push({id:'caller-scope',message:'This storage contract requires one explicit existing caller; multiple independent identities need separate permission inputs.'});
+ if(!definition)gapDetails.push({id:'cloud-scope',message:'Only one provider per native storage export is supported; mixed-cloud deployment remains unimplemented.'});
+ for(const n of nodes){
+  if(!stores.includes(n)&&!actors.includes(n)&&!existingReference(n))gapDetails.push({id:'resource-'+address(n.id),componentIds:[n.id],message:`${n.data.label}: native storage implementation is unavailable for this component.`});
+  if(stores.includes(n)&&connections.filter(e=>e.target===n.id).length!==1)gapDetails.push({id:'access-'+address(n.id),componentIds:[n.id],message:`${n.data.label}: exactly one explicit object-admin caller binding is required.`});
+  if(actors.includes(n)&&!connections.some(e=>e.source===n.id))gapDetails.push({id:'access-'+address(n.id),componentIds:[n.id],message:'Caller is not connected to a supported storage component.'});
+ }
+ for(const e of project.edges)if(!connections.includes(e))gapDetails.push({id:'connection-'+address(e.id),edgeIds:[e.id],message:'Unsupported storage integration; preserve and implement the requested flow.'});
+ if(!stores.length)gapDetails.push({id:'no-storage',message:'Select a supported private-object-storage implementation.'});
+ const rows=nodes.map(n=>({id:n.id,address:address(n.id),label:n.data.label,provider:n.data.provider,service:n.data.service||n.data.label,existing:n.data.origin==='existing',foundation:stores.includes(n),compute:false,reference:actors.includes(n),existingServiceReference:existingReference(n),implemented:stores.includes(n)||actors.includes(n)||!!existingReference(n),resources:stores.includes(n)?definition.types:[],settings:{},region:n.data.config?.region||'To be selected',dependencies:[],terraform:existingReference(n)?'Existing service reference — preserved without provisioning or import; behavior and connections remain unverified':stores.includes(n)?'Typed native storage and scoped object permissions generated; cloud verification required':actors.includes(n)?'Existing principal reference; permissions require review':'Implementation needed'}));
+ return {revision:project.revision,provider,rows,connections:project.edges.map(e=>({...e,generated:connections.includes(e)})),storageContracts:stores.map(n=>({id:n.id,address:address(n.id),callerId:connections.find(e=>e.target===n.id)?.source})),gapDetails,gaps:gapDetails.map(g=>g.message),accessPlan:{bindings:[],connections:[]},asyncPlan:{pipelines:[]},summaryPlan:{entries:[],modelIds:[]},ragPlan:{entries:[],componentIds:[]},sourceContractPlan:{sources:[],connections:[]},webPlan:{entries:[],componentIds:[]},scope:'Native storage foundation only; emulator does not validate IAM or control-plane deployment.',sources:[]};
+}
+
+const CLIENT=`"""Generated object CRUD adapters. Configure an authenticated provider SDK separately.
+Emulator injection is test-only; this file neither discovers credentials nor provisions resources.
+"""
+def azure_put(container,key,data):
+    return container.upload_blob(key,data,overwrite=True)
+def azure_get(container,key):
+    return container.download_blob(key).readall()
+def azure_delete(container,key):
+    container.delete_blob(key,delete_snapshots='include')
+def gcp_put(bucket,key,data,expected_generation=None):
+    blob=bucket.blob(key)
+    blob.upload_from_string(data,if_generation_match=expected_generation,timeout=5,retry=None)
+    return blob.generation
+def gcp_get(bucket,key,generation=None):
+    return bucket.blob(key,generation=generation).download_as_bytes(timeout=5,retry=None)
+def gcp_delete(bucket,key,generation=None):
+    bucket.blob(key,generation=generation).delete(timeout=5,retry=None)
+def ibm_put(client,bucket,key,data):
+    return client.put_object(Bucket=bucket,Key=key,Body=data)
+def ibm_get(client,bucket,key,version=None):
+    args={'Bucket':bucket,'Key':key}
+    if version:args['VersionId']=version
+    result=client.get_object(**args)
+    try:return result['Body'].read()
+    finally:result['Body'].close()
+def ibm_delete(client,bucket,key,version):
+    client.delete_object(Bucket=bucket,Key=key,VersionId=version)
+`;
+
+export function crossCloudTerraform(project,environment='staging'){
+ const plan=crossCloudPlan(project),d=definitions[plan.provider];
+ if(!d)return incompleteTerraform(project,plan,environment);
+ const p=d.provider;
+ const variable={review_approved:{type:'bool',default:false,description:'Explicitly review the real destination, permissions, cost and plan before apply.'},region:{type:'string',description:'Reviewed provider-native region; emulator region does not select a deployment location.'}};
+ const resource={terraform_data:{review_gate:{input:{design_revision:project.revision,environment},lifecycle:{precondition:[{condition:'${var.review_approved && length(local.unfinished_work) == 0}',error_message:'Unfinished work or missing review blocks deployment.'}]}}}};
+ const add=(type,name,body)=>{(resource[type]||={})[name]={...body,depends_on:['terraform_data.review_gate']};};
+ const v=name=>'${var.'+name+'}',ref=(type,name,field)=>'${'+type+'.'+name+'.'+field+'}';
+ const input=(name,description)=>variable[name]={type:'string',nullable:false,description};
+ const examples={review_approved:true,region:{azure:'australiaeast',gcp:'australia-southeast1',ibm:'au-syd'}[plan.provider]||'australia-southeast1'};
+ const provider=d?{[p]:{}}:{};
+ if(plan.provider==='azure'){
+  input('subscription_id','Reviewed Azure subscription UUID.');input('resource_group_name','Existing reviewed resource group.');input('principal_object_id','Existing Entra principal object UUID; no credentials.');
+  provider[p]={features:{},subscription_id:v('subscription_id'),storage_use_azuread:true};Object.assign(examples,{subscription_id:'11111111-1111-1111-1111-111111111111',resource_group_name:'synthetic-qualification',principal_object_id:'22222222-2222-2222-2222-222222222222'});
+ }
+ if(plan.provider==='gcp'){input('project_id','Reviewed existing Google Cloud project.');input('principal_member','Existing serviceAccount:email identity for object CRUD; no allUsers or allAuthenticatedUsers.');variable.principal_member.validation={condition:'${can(regex("^serviceAccount:[^@ ]+@[^ ]+\\\\.iam\\\\.gserviceaccount\\\\.com$", var.principal_member))}',error_message:'Select a specific existing service account.'};provider[p]={project:v('project_id'),region:v('region')};Object.assign(examples,{project_id:'synthetic-qualification',principal_member:'serviceAccount:operator@synthetic-qualification.iam.gserviceaccount.com'});}
+ if(plan.provider==='ibm'){input('cos_instance_crn','Existing reviewed COS instance CRN.');input('iam_service_id','Existing IBM IAM service ID for bucket-scoped object access.');provider[p]={region:v('region')};Object.assign(examples,{cos_instance_crn:'crn:v1:bluemix:public:cloud-object-storage:global:a/00000000000000000000000000000000:11111111-1111-1111-1111-111111111111::',iam_service_id:'ServiceId-22222222-2222-2222-2222-222222222222'});}
+ let storageIndex=0;
+ for(const store of plan.storageContracts){
+  storageIndex++;
+  const n=store.address;input(n+'_name','Globally unique reviewed storage name.');examples[n+'_name']=plan.provider==='azure'?`atmemsynthetic${storageIndex}`:`atmem-synthetic-storage-${storageIndex}`;
+  if(plan.provider==='azure'){
+   add('azurerm_storage_account',n,{name:v(n+'_name'),resource_group_name:v('resource_group_name'),location:v('region'),account_tier:'Standard',account_replication_type:'LRS',account_kind:'StorageV2',min_tls_version:'TLS1_2',https_traffic_only_enabled:true,allow_nested_items_to_be_public:false,shared_access_key_enabled:false,blob_properties:{versioning_enabled:true,delete_retention_policy:{days:7}},lifecycle:{prevent_destroy:environment!=='qualification'}});
+   add('azurerm_storage_container',n,{name:'documents',storage_account_id:ref('azurerm_storage_account',n,'id'),container_access_type:'private'});
+   add('azurerm_role_definition',n,{name:'AtMem object CRUD '+v(n+'_name'),scope:ref('azurerm_storage_account',n,'id'),permissions:[{data_actions:['Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read','Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write','Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete']}],assignable_scopes:[ref('azurerm_storage_account',n,'id')]});
+   add('azurerm_role_assignment',n,{scope:ref('azurerm_storage_container',n,'resource_manager_id'),role_definition_id:ref('azurerm_role_definition',n,'role_definition_resource_id'),principal_id:v('principal_object_id')});
+  }
+  if(plan.provider==='gcp'){
+   add('google_storage_bucket',n,{name:v(n+'_name'),project:v('project_id'),location:v('region'),uniform_bucket_level_access:true,public_access_prevention:'enforced',versioning:{enabled:true},force_destroy:false,lifecycle:{prevent_destroy:environment!=='qualification'}});
+   add('google_storage_bucket_iam_member',n,{bucket:ref('google_storage_bucket',n,'name'),role:'roles/storage.objectUser',member:v('principal_member')});
+  }
+  if(plan.provider==='ibm'){
+   add('ibm_cos_bucket',n,{bucket_name:v(n+'_name'),resource_instance_id:v('cos_instance_crn'),region_location:v('region'),storage_class:'standard',object_versioning:{enable:true},force_delete:false,lifecycle:{prevent_destroy:environment!=='qualification'}});
+   add('ibm_iam_service_policy',n,{iam_service_id:v('iam_service_id'),roles:['Writer'],resources:[{service:'cloud-object-storage',resource_instance_id:'${split(":", var.cos_instance_crn)[7]}',resource_type:'bucket',resource:ref('ibm_cos_bucket',n,'bucket_name')}]});
+  }
+ }
+ const gaps=[...plan.gapDetails.map(g=>g.id),...(environment==='production'?['production-remote-state-and-operational-review-required']:[])];
+ const config={terraform:{required_version:'>= 1.7.0, < 2.0.0',required_providers:d?{[p]:{source:d.source,version:d.version}}:{}},provider,variable,locals:{unfinished_work:gaps},resource,output:{design_revision:{value:project.revision},environment:{value:environment}}};
+ const values=Object.entries(examples).map(([k,val])=>`  ${k} = ${JSON.stringify(val)}`).join('\n');
+ return {...existingReferenceFiles(project),...(d?{'.terraform.lock.hcl':CLOUD_PROVIDER_LOCKS[plan.provider],'requirements.txt':({azure:'azure-storage-blob==12.31.1',gcp:'google-cloud-storage==3.17.1',ibm:'boto3==1.43.123'})[plan.provider]+'\n'}:{}),'main.tf.json':JSON.stringify(config,null,2),'resource-schedule.json':JSON.stringify(plan,null,2),'storage_client.py':CLIENT,'deployment.tfvars.json.example':JSON.stringify({...examples,review_approved:false},null,2),'.gitignore':'.terraform/\n*.tfstate*\n*.tfplan\n*.tfvars\n*.tfvars.json\n__pycache__/\n',
+  'tests/storage.tftest.hcl':`mock_provider "${p}" {}\nvariables {\n${values}\n}\nrun "reviewed_storage_plan" { command = plan }\nrun "unreviewed_plan_blocked" {\n command = plan\n variables { review_approved = false }\n expect_failures = [terraform_data.review_gate]\n}\n`,
+  'README.md':`# ${d?.name||'Unsupported cloud'} storage foundation\n\nNative resources and an SDK adapter for explicit private-object-storage + cloud-storage-principal + storage-object-admin contracts. Object permissions include deletion for this synthetic CRUD scenario. Existing principal permissions and public grants outside this export require review; no default emulator identity is a deployment identity. Azure uses a container-scoped custom data role, GCP a bucket-scoped objectUser grant, IBM a bucket-scoped Writer grant. Existing subscription/project/resource group/COS instance inputs must be reviewed. Provider-managed encryption defaults apply; customer-managed keys and private-network routing are not implemented by this contract. Azure has an authenticated public network endpoint, not a private endpoint.\n\nEmulation exercises object APIs and emitted client functions, not control-plane apply or IAM enforcement. Run terraform init -backend=false, terraform validate, then terraform test in a credential-free directory. Use the standard provider credential chain only for a separately approved account plan. No credentials belong in this export. Generated examples use synthetic placeholders. Production is blocked pending remote state and operational review. Never clear those gates to obtain a pass. SDK adapters accept an explicitly configured authenticated client; install the pinned SDK from requirements.txt in an isolated environment before configuring the authenticated client; SDK dependency installation is operator-owned (Azure azure-storage-blob, GCP google-cloud-storage, IBM S3-compatible boto3/HMAC client).\n`};
+}

package/src/delivery-capabilities.mjs

@@ -0,0 +1,25 @@
+import {INVOICE_SERVICES} from './invoice-plan.mjs';
+import {containerContract} from './container-contracts.mjs';
+import {invoiceTerraform} from './invoice-terraform.mjs';
+import {containerTerraform} from './container-terraform.mjs';
+import {planCapabilityComposition,deliveryUnitProject} from './capability-composition.mjs';
+import {composeTerraformUnits} from './terraform-composition.mjs';
+// Reviewed domain/provider policies remain explicit adapters. The partitioner and
+// linker operate on contracts and unit identities, never project names or corpus IDs.
+export const DELIVERY_CAPABILITIES=Object.freeze([
+ Object.freeze({id:'invoice-workflow',matches:node=>node.data.origin==='proposed'&&node.data.implementation==='invoice-workflow'&&node.data.service===INVOICE_SERVICES[node.data.provider],compile:(project,plan,environment)=>invoiceTerraform(project,plan,environment,{stateScope:'parent'})}),
+ Object.freeze({id:'container-service',matches:containerContract,compile:containerTerraform}),
+]);
+export const capabilityCompositionPlan=(project,planProject)=>planCapabilityComposition(project,DELIVERY_CAPABILITIES,planProject);
+export function compileCapabilityComposition(project,plan,planProject,environment='staging'){
+ if(!['staging','production','qualification'].includes(environment))throw Error('Use an explicit supported composition environment.');
+ const current=capabilityCompositionPlan(project,planProject);
+ if(!current||plan.revision!==project.revision||JSON.stringify(current.composition)!==JSON.stringify(plan.composition)||JSON.stringify(current.gapDetails)!==JSON.stringify(plan.gapDetails))throw Error('The composition plan is stale; compile the latest complete design.');
+ const units=current.composition.units.map(unit=>{
+  const scoped=deliveryUnitProject(project,unit.id),adapter=DELIVERY_CAPABILITIES.find(c=>c.id===unit.implementation),child=planProject(scoped);
+  return {id:unit.id,implementation:unit.implementation,files:adapter.compile(scoped,child,environment)};
+ });
+ const files=composeTerraformUnits(project,units,{environment,gaps:current.gapDetails.map(g=>g.id)});
+ files['resource-schedule.json']=JSON.stringify(current,null,2)+'\n';
+ return files;
+}

package/src/delivery.mjs

@@ -0,0 +1,58 @@
+import {architectureWork} from './architecture-work.mjs';
+import {artifactWorkProjection} from './artifact-work.mjs';
+import {generationQuality} from './generation-quality.mjs';
+import {implementationOutcome} from './implementation-outcome.mjs';
+import {systemDescriptionMarkdown,requirementExplanation} from './system-description.mjs';
+import { specKit } from "./spec-kit.mjs";
+import { requirementNumber } from "./derive.mjs";
+// All deliverables are generated from one project snapshot, never independently edited copies.
+import { toProjectFile } from "./project-file.mjs";
+import { deploymentDocument } from "./document.mjs";
+import { mermaid, adrMarkdown, OPTION_NAMES } from "./pack.mjs";
+import { OPTIONS, CRITERIA, optionScore } from "./engagement.mjs";
+import { estimate, consultingEstimate, DISCLAIMER } from "./estimate.mjs";
+import { resourcePlan, resourceMarkdown } from "./resources.mjs";
+import { terraformSketch } from "./terraform.mjs";
+import { review, blockers } from "./review.mjs";
+
+const text = (s) => String(s ?? "").replaceAll("|", "\\|").replaceAll("\n", " ");
+const json = (v) => JSON.stringify(v, null, 2);
+const list = (items) => items.length ? items.map((x) => `- ${x}`).join("\n") : "None recorded.";
+export function solutionSpecification(project) {
+  const a = project.assessment;
+  return `# ${project.name} — solution specification\n\n## Problem and intended outcome\n\n${implementationOutcome(project)}\n\n## Scope\n\n${list((project.useCases || []).map((u) => `${u.title}: ${u.verdict}${u.reason ? ` — ${u.reason}` : ""}`))}\n\n## Requirements and acceptance criteria\n\n${list((project.needs || []).map((r) => `[${requirementNumber(project,r.id)}] ${r.statement} (${r.priority}, ${r.status}); target: ${r.measure ? `${r.measure.metric} ${r.measure.op} ${r.measure.target}${r.measure.unit || ""}` : "acceptance target needed"}; linked blocks: ${r.links?.join(", ") || "not linked"}${`\n\nDesign explanation: ${requirementExplanation(r)}`}${r.basis ? `\n\nBasis: ${r.basis}` : ""}`))}\n\n${systemDescriptionMarkdown(project)}\n\n## Architecture\n\n\`\`\`mermaid\n${mermaid(project)}\n\`\`\`\n\n${resourceMarkdown(project)}\n\n## Options and tradeoffs\n\n${a ? `Scores are entered judgements (1–5), not provider benchmarks or prices. Unscored options remain open.\n\n| Option | ${CRITERIA.map((c) => c.label).join(" | ")} | Weighted score | Rationale |\n|---|${CRITERIA.map(() => "---|").join("")}---|---|\n${OPTIONS.map((o) => `| ${OPTION_NAMES[o]} | ${CRITERIA.map((c) => a.scores?.[o]?.[c.id] ?? "—").join(" | ")} | ${optionScore(a, o) ?? "—"} | ${text(a.notes?.[o])} |`).join("\n")}` : "Use Design → Options to compare cloud choices and record the rationale before choosing."}\n\n## Decisions and change history\n\n${adrMarkdown(project.decisions)}\n\n## Assumptions\n\n${list((project.assumptions || []).map((a) => `[${a.id}] ${a.statement} (${a.madeAt})`))}\n\n## Questions to resolve\n\n${list((project.openQuestions || []).filter((q) => q.status === "open").map((q) => `[${q.id}] ${q.question}${q.owner ? ` — ${q.owner}` : ""}`))}\n`;
+}
+
+export function deliveryPack(project, run, environment = "staging", now = new Date()) {
+  // Credential refusal runs before producing any files, including the plain-language outputs.
+  const file = toProjectFile(project, now);
+  const cloud = estimate(project, now), consulting = consultingEstimate(project), resources = resourcePlan(project);
+  const findings = review(project);
+  const snapshotId = crypto.randomUUID();
+  const stamp = `Snapshot ${snapshotId} · design r${project.revision} · generated ${now.toISOString()}`;
+  const outstanding = [
+    ...blockers(findings).map((f) => `Architecture: ${f.statement}`), ...cloud.gaps,
+    ...resources.gaps,
+    ...consulting.lines.filter((l) => !l.complete).map((l) => `${l.label}: effort, rate, ordered day range and basis needed.`),
+    ...(project.openQuestions || []).filter((q) => q.status === "open").map((q) => q.question),
+  ];
+  const files = {
+    ...specKit(project,{snapshotId,stamp,now,environment:environment === "production" ? "production" : "staging"}),
+    "project.atmem-ai-architect.json": json(file),
+    "architecture-work.json": json(architectureWork(project)),
+    "architecture-artifact-mappings.json": json(artifactWorkProjection(project)),
+    "specification.md": `${stamp}\n\n${solutionSpecification(project)}\n\n## Implementation specification and coding-agent handoff\n\nThe Spec Kit translates these requirements and the architecture into implementation work. Start with START_HERE.md and AGENTS.md; read spec-kit/implementation-spec.md (or PDF) for the implementation plan, contracts, detailed tasks and validation plan. Requirements remain the source of desired outcomes; the kit is the build plan derived from them.\n`,
+    "architecture-and-deployment.md": `${stamp}\n\n${deploymentDocument(project, run, now)}`,
+    "diagram.mmd": mermaid(project),
+    "decisions.md": `${stamp}\n\n${adrMarkdown(project.decisions)}`,
+    "resource-schedule.json": json(resources),
+    "estimate.json": json({ snapshotId, revision: project.revision, generatedAt: now.toISOString(), disclaimer: DISCLAIMER, cloud, consulting }),
+    "handoff.md": `# Delivery handoff\n\n${stamp}\n\nThis is a reviewable design handoff, not deployment evidence.\n\n## Readiness\n\nRead spec-kit/readiness.md for prioritised decisions, task links and separate evidence stages. Schema checks cannot establish application deployment readiness.\n\n## Work remaining\n\n${list(outstanding)}\n\n## Before deployment\n\n- Confirm provider, region, data residency, account owner and environment.\n- Complete the resource implementations, application code, IAM and data-flow integrations.\n- Validate the estimate against every billable dimension and a current provider quote.\n- Review least-privilege access, quotas, secrets handling and Terraform state storage.\n- Run and review the infrastructure plan in the intended account.\n- Agree acceptance tests, rollback and an explicit deployment approval.\n- Capture results and handover ownership. No cloud operation has been performed by this export.\n`,
+    ...Object.fromEntries(Object.entries(terraformSketch(project, environment)).map(([name, content]) => [`terraform/${name}`, content])),
+    "README.md": `# ${project.name} — delivery pack\n\n${stamp}\n\nFor a coding-agent handoff, start with START_HERE.md and AGENTS.md, then spec-kit/implementation-spec.md or PDF. The kit includes detailed task dependencies, acceptance criteria, contracts and a progress journal.\n\nOpen specification.md for scope, requirements, options and decisions; architecture-and-deployment.md for the diagram, review, costs and steps. estimate.json separates monthly cloud cost and one-off consulting/build cost. resource-schedule.json links resources to diagram IDs. terraform/ contains provider-specific generated artifacts where supported; generation-quality.json records component coverage, missing implementations, selected skill digests and validation boundaries.\n\nReopen project.atmem-ai-architect.json in AtMem AI Architect to change requirements, assumptions, decisions, prices or the diagram, then regenerate this pack. All files come from the same snapshot; do not maintain edited copies as the source of truth. Design revision tracks board changes; snapshot ID and generation time identify exports including changes to costs and requirements.\n\nCloud prices and professional-service rates are only those entered in the project. A ROM or detailed worksheet is not a fixed-price quote. No cloud access, deployment or successful infrastructure validation is implied.\n`,
+  };
+  const terraformFiles=Object.fromEntries(Object.entries(files).filter(([name])=>name.startsWith('terraform/')).map(([name,content])=>[name.slice(10),content]));
+  files['generation-quality.json']=json(generationQuality(project,resources,terraformFiles));
+  files["manifest.json"] = json({ format: "atmem.ai-architect.delivery", version: "1.0.0", snapshotId, projectId: file.meta.id, designRevision: project.revision, generatedAt: now.toISOString(), environment: environment === "production" ? "production" : "staging", estimateStage: cloud.maturity, deploymentExecuted: false, handoffStatus: 'engineering_required', readinessFile: 'spec-kit/readiness.json', files: [...Object.keys(files), "manifest.json"] });
+  return files;
+}

package/src/deployment-ownership.mjs

@@ -0,0 +1,10 @@
+// Existing application source and an existing cloud deployment are separate facts.
+export const existingDeployment=node=>{validateDeploymentOwnership(node.data);return ['existing','imported Pulumi state'].includes(node.data.origin)&&node.data.deploymentMode!=='create';};
+export function validateDeploymentOwnership(data){
+ if(data.config?.containerMemoryBytes!=null&&data.implementation!=='container-service')throw Error('Exact container memory requires an explicit container-service contract; no other implementation was changed.');
+ if(data.deploymentMode==='reference'&&!['existing','imported Pulumi state'].includes(data.origin))throw Error('Reference handling must preserve an existing system; it cannot provision a proposed replacement.');
+ if(data.binding&&(!['existing','imported Pulumi state'].includes(data.origin)||data.deploymentMode==='create'))throw Error('Reference bindings identify existing systems and cannot provision a replacement. Preserve existing ownership or correct the binding.');
+ if(data.deploymentMode!=null&&!['reference','create'].includes(data.deploymentMode))throw Error('Choose reference or create for deployment ownership.');
+ if(data.origin==='imported Pulumi state'&&data.deploymentMode==='create')throw Error('Imported cloud-state metadata identifies an existing deployment, not application source. Preserve its reference ownership; create a separate proposed deployment for new resources.');
+ if(data.origin==='existing'&&data.deploymentMode==='create'&&(data.implementation!=='container-service'||data.binding))throw Error('Deploying existing application source requires an explicit container-service contract without an external reference binding.');
+}

package/src/deployment-region.mjs

@@ -0,0 +1,11 @@
+// Supported identifier shapes, not a region/service-availability catalogue.
+// AWS supplied-image lowering supports commercial, China and GovCloud identifier
+// families. Other partitions remain explicit implementation work, not a fallback.
+export const PROVIDER_REGION_PATTERNS={aws:'^([a-z]{2}-[a-z]+|us-gov-[a-z]+)-[0-9]{1,2}$',azure:'^[a-z][a-z0-9]{1,39}$',gcp:'^[a-z]+-[a-z]+[0-9]{1,2}$',ibm:'^[a-z]{2}-[a-z]+$'};
+export const validProviderRegion=(provider,value)=>typeof value==='string'&&Object.hasOwn(PROVIDER_REGION_PATTERNS,provider)&&new RegExp(PROVIDER_REGION_PATTERNS[provider]).test(value);
+export function declaredRegion(node){
+ const value=node.data.config?.region;
+ if(value==null||value===''||value==='To be selected')return {region:null,gaps:[]};
+ if(validProviderRegion(node.data.provider,value))return {region:value,gaps:[]};
+ return {region:null,gaps:[{key:'region',value,reason:'is preserved but not a supported deployment-region identifier for this provider contract; implement its placement/partition requirements without choosing another destination'}]};
+}

package/src/derive.mjs

@@ -0,0 +1,31 @@
+import {prefillAcceptedSettings} from './engineering-defaults.mjs';
+// Small, grounded working requirements. Unknown targets become conversation topics,
+// not invented company policies or a large list of fields for the user to complete.
+import { roleOf } from './review.mjs';
+import { cleanRequirement } from './records.mjs';
+export function deriveRequirements(project) {
+  const nodes=project.nodes.filter(n=>n.data.kind!=='note');
+  if(!nodes.length)return [];
+  const out=[];
+  const group=(roles)=>nodes.filter(n=>roles.includes(roleOf(n))).map(n=>n.id);
+  const add=(id,category,statement,links)=>{if(links.length)out.push(cleanRequirement({id:`drv-${id}`,source:'agent',kind:'nonfunctional',category,priority:'should',status:'open',statement,links}));};
+  add('data-access','security','Agree who can access the data and which content each person is allowed to use.',group(['data','index','llm']));
+  add('data-location','compliance','Confirm where source data, model requests and logs may be processed and stored.',group(['data','index','llm']));
+
+  return out.map(r=>({...r,rationale:r.id==='drv-data-access' ? 'The design uses information that people may have different rights to access. Clarifying this early helps prevent inappropriate disclosure.' : 'The design processes and stores information. We need to establish any location constraints before choosing services and regions.',basis:'Inferred from the data and AI components on the board; this is a question to validate, not an established company policy.'}));
+}
+export function withDerived(project){
+ project=prefillAcceptedSettings(project);
+ const mine=(project.needs||[]).filter(r=>!(r.source==='agent'&&r.id.startsWith('drv-')));
+ const excluded=new Set([...(project.extensions?.dismissedRequirements||[]),...mine.map(r=>r.id)]);
+ const needs=[...mine,...(mine.some(r=>r.id.startsWith("ai-")) ? [] : deriveRequirements(project)).filter(r=>!excluded.has(r.id))].slice(0,300);
+ const numbers={...(project.extensions?.requirementNumbers || {})};
+ let next=Math.max(0,...Object.values(numbers).filter(n=>Number.isSafeInteger(n)&&n>0))+1;
+ for(const r of needs)if(!Number.isSafeInteger(numbers[r.id]) || numbers[r.id]<1)numbers[r.id]=next++;
+ return {...project,needs,extensions:{...project.extensions,requirementNumbers:numbers}};
+}
+
+export function requirementNumber(project,id) {
+ const value=project.extensions?.requirementNumbers?.[id];
+ return Number.isSafeInteger(value)&&value>0 ? `REQ-${String(value).padStart(3,'0')}` : 'Requirement';
+}

package/src/design-build-flow.mjs

@@ -0,0 +1,10 @@
+// Architecture is the entry point. Implementation is an explicit outcome action.
+export const BUILD_AND_TEST_REQUEST='Implement the current saved design and run its local checks. Preserve every requirement, existing system, provider, placement and ownership boundary. Include a coherent Spec Kit with requirements, a plan, dependent tasks and acceptance evidence, plus implementation, infrastructure and receiving run instructions. Generate the application and its connections, run the applicable block and full-system tests, and retain artifact-bound evidence. Clarify only material unresolved choices; never substitute a smaller demonstration or report an unexecuted check as passed. No cloud deployment or account access.';
+export const BUILD_DESIGN_REQUEST=BUILD_AND_TEST_REQUEST;
+export function hasArchitectureDesign(project){
+ return !!(project?.nodes?.some(n=>n.data?.kind!=='note')||project?.extensions?.architectureWork?.records?.some(r=>['responsibility','delivery-unit','interface'].includes(r.kind)));
+}
+export function buildIntent(project,draft){
+ if(typeof draft==='string'&&draft.trim())return draft;
+ return hasArchitectureDesign(project)?BUILD_DESIGN_REQUEST:'';
+}

package/src/diagram-attention.mjs

@@ -0,0 +1,24 @@
+// Presentation-only IDs: never write attention state into the project or its history.
+export function diagramAttention(before, after) {
+  const nodes = new Set(), edges = new Set();
+  const oldNodes = new Map(before.nodes.map(n => [n.id, n]));
+  const newNodes = new Set(after.nodes.map(n => n.id));
+  const oldEdges = new Map(before.edges.map(e => [e.id, e]));
+  const newEdges = new Set(after.edges.map(e => e.id));
+  for (const n of after.nodes) {
+    const old = oldNodes.get(n.id);
+    if (!old || JSON.stringify([old.data, old.position, old.type]) !== JSON.stringify([n.data, n.position, n.type])) nodes.add(n.id);
+  }
+  for (const e of after.edges) {
+    if (JSON.stringify(oldEdges.get(e.id)) !== JSON.stringify(e)) {
+      edges.add(e.id); nodes.add(e.source); nodes.add(e.target);
+    }
+  }
+  for (const e of before.edges) {
+    if (!newEdges.has(e.id) || !newNodes.has(e.source) || !newNodes.has(e.target)) {
+      if (newNodes.has(e.source)) nodes.add(e.source);
+      if (newNodes.has(e.target)) nodes.add(e.target);
+    }
+  }
+  return { nodes: [...nodes].filter(id => newNodes.has(id)), edges: [...edges] };
+}