@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/enterprise-aws-infrastructure-tests.mjs

@@ -0,0 +1,38 @@
+export function awsDocumentInfrastructureTests(n,seed,region){
+ const name=`format("doc-%s",substr(sha256(${JSON.stringify(seed)}),0,12))`,host=`format("doc-host-%s",substr(sha256(${JSON.stringify(seed)}),0,12))`;
+ const block=(kind,target,values)=>`${kind} {\n ${kind==='override_resource'?'override_during = plan\n ':''}target = ${target}\n values = ${values}\n}\n`;
+ const run=(name,body)=>`run "${name}" {\n command = plan\n ${body}\n}\n`,assert=(condition,message)=>`assert {\n condition = ${condition}\n error_message = ${JSON.stringify(message)}\n}`;
+ let text='mock_provider "aws" {}\n';
+ for(const target of [`data.aws_iam_role.${n}_worker`,`module.host_verification.data.aws_iam_role.${n}_worker`])text+=block('override_data',target,'{arn="arn:aws:iam::123456789012:role/question-worker",name="question-worker"}');
+ text+=block('override_data',`data.aws_ssm_parameter.${n}_recommended_ami`,'{value="ami-0123456789abcdef0"}');
+ text+=block('override_data',`data.aws_ami.${n}_host`,'{id="ami-0123456789abcdef0",root_device_name="/dev/xvda"}');
+ text+=block('override_resource',`aws_ecs_cluster.${n}`,`{arn=format("arn:aws:ecs:${region}:123456789012:cluster/%s",${name})}`);
+ const bucket=`format("atmem-doc-%s",substr(sha256(format("%s:%s","123456789012",${name})),0,20))`;
+ text+=block('override_resource',`aws_s3_bucket.${n}`,`{id=${bucket},arn=format("arn:aws:s3:::%s",${bucket})}`);
+ for(const purpose of ['parser','transfer'])text+=block('override_resource',`aws_ecr_repository.${n}_${purpose}`,`{arn=format("arn:aws:ecr:${region}:123456789012:repository/%s/${purpose}",${name}),repository_url=format("123456789012.dkr.ecr.${region}.amazonaws.com/%s/${purpose}",${name})}`);
+ for(const purpose of ['host','execution','transfer'])text+=block('override_resource',`aws_iam_role.${n}_${purpose}`,`{arn=format("arn:aws:iam::123456789012:role/%s-${purpose}",${name})}`);
+ text+=block('override_resource',`aws_ecs_task_definition.${n}`,`{arn=format("arn:aws:ecs:${region}:123456789012:task-definition/document-%s-parser:1",${name}),revision=1}`);
+ text+=block('override_resource',`aws_iam_instance_profile.${n}`,`{arn=format("arn:aws:iam::123456789012:instance-profile/%s-host",${name})}`);
+ text+=block('override_resource',`aws_vpc.${n}`,'{id="vpc-aaaaaaaaaaaaaaaaa"}');
+ for(const [suffix,id]of [['_host','bbbbbbbbbbbbbbbbb'],['_endpoint','ccccccccccccccccc']])text+=block('override_resource',`aws_security_group.${n}${suffix}`,`{id="sg-${id}"}`);
+ for(let i=0;i<2;i++){
+  text+=block('override_resource',`aws_subnet.${n}_${i}`,`{id="subnet-${String(i+1).repeat(17)}"}`);
+  text+=block('override_resource',`aws_route_table.${n}_${i}`,`{id="rtb-${String(i+3).repeat(17)}"}`);
+ }
+ for(const [index,service]of ['ecs','ecs_agent','ecs_telemetry','ecr_api','ecr_dkr','ssm','ssmmessages','s3'].entries())text+=block('override_resource',`aws_vpc_endpoint.${n}_${service}`,`{id="vpce-${String(index+1).repeat(17)}"${service==='s3'?',prefix_list_id="pl-aaaaaaaaaaaaaaaaa"':''}}`);
+ text+=block('override_resource',`aws_launch_template.${n}`,'{id="lt-aaaaaaaaaaaaaaaaa",latest_version=1}');
+ text+=block('override_resource',`module.host_verification.aws_ssm_document.${n}`,`{arn=format("arn:aws:ssm:${region}:123456789012:document/%s",${host}),hash="${'f'.repeat(64)}",hash_type="Sha256",latest_version=1}`);
+ text+=`variables {\n review_approved=true\n account_id="123456789012"\n worker_role_arn="arn:aws:iam::123456789012:role/question-worker"\n availability_zones=["${region}a","${region}b"]\n}\n`;
+ const ready=`variables {\n images_ready=true\n hosts_enabled=true\n host_ami_id="ami-0123456789abcdef0"\n parser_revision="${'c'.repeat(64)}"\n parser_image=format("123456789012.dkr.ecr.${region}.amazonaws.com/%s/parser@sha256:${'a'.repeat(64)}",${name})\n transfer_image=format("123456789012.dkr.ecr.${region}.amazonaws.com/%s/transfer@sha256:${'b'.repeat(64)}",${name})\n}\n`;
+ text+=run('foundation_has_no_ready_runtime',assert(`output.document_job_configuration == null && length(aws_ecs_task_definition.${n}) == 0 && length(aws_launch_template.${n}) == 0 && length(aws_autoscaling_group.${n}) == 0`,'No synthetic task, AMI or ready worker during foundation.'));
+ text+=run('private_document_substrate',ready+assert(`output.document_executor_configuration.provider == "aws" && output.document_executor_configuration.parserRevision == var.parser_revision && output.document_executor_configuration.configuration == output.document_job_configuration && output.document_job_configuration.format == "enterprise-aws-document-job-v2" && output.document_job_configuration.taskDefinitionArn == aws_ecs_task_definition.${n}[0].arn && output.document_job_configuration.workerRoleArn == var.worker_role_arn`,'Bind the exact static revision and existing worker.')+'\n'+assert(`aws_ecs_task_definition.${n}[0].network_mode == "bridge" && jsondecode(aws_ecs_task_definition.${n}[0].container_definitions)[1].disableNetworking && length(jsondecode(aws_ecs_task_definition.${n}[0].container_definitions)) == 3`,'Keep isolated parser and sequential transfer stages.'));
+ text+=run('private_host_bootstrap',ready+assert(`aws_launch_template.${n}[0].metadata_options[0].http_tokens == "required" && aws_launch_template.${n}[0].metadata_options[0].http_put_response_hop_limit == 1 && !one(aws_launch_template.${n}[0].network_interfaces).associate_public_ip_address && one(aws_launch_template.${n}[0].block_device_mappings).ebs[0].encrypted`,'Private host identity and encrypted disposable root volume.')+'\n'+assert(`aws_autoscaling_group.${n}[0].desired_capacity == var.host_count && aws_autoscaling_group.${n}[0].max_size == var.host_count`,'Standing bounded pool; do not claim automatic scaling.'));
+ text+=run('storage_has_no_history',assert(`aws_s3_bucket_versioning.${n}.versioning_configuration[0].status == "Disabled" && aws_s3_bucket_public_access_block.${n}.block_public_policy && !aws_s3_bucket.${n}.force_destroy`,'No retained history/public access or destructive populated-store deletion.'));
+ text+=run('review_required',`variables {review_approved=false}\n expect_failures=[terraform_data.${n}_review]`);
+ text+=run('worker_path_cannot_redirect',`variables {worker_role_arn="arn:aws:iam::123456789012:role/wrong/question-worker"}\n expect_failures=[terraform_data.${n}_review]`);
+ text+=run('region_drift_rejected',`variables {region="us-east-1"}\n expect_failures=[var.region]`);
+ text+=run('same_zone_rejected',`variables {availability_zones=["${region}a","${region}a"]}\n expect_failures=[var.availability_zones]`);
+ text+=run('missing_ami_rejected',`variables {hosts_enabled=true}\n expect_failures=[var.host_ami_id]`);
+ text+=run('missing_image_revision_rejected',`variables {images_ready=true}\n expect_failures=[var.parser_image,var.transfer_image,var.parser_revision]`);
+ return text;
+}

package/src/enterprise-aws-infrastructure.mjs

@@ -0,0 +1,138 @@
+import {awsHostVerificationTerraform}from'./enterprise-aws-host-infrastructure.mjs';
+import template from'./runtime/enterprise-aws-task-template.json'with{type:'json'};
+import probe from'./runtime/enterprise-aws-host-probe-source.json'with{type:'json'};
+import bootstrap from'./runtime/enterprise-aws-host-bootstrap-source.json'with{type:'json'};
+import {awsDocumentInfrastructureTests}from'./enterprise-aws-infrastructure-tests.mjs';
+import {enterpriseApplicationFiles}from'./enterprise-application.mjs';
+
+// Parser execution substrate. Full private API/worker/SQL/source/model composition
+// and destination qualification remain separate mandatory work, not implied here.
+export function awsDocumentJobTerraform(project,row,environment='staging'){
+ const host=awsHostVerificationTerraform(project,row,environment),child=JSON.parse(host['main.tf.json']);
+ delete child.provider; // Inherit the root provider, including native test mocks.
+ const regionInput=structuredClone(child.variable.region);
+ const files={'modules/host-verification/main.tf.json':JSON.stringify(child,null,2)+'\n'};
+ const n=row.address,v=key=>'${var.'+key+'}',r=(type,suffix,field)=>'${'+type+'.'+n+suffix+'.'+field+'}',l=key=>'${local.'+key+'}';
+ const literal=value=>value.replace(/\$\{/g,()=>'$${').replace(/%\{/g,()=>'%%{');
+ const seed='https://atmem.ai/workspaces/'+encodeURIComponent(project.id)+'/'+n+'/'+environment;
+ const variable={account_id:child.variable.account_id,region:regionInput,worker_role_arn:child.variable.worker_role_arn,
+  review_approved:{type:'bool',default:false,nullable:false,description:'Review destination, ownership, endpoint/host costs, data retention and operating responsibilities before apply.'},
+  images_ready:{type:'bool',default:false,nullable:false,description:'Create the task revision only after both real immutable owned artifacts pass their checks.'},
+  hosts_enabled:{type:'bool',default:false,nullable:false,description:'Launch new dedicated instances only after the actual AMI and bootstrap have been reviewed.'},
+  host_count:{type:'number',default:2,nullable:false,description:'Standing capacity proposal, not autoscaling or a throughput guarantee. Review costs and load evidence.',validation:{condition:'${var.host_count == floor(var.host_count) && var.host_count >= 1 && var.host_count <= 4}',error_message:'Use one to four reviewed dedicated hosts.'}},
+  availability_zones:{type:'list(string)',nullable:false,description:'Two distinct destination availability zones in the selected region.',validation:{condition:'${length(var.availability_zones) == 2 && length(distinct(var.availability_zones)) == 2 && alltrue([for zone in var.availability_zones : can(regex("^'+row.region+'[a-z]$",zone))])}',error_message:'Supply two distinct availability zones in the selected region.'}},
+  host_ami_id:{type:'string',default:'',nullable:false,description:'Pin the reviewed actual Amazon ECS-optimized AL2023 x86_64 AMI. Recommended metadata is discovery, not approval.',validation:{condition:'${!var.hosts_enabled || can(regex("^ami-[0-9a-f]{17}$",var.host_ami_id))}',error_message:'Pin the actual reviewed AMI before launching hosts.'}},
+  parser_revision:{type:'string',default:'',nullable:false,description:'Actual independently qualified parser artifact revision.',validation:{condition:'${!var.images_ready || can(regex("^[0-9a-f]{64}$",var.parser_revision))}',error_message:'Supply the actual qualified parser revision.'}}};
+ const examples={review_approved:false,images_ready:false,hosts_enabled:false,account_id:'123456789012',region:row.region,worker_role_arn:'arn:aws:iam::123456789012:role/question-worker',availability_zones:[row.region+'a',row.region+'b'],host_ami_id:'',host_count:2,parser_revision:''};
+ for(const purpose of ['parser','transfer']){
+  variable[purpose+'_image']={type:'string',default:'',nullable:false,description:'Actual owned regional ECR '+purpose+' image pinned by SHA256.',validation:{condition:'${!var.images_ready || can(regex("^[a-z0-9./_-]+@sha256:[0-9a-f]{64}$",var.'+purpose+'_image))}',error_message:'Use the actual immutable '+purpose+' image.'}};
+  examples[purpose+'_image']='';
+ }
+ const locals={name:'${format("doc-%s",substr(sha256('+JSON.stringify(seed)+'),0,12))}',
+  cluster_arn:r('aws_ecs_cluster','','arn'),host_policy:'${module.host_verification.host_verification.hostPolicySha256}',
+  expected:{format:'enterprise-aws-host-policy-v1',clusterArn:l('cluster_arn'),policySha256:l('host_policy')}};
+ const resource={},data={aws_iam_role:{[n+'_worker']:{name:'${basename(var.worker_role_arn)}'}},
+  aws_ssm_parameter:{[n+'_recommended_ami']:{name:'/aws/service/ecs/optimized-ami/amazon-linux-2023/recommended/image_id',with_decryption:false}},
+  aws_ami:{[n+'_host']:{count:'${var.hosts_enabled ? 1 : 0}',owners:['amazon'],filter:[{name:'image-id',values:[v('host_ami_id')]},{name:'architecture',values:['x86_64']},{name:'virtualization-type',values:['hvm']},{name:'root-device-type',values:['ebs']},{name:'name',values:['al2023-ami-ecs-hvm-2023.*-x86_64']} ]}}};
+ const checks=[{condition:v('review_approved'),error_message:'Review this concrete component plan, destination and costs before apply.'},
+  {condition:'${startswith(var.worker_role_arn,format("arn:aws:iam::%s:role/",var.account_id)) && data.aws_iam_role.'+n+'_worker.arn == var.worker_role_arn}',error_message:'The existing worker must match the full same-account ARN, including its path.'}];
+ for(const purpose of ['parser','transfer'])checks.push({condition:'${!var.images_ready || startswith(var.'+purpose+'_image,format("%s.dkr.ecr.%s.amazonaws.com/%s/'+purpose+'@sha256:",var.account_id,var.region,local.name))}',error_message:'Keep '+purpose+' in its owned regional repository.'});
+ resource.terraform_data={[n+'_review']:{input:{source_component:literal(row.id),design_revision:project.revision,environment,requested_worker_arn:v('worker_role_arn'),resolved_worker_arn:'${data.aws_iam_role.'+n+'_worker.arn}'},lifecycle:{precondition:checks}}};
+ const add=(type,suffix,body)=>((resource[type]??={})[n+suffix]={...body,depends_on:['terraform_data.'+n+'_review',...(body.depends_on||[])]});
+ add('aws_ecs_cluster','',{name:l('name'),setting:[{name:'containerInsights',value:'disabled'}],configuration:{execute_command_configuration:{logging:'NONE'}}});
+ const module={host_verification:{source:'./modules/host-verification',providers:{aws:'aws'},account_id:v('account_id'),region:v('region'),review_approved:v('review_approved'),cluster_arn:l('cluster_arn'),worker_role_arn:v('worker_role_arn')}};
+ add('aws_vpc','',{cidr_block:'10.88.0.0/16',enable_dns_support:true,enable_dns_hostnames:true,tags:{Name:l('name')},lifecycle:{prevent_destroy:true}});
+ for(let i=0;i<2;i++){
+  add('aws_subnet','_'+i,{vpc_id:r('aws_vpc','','id'),cidr_block:'10.88.'+i+'.0/24',availability_zone:'${var.availability_zones['+i+']}',map_public_ip_on_launch:false});
+  add('aws_route_table','_'+i,{vpc_id:r('aws_vpc','','id')});
+  add('aws_route_table_association','_'+i,{subnet_id:r('aws_subnet','_'+i,'id'),route_table_id:r('aws_route_table','_'+i,'id')});
+ }
+ for(const suffix of ['_host','_endpoint'])add('aws_security_group',suffix,{name:l('name')+suffix.replace('_','-'),description:'Private document '+suffix.slice(1)+' boundary; rules managed separately',vpc_id:r('aws_vpc','','id')});
+ add('aws_vpc_security_group_ingress_rule','_endpoint',{security_group_id:r('aws_security_group','_endpoint','id'),referenced_security_group_id:r('aws_security_group','_host','id'),ip_protocol:'tcp',from_port:443,to_port:443});
+ add('aws_vpc_security_group_egress_rule','_api',{security_group_id:r('aws_security_group','_host','id'),referenced_security_group_id:r('aws_security_group','_endpoint','id'),ip_protocol:'tcp',from_port:443,to_port:443});
+ const subnets=[r('aws_subnet','_0','id'),r('aws_subnet','_1','id')];
+ // Modern SSM Agent uses ssmmessages; obsolete ec2messages is unavailable in
+ // newer regions. No public endpoint fallback exists in this isolated VPC.
+ for(const service of ['ecs','ecs-agent','ecs-telemetry','ecr.api','ecr.dkr','ssm','ssmmessages'])add('aws_vpc_endpoint','_'+service.replace(/[.-]/g,'_'),{vpc_id:r('aws_vpc','','id'),service_name:'${format("com.amazonaws.%s.'+service+'",var.region)}',vpc_endpoint_type:'Interface',private_dns_enabled:true,subnet_ids:subnets,security_group_ids:[r('aws_security_group','_endpoint','id')]});
+ add('aws_vpc_endpoint','_s3',{vpc_id:r('aws_vpc','','id'),service_name:'${format("com.amazonaws.%s.s3",var.region)}',vpc_endpoint_type:'Gateway',route_table_ids:[r('aws_route_table','_0','id'),r('aws_route_table','_1','id')],
+  policy:'${jsonencode({Version="2012-10-17",Statement=[{Effect="Allow",Principal="*",Action=["s3:GetObject","s3:PutObject","s3:GetBucketLocation","s3:GetBucketVersioning"],Resource=[aws_s3_bucket.'+n+'.arn,format("%s/document-jobs/*",aws_s3_bucket.'+n+'.arn),format("arn:aws:s3:::prod-%s-starport-layer-bucket/*",var.region)]}]})}'});
+ add('aws_vpc_security_group_egress_rule','_s3',{security_group_id:r('aws_security_group','_host','id'),prefix_list_id:r('aws_vpc_endpoint','_s3','prefix_list_id'),ip_protocol:'tcp',from_port:443,to_port:443});
+ add('aws_s3_bucket','',{bucket:'${format("atmem-doc-%s",substr(sha256(format("%s:%s",var.account_id,local.name)),0,20))}',force_destroy:false,lifecycle:{prevent_destroy:true}});
+ add('aws_s3_bucket_public_access_block','',{bucket:r('aws_s3_bucket','','id'),block_public_acls:true,block_public_policy:true,ignore_public_acls:true,restrict_public_buckets:true});
+ add('aws_s3_bucket_ownership_controls','',{bucket:r('aws_s3_bucket','','id'),rule:{object_ownership:'BucketOwnerEnforced'}});
+ add('aws_s3_bucket_server_side_encryption_configuration','',{bucket:r('aws_s3_bucket','','id'),rule:{apply_server_side_encryption_by_default:{sse_algorithm:'AES256'}}});
+ // A new bucket has no history; never suspend/adopt an existing versioned bucket.
+ add('aws_s3_bucket_versioning','',{bucket:r('aws_s3_bucket','','id'),versioning_configuration:{status:'Disabled'}});
+ add('aws_s3_bucket_lifecycle_configuration','',{bucket:r('aws_s3_bucket','','id'),rule:[{id:'orphan-fallback',status:'Enabled',filter:{prefix:'document-jobs/'},expiration:{days:1},abort_incomplete_multipart_upload:{days_after_initiation:1}}]});
+ const bucket=r('aws_s3_bucket','','arn'),objects='${format("%s/document-jobs/*",aws_s3_bucket.'+n+'.arn)}';
+ locals.bucket_policy={Version:'2012-10-17',Statement:[
+  {Sid:'RequireTLS',Effect:'Deny',Principal:'*',Action:'s3:*',Resource:[bucket,'${format("%s/*",aws_s3_bucket.'+n+'.arn)}'],Condition:{Bool:{'aws:SecureTransport':'false'}}},
+  {Sid:'RequireExplicitEncryption',Effect:'Deny',Principal:'*',Action:'s3:PutObject',Resource:objects,Condition:{StringNotEquals:{'s3:x-amz-server-side-encryption':'AES256'}}},
+  {Sid:'RequireCreateOnly',Effect:'Deny',Principal:'*',Action:'s3:PutObject',Resource:objects,Condition:{StringNotEquals:{'s3:if-none-match':'*'}}}]};
+ add('aws_s3_bucket_policy','',{bucket:r('aws_s3_bucket','','id'),policy:'${jsonencode(local.bucket_policy)}',depends_on:['aws_s3_bucket_public_access_block.'+n]});
+ for(const purpose of ['parser','transfer'])add('aws_ecr_repository','_'+purpose,{name:l('name')+'/'+purpose,image_tag_mutability:'IMMUTABLE',force_delete:false,encryption_configuration:{encryption_type:'AES256'},image_scanning_configuration:{scan_on_push:true},lifecycle:{prevent_destroy:true}});
+ locals.task_trust={Version:'2012-10-17',Statement:[{Effect:'Allow',Principal:{Service:'ecs-tasks.amazonaws.com'},Action:'sts:AssumeRole',Condition:{StringEquals:{'aws:SourceAccount':v('account_id')},ArnLike:{'aws:SourceArn':'${format("arn:aws:ecs:%s:%s:*",var.region,var.account_id)}'}}}]};
+ const trust=service=>service==='ecs-tasks.amazonaws.com'?'${jsonencode(local.task_trust)}':JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Principal:{Service:service},Action:'sts:AssumeRole'}]});
+ for(const purpose of ['host','execution','transfer'])add('aws_iam_role','_'+purpose,{name:l('name')+'-'+purpose,assume_role_policy:trust(purpose==='host'?'ec2.amazonaws.com':'ecs-tasks.amazonaws.com')});
+ const policy=suffix=>add('aws_iam_role_policy',suffix,{name:l('name')+suffix.replace('_','-'),role:r('aws_iam_role',suffix,'name'),policy:'${jsonencode(local.'+suffix.slice(1)+'_policy)}'}),allow=(Sid,Action,Resource,Condition)=>({Sid,Effect:'Allow',Action,Resource,...(Condition?{Condition}:{} )});
+ locals.transfer_policy={Version:'2012-10-17',Statement:[allow('TemporaryBytesOnly',['s3:GetObject','s3:PutObject'],objects),allow('CheckOwnedStore',['s3:GetBucketLocation','s3:GetBucketVersioning'],bucket)]};policy('_transfer');
+ locals.execution_policy={Version:'2012-10-17',Statement:[allow('EcrLogin',['ecr:GetAuthorizationToken'],'*'),allow('OwnedImagesOnly',['ecr:BatchGetImage','ecr:GetDownloadUrlForLayer','ecr:BatchCheckLayerAvailability'],[r('aws_ecr_repository','_parser','arn'),r('aws_ecr_repository','_transfer','arn')])]};policy('_execution');
+ const ci='${format("arn:aws:ecs:%s:%s:container-instance/%s/*",var.region,var.account_id,local.name)}',tasks='${format("arn:aws:ecs:%s:%s:task/%s/*",var.region,var.account_id,local.name)}';
+ locals.host_policy_document={Version:'2012-10-17',Statement:[allow('RegisterInOwnedCluster',['ecs:RegisterContainerInstance','ecs:DeregisterContainerInstance','ecs:SubmitAttachmentStateChanges','ecs:SubmitContainerStateChange','ecs:SubmitTaskStateChange'],l('cluster_arn')),
+  allow('OwnedAgentLifecycle',['ecs:Poll','ecs:StartTelemetrySession','ecs:UpdateContainerInstancesState'],ci,{ArnEquals:{'ecs:cluster':l('cluster_arn')}}),
+  allow('DiscoverAgentEndpoint',['ecs:DiscoverPollEndpoint'],'*'),allow('OwnedAgentTags',['ecs:ListTagsForResource'],[ci,tasks]),
+  allow('AgentRegistrationTags',['ecs:TagResource'],ci,{StringEquals:{'ecs:CreateAction':'RegisterContainerInstance'}}),
+  allow('SsmTransport',['ssm:UpdateInstanceInformation','ssmmessages:CreateControlChannel','ssmmessages:CreateDataChannel','ssmmessages:OpenControlChannel','ssmmessages:OpenDataChannel'],'*'),
+  allow('FixedSsmDocument',['ssm:GetDocument','ssm:DescribeDocument'],'${module.host_verification.host_verification.hostDocumentArn}')]};
+ add('aws_iam_role_policy','_host',{name:l('name')+'-host',role:r('aws_iam_role','_host','name'),policy:'${jsonencode(local.host_policy_document)}'});
+ add('aws_iam_instance_profile','',{name:l('name')+'-host',role:r('aws_iam_role','_host','name')});
+ // Resolve only owned static placeholders; no request or client source is evaluated.
+ const replacements={'__FAMILY__':l('name')+'-parser','__POLICY_SHA256__':l('host_policy'),'__TRANSFER_ROLE_ARN__':r('aws_iam_role','_transfer','arn'),'__EXECUTION_ROLE_ARN__':r('aws_iam_role','_execution','arn'),'__PARSER_IMAGE__':v('parser_image'),'__TRANSFER_IMAGE__':v('transfer_image')};
+ function resolve(value){if(Array.isArray(value))return value.map(resolve);if(value&&typeof value==='object')return Object.fromEntries(Object.entries(value).map(([key,item])=>[key,resolve(item)]));if(typeof value==='string')for(const[key,item]of Object.entries(replacements))value=value.replaceAll(key,item);return value;}
+ locals.task_definition=resolve(template);
+ // Runtime family is deliberately prefixed document-, independent of display names.
+ locals.task_definition.family='${format("document-%s-parser",local.name)}';
+ add('aws_ecs_task_definition','',{count:'${var.images_ready ? 1 : 0}',family:'${local.task_definition.family}',network_mode:'bridge',requires_compatibilities:['EC2'],task_role_arn:r('aws_iam_role','_transfer','arn'),execution_role_arn:r('aws_iam_role','_execution','arn'),
+  container_definitions:'${jsonencode(local.task_definition.containerDefinitions)}',runtime_platform:{cpu_architecture:'X86_64',operating_system_family:'LINUX'},placement_constraints:[{type:'memberOf',expression:'${local.task_definition.placementConstraints[0].expression}'}],
+  volume:['input','output'].map(name=>({name,docker_volume_configuration:{scope:'task',driver:'local',autoprovision:false}})),tags:{'atmem-workload':'document-parser'}});
+ locals.worker_policy={Version:'2012-10-17',Statement:[allow('InspectDefinition',['ecs:DescribeTaskDefinition'],'*'),allow('RunPinnedDefinition',['ecs:RunTask'],'${var.images_ready ? aws_ecs_task_definition.'+n+'[0].arn : null}',{ArnEquals:{'ecs:cluster':l('cluster_arn')},Bool:{'ecs:enable-execute-command':'false'}}),
+  allow('OwnedTaskLifecycle',['ecs:DescribeTasks','ecs:StopTask'],tasks,{ArnEquals:{'ecs:cluster':l('cluster_arn')}}),allow('DiscoverOwnedRuns',['ecs:ListTasks'],ci,{ArnEquals:{'ecs:cluster':l('cluster_arn')}}),
+  allow('PassOnlyTransferAndPull',['iam:PassRole'],[r('aws_iam_role','_transfer','arn'),r('aws_iam_role','_execution','arn')],{StringEquals:{'iam:PassedToService':'ecs-tasks.amazonaws.com'}}),
+  allow('OwnedTemporaryBytes',['s3:GetObject','s3:PutObject','s3:DeleteObject'],objects),allow('CheckOwnedStore',['s3:GetBucketLocation','s3:GetBucketVersioning'],bucket)]};
+ // Conditional local prevents evaluating [0] while images are not ready.
+ locals.enabled_worker_policy='${var.images_ready ? jsonencode(local.worker_policy) : null}';
+ add('aws_iam_role_policy','_worker',{count:'${var.images_ready ? 1 : 0}',name:l('name')+'-worker',role:'${data.aws_iam_role.'+n+'_worker.name}',policy:l('enabled_worker_policy')});
+ const encode=text=>btoa(Array.from(new TextEncoder().encode(text),byte=>String.fromCharCode(byte)).join(''));
+ locals.expected_b64='${base64encode(jsonencode(local.expected))}';
+ const guardUnit='[Unit]\nDescription=AtMem private parser host guard\nRequires=docker.service\nAfter=docker.service\nBindsTo=docker.service\nPartOf=docker.service\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nTimeoutStartSec=60\nExecStart=/usr/bin/python3 -I /opt/atmem/enterprise_aws_host_bootstrap.py guard ${local.expected_b64}\n';
+ const ecsDropin='[Unit]\nRequires=atmem-document-guard.service\nAfter=atmem-document-guard.service\nBindsTo=atmem-document-guard.service\nPartOf=docker.service\n';
+ locals.cloud_init={package_update:false,package_upgrade:false,bootcmd:[['systemctl','mask','--runtime','--now','ecs.service']],write_files:[
+  {path:'/opt/atmem/enterprise_aws_host_probe.py',owner:'root:root',permissions:'0600',encoding:'b64',content:encode(probe)},
+  {path:'/opt/atmem/enterprise_aws_host_bootstrap.py',owner:'root:root',permissions:'0600',encoding:'b64',content:encode(bootstrap)},
+  {path:'/etc/systemd/system/atmem-document-guard.service',owner:'root:root',permissions:'0644',content:guardUnit},
+  {path:'/etc/systemd/system/ecs.service.d/atmem-document.conf',owner:'root:root',permissions:'0644',content:ecsDropin}],
+  runcmd:[['/bin/bash','-euo','pipefail','-c','/usr/bin/python3 -I /opt/atmem/enterprise_aws_host_bootstrap.py prepare ${local.expected_b64}\n/usr/bin/systemctl daemon-reload\n/usr/bin/systemctl restart docker.service\n/usr/bin/systemctl start atmem-document-guard.service\n/usr/bin/systemctl unmask --runtime ecs.service\n/usr/bin/systemctl enable --now --no-block ecs.service']]};
+ locals.cloud_init_text=['#cloud-config','${jsonencode(local.cloud_init)}'].join(String.fromCharCode(10));
+ add('aws_launch_template','',{count:'${var.hosts_enabled ? 1 : 0}',name_prefix:l('name')+'-',image_id:'${data.aws_ami.'+n+'_host[0].id}',instance_type:'m6i.large',update_default_version:false,
+  iam_instance_profile:{arn:r('aws_iam_instance_profile','','arn')},network_interfaces:[{associate_public_ip_address:false,security_groups:[r('aws_security_group','_host','id')]}],
+  metadata_options:{http_endpoint:'enabled',http_tokens:'required',http_put_response_hop_limit:1,http_protocol_ipv6:'disabled',instance_metadata_tags:'disabled'},
+  block_device_mappings:[{device_name:'${data.aws_ami.'+n+'_host[0].root_device_name}',ebs:{encrypted:true,delete_on_termination:true,volume_size:40,volume_type:'gp3'}}],
+  user_data:'${base64encode(local.cloud_init_text)}',
+  tag_specifications:[{resource_type:'instance',tags:{'atmem-document-policy':l('host_policy'),Name:l('name')}},{resource_type:'volume',tags:{Name:l('name')}}],lifecycle:{create_before_destroy:true}});
+ add('aws_autoscaling_group','',{count:'${var.hosts_enabled ? 1 : 0}',name:l('name'),min_size:v('host_count'),max_size:v('host_count'),desired_capacity:v('host_count'),vpc_zone_identifier:subnets,health_check_type:'EC2',
+  launch_template:{id:'${aws_launch_template.'+n+'[0].id}',version:'${tostring(aws_launch_template.'+n+'[0].latest_version)}'},
+  tag:[{key:'atmem-document-policy',value:l('host_policy'),propagate_at_launch:true}],
+  depends_on:['aws_iam_role_policy.'+n+'_host',...Object.keys(resource.aws_vpc_endpoint).map(name=>'aws_vpc_endpoint.'+name),'aws_vpc_security_group_egress_rule.'+n+'_api','aws_vpc_security_group_egress_rule.'+n+'_s3']});
+ locals.document_job_configuration={format:'enterprise-aws-document-job-v2',accountId:v('account_id'),region:v('region'),bucket:r('aws_s3_bucket','','id'),clusterArn:l('cluster_arn'),
+  hostPolicySha256:l('host_policy'),hostDocumentArn:'${module.host_verification.host_verification.hostDocumentArn}',hostDocumentHash:'${module.host_verification.host_verification.hostDocumentHash}',hostDocumentVersion:'${module.host_verification.host_verification.hostDocumentVersion}',
+  workerRoleArn:v('worker_role_arn'),transferRoleArn:r('aws_iam_role','_transfer','arn'),executionRoleArn:r('aws_iam_role','_execution','arn'),parserImage:v('parser_image'),transferImage:v('transfer_image'),taskDefinitionArn:'${var.images_ready ? aws_ecs_task_definition.'+n+'[0].arn : null}'};
+ locals.document_executor_configuration={format:'enterprise-document-executor-v1',provider:'aws',parserRevision:v('parser_revision'),configuration:l('document_job_configuration')};
+ const output={document_job_configuration:{value:'${var.images_ready && var.hosts_enabled ? local.document_job_configuration : null}',description:'Runtime config only; requires complete worker/export and destination checks.',depends_on:['aws_autoscaling_group.'+n,'aws_iam_role_policy.'+n+'_worker']},
+  artifacts:{value:{parserRepository:r('aws_ecr_repository','_parser','repository_url'),transferRepository:r('aws_ecr_repository','_transfer','repository_url'),parserRevision:v('parser_revision'),recommendedAmi:'${nonsensitive(data.aws_ssm_parameter.'+n+'_recommended_ami.value)}',hostAmi:v('host_ami_id')}},
+  host_verification:{value:'${module.host_verification.host_verification}'},document_executor_configuration:{value:'${var.images_ready && var.hosts_enabled ? local.document_executor_configuration : null}',description:'Owned worker input envelope, bound to the approved parser revision; full application hosting/export acceptance is separate.'}};
+ const main={terraform:child.terraform,provider:{aws:{region:v('region'),allowed_account_ids:[v('account_id')]}},variable,locals,data,module,resource,output};
+ return {...enterpriseApplicationFiles('aws',n),...files,'main.tf.json':JSON.stringify(main,null,2)+'\n','.terraform.lock.hcl':host['.terraform.lock.hcl'],'deployment.tfvars.json.example':JSON.stringify(examples,null,2)+'\n',
+  'tests/document-infrastructure.tftest.hcl':awsDocumentInfrastructureTests(n,seed,row.region),
+  'document-job-boundary.json':JSON.stringify({provider:'aws',region:row.region,component:row.id,scope:'Private parser execution substrate; complete application/export is unfinished.',cloudOperations:false,wholeProjectQualified:false},null,2)+'\n',
+  'README.md':'# AWS private parser substrate\n\nCreates a new dedicated private VPC, two subnets, API/ECR/SSM endpoints, temporary no-history S3 store, separate host/transfer/image-pull roles, immutable repositories, fixed host verifier and optional EC2 pool/static task revision. Existing worker identity is referenced by its full ARN and receives additive named policies. No existing pool, database, document source or website is adopted.\n\nReview costs before foundation apply: endpoints incur standing charges even with hosts disabled. Hosts are a fixed bounded standing pool, not automatically scaled or performance-qualified. Supply actual reviewed AMI and independently qualified immutable images; discovery metadata does not approve them. Runtime output remains null until both switches are enabled.\n\nNo NAT, internet gateway, public IP or SSH ingress is created. Trusted transfer stages can reach the named private APIs and the S3 gateway prefix list; the parser has networking disabled. Physical erasure, native host/agent/SSM/IAM behavior, strict retention and throughput require destination qualification. One-day lifecycle is an asynchronous fallback, not a deadline.\n\nTask definitions belong to Terraform, not the worker. Upgrade by publishing a new reviewed revision and draining active work before replacing hosts; automatic rolling host replacement/draining is not implemented. Keep the old cleanup target available when changing family/bucket/destination. Never destroy populated stores or terminate active hosts without a reviewed drain.\n\nComplete API/worker/SQL/model/source hosting, enrollment, secrets, recovery and Spec Kit/export composition remain unfinished. No whole-project, security, cloud-plan or deployment acceptance is implied.\n'};
+}

package/src/enterprise-google-infrastructure.mjs

@@ -0,0 +1,84 @@
+import {resourceAddress} from './identifiers.mjs';
+import {CLOUD_PROVIDER_LOCKS} from './cloud-provider-locks.mjs';
+import {googleDocumentJobTests} from './enterprise-google-tests.mjs';
+import {enterpriseApplicationFiles}from'./enterprise-application.mjs';
+
+// Partial compiler building block. Do not register a complete private-assistant
+// capability until application/operator/recovery and the other clouds qualify.
+export function googleDocumentJobTerraform(project,row,environment='staging'){
+ if(!project||typeof project.id!=='string'||!project.id||project.id.length>255||!Number.isSafeInteger(project.revision)||project.revision<1)throw Error('Use the stable owned project and design revision');
+ if(!row||row.provider!=='gcp'||typeof row.id!=='string'||!row.id||typeof row.address!=='string'||!/^block_[0-9a-f]+$/.test(row.address)||typeof row.region!=='string'||!(/^[a-z]+-[a-z]+[1-9][0-9]?$/).test(row.region))throw Error('Preserve the explicit Google provider and canonical selected region');
+ encodeURIComponent(row.id); // Reject invalid Unicode instead of replacing bytes.
+ const address=resourceAddress(row.id);
+ if(row.address!==address)throw Error('Keep the canonical source-component address; do not redirect another component');
+ if(!['staging','production','qualification'].includes(environment))throw Error('Use an explicit supported environment');
+ const n=row.address,seed='https://atmem.ai/workspaces/'+encodeURIComponent(project.id)+'/'+n+'/'+environment;
+ const v=key=>'${var.'+key+'}',r=(type,key,attribute)=>'${'+type+'.'+key+'.'+attribute+'}',l=key=>'${local.'+key+'}';
+ const variable={review_approved:{type:'bool',default:false,nullable:false,description:'Review the exact destination, IAM scope, raw-data retention, costs and operating responsibilities before any apply.'},images_ready:{type:'bool',default:false,nullable:false,description:'Enable configuration output only after actual immutable parser/transfer artifacts are built and reviewed.'}};
+ const examples={review_approved:false,images_ready:false},resource={},output={};
+ function input(name,description,example,pattern,defaultValue){
+  variable[name]={type:'string',nullable:false,description,validation:{condition:'${can(regex('+JSON.stringify(pattern)+',var.'+name+'))}',error_message:'Supply the reviewed '+name+' destination input.'}};
+  if(defaultValue!==undefined)variable[name].default=defaultValue;examples[name]=example;return v(name);
+ }
+ const destination=input('project_id','Existing owned project in which this package administers Batch jobs. Review project-scoped control permissions; unrelated workloads are not adopted.','reviewed-project','^[a-z][a-z0-9-]{4,28}[a-z0-9]$');
+ const region=input('region','Placement is bound to the selected architecture; regenerate to change it.',row.region,'^'+row.region+'$',row.region);
+ const worker=input('worker_service_account','Existing question-worker service account in this project, referenced without changing its other roles or SQL identity.','owned-worker@reviewed-project.iam.gserviceaccount.com','^[a-z][a-z0-9-]{4,28}[a-z0-9]@[a-z][a-z0-9-]{4,28}[a-z0-9][.]iam[.]gserviceaccount[.]com$');
+ const locals={name:'${format("doc-%s",substr(sha256('+JSON.stringify(seed)+'),0,12))}'};
+ const checks=[{condition:v('review_approved'),error_message:'Review the destination and complete this component plan before any apply.'},
+  {condition:'${endswith(var.worker_service_account,format("@%s.iam.gserviceaccount.com",var.project_id))}',error_message:'The existing worker identity must belong to this destination project.'},
+  {condition:'${var.worker_service_account != format("%s-vm@%s.iam.gserviceaccount.com",local.name,var.project_id)}',error_message:'Keep question-worker and parser-transfer VM identities separate.'}];
+ for(const purpose of ['parser','transfer']){
+  const name=purpose+'_image';
+  variable[name]={type:'string',default:'',nullable:false,description:'Immutable package-owned regional '+purpose+' artifact; empty only during foundation.',validation:{condition:'${!var.images_ready || can(regex("^[a-z0-9./_-]+@sha256:[0-9a-f]{64}$",var.'+name+'))}',error_message:'Use the actual reviewed immutable '+purpose+' artifact.'}};
+  examples[name]='';
+  checks.push({condition:'${!var.images_ready || startswith(var.'+name+',format("%s-docker.pkg.dev/%s/%s/'+purpose+'@sha256:",var.region,var.project_id,local.name))}',error_message:'Keep '+purpose+' in the owned regional registry with a reviewed digest.'});
+ }
+ variable.parser_revision={type:'string',default:'',nullable:false,description:'Full independently qualified parser artifact revision, supplied by the image build receipt, not guessed from a source revision.',validation:{condition:'${!var.images_ready || can(regex("^[0-9a-f]{64}$",var.parser_revision))}',error_message:'Supply the actual qualified parser artifact revision.'}};examples.parser_revision='';
+ const literal=value=>value.replace(/\$\{/g,()=>'$${').replace(/%\{/g,()=>'%%{');
+ resource.terraform_data={[n+'_review']:{input:{design_revision:project.revision,environment,source_component:literal(row.id)},lifecycle:{precondition:checks}}};
+ const add=(type,name,body)=>((resource[type]??={})[name]={...body,depends_on:['terraform_data.'+n+'_review',...(body.depends_on||[])]});
+ const apiDependencies=[];
+ for(const [key,service]of Object.entries({compute:'compute.googleapis.com',batch:'batch.googleapis.com',identity:'iam.googleapis.com',storage:'storage.googleapis.com',registry:'artifactregistry.googleapis.com',dns:'dns.googleapis.com'})){
+  add('google_project_service',n+'_'+key,{project:destination,service,disable_on_destroy:false});apiDependencies.push('google_project_service.'+n+'_'+key);
+ }
+ add('google_project_service_identity',n+'_batch_agent',{provider:'google-beta',project:destination,service:'batch.googleapis.com',depends_on:['google_project_service.'+n+'_batch']});
+ add('google_project_iam_member',n+'_batch_agent',{project:destination,role:'roles/batch.serviceAgent',member:r('google_project_service_identity',n+'_batch_agent','member')});
+ add('google_service_account',n+'_vm',{project:destination,account_id:l('name')+'-vm',display_name:'Trusted one-file transfer and Batch reporting; no source/model/SQL role',depends_on:['google_project_service.'+n+'_identity']});
+ const vmMember='${format("serviceAccount:%s",google_service_account.'+n+'_vm.email)}',workerMember='${format("serviceAccount:%s",var.worker_service_account)}';
+ add('google_project_iam_member',n+'_reporter',{project:destination,role:'roles/batch.agentReporter',member:vmMember,depends_on:['google_project_service.'+n+'_batch']});
+ add('google_service_account_iam_member',n+'_worker_act_as',{service_account_id:r('google_service_account',n+'_vm','name'),role:'roles/iam.serviceAccountUser',member:workerMember});
+ add('google_project_iam_custom_role',n+'_control',{project:destination,role_id:'${replace(local.name,"-","_")}_control',title:'Owned private document job controller',stage:'GA',permissions:['batch.jobs.create','batch.jobs.get','batch.jobs.delete','batch.operations.get'],depends_on:['google_project_service.'+n+'_batch']});
+ add('google_project_iam_member',n+'_worker_control',{project:destination,role:r('google_project_iam_custom_role',n+'_control','name'),member:workerMember});
+ add('google_artifact_registry_repository',n,{project:destination,location:region,repository_id:l('name'),format:'DOCKER',description:'Reviewed immutable parser and trusted transfer artifacts',depends_on:['google_project_service.'+n+'_registry'],lifecycle:{prevent_destroy:true}});
+ add('google_artifact_registry_repository_iam_member',n+'_image_read',{project:destination,location:region,repository:r('google_artifact_registry_repository',n,'repository_id'),role:'roles/artifactregistry.reader',member:vmMember});
+ add('google_storage_bucket',n,{project:destination,name:'${format("atmem-doc-%s",substr(sha256(format("%s:%s",var.project_id,local.name)),0,20))}',location:region,storage_class:'STANDARD',uniform_bucket_level_access:true,public_access_prevention:'enforced',force_destroy:false,
+  versioning:{enabled:false},soft_delete_policy:{retention_duration_seconds:0},lifecycle_rule:[{action:{type:'Delete'},condition:{age:1,matches_prefix:['document-jobs/']}}],lifecycle:{prevent_destroy:true},depends_on:['google_project_service.'+n+'_storage']});
+ for(const [role,permissions,member]of [['transfer',['storage.objects.get','storage.objects.create'],vmMember],['worker',['storage.objects.get','storage.objects.create','storage.objects.delete'],workerMember]]){
+  add('google_project_iam_custom_role',n+'_'+role+'_objects',{project:destination,role_id:'${replace(local.name,"-","_")}_'+role+'_objects',title:'Private parser '+role+' temporary bytes',stage:'GA',permissions,depends_on:['google_project_service.'+n+'_storage']});
+  add('google_storage_bucket_iam_member',n+'_'+role,{bucket:r('google_storage_bucket',n,'name'),role:r('google_project_iam_custom_role',n+'_'+role+'_objects','name'),member});
+ }
+ add('google_compute_network',n,{project:destination,name:l('name'),auto_create_subnetworks:false,delete_default_routes_on_create:true,depends_on:['google_project_service.'+n+'_compute'],lifecycle:{prevent_destroy:true}});
+ add('google_compute_subnetwork',n,{project:destination,name:l('name'),region,network:r('google_compute_network',n,'id'),ip_cidr_range:'10.87.0.0/24',private_ip_google_access:true,lifecycle:{prevent_destroy:true}});
+ // No NAT/public IP or broad internet route: only Google private API VIPs and
+ // the documented direct connectivity range are reachable from trusted VMs.
+ for(const [suffix,cidr]of [['api','199.36.153.8/30'],['direct','34.126.0.0/18']])add('google_compute_route',n+'_'+suffix,{project:destination,name:l('name')+'-'+suffix,network:r('google_compute_network',n,'id'),dest_range:cidr,next_hop_gateway:'default-internet-gateway',priority:1000});
+ add('google_compute_firewall',n+'_allow_api',{project:destination,name:l('name')+'-api',network:r('google_compute_network',n,'id'),direction:'EGRESS',priority:1000,destination_ranges:['199.36.153.8/30','34.126.0.0/18'],target_service_accounts:[r('google_service_account',n+'_vm','email')],allow:[{protocol:'tcp',ports:['443']}]});
+ add('google_compute_firewall',n+'_deny_egress',{project:destination,name:l('name')+'-deny-egress',network:r('google_compute_network',n,'id'),direction:'EGRESS',priority:2000,destination_ranges:['0.0.0.0/0'],deny:[{protocol:'all'}]});
+ add('google_compute_firewall',n+'_deny_ingress',{project:destination,name:l('name')+'-deny-ingress',network:r('google_compute_network',n,'id'),direction:'INGRESS',priority:1000,source_ranges:['0.0.0.0/0'],deny:[{protocol:'all'}]});
+ for(const [key,domain]of [['apis','googleapis.com.'],['registry','pkg.dev.']]){
+  add('google_dns_managed_zone',n+'_'+key,{project:destination,name:l('name')+'-'+key,dns_name:domain,visibility:'private',description:'Owned private parser API resolution',private_visibility_config:{networks:[{network_url:r('google_compute_network',n,'id')}]},depends_on:['google_project_service.'+n+'_dns'],lifecycle:{prevent_destroy:true}});
+  add('google_dns_record_set',n+'_'+key+'_wildcard',{project:destination,managed_zone:r('google_dns_managed_zone',n+'_'+key,'name'),name:'*.'+domain,type:'CNAME',ttl:300,rrdatas:['private.googleapis.com.']});
+ }
+ add('google_dns_record_set',n+'_private_vip',{project:destination,managed_zone:r('google_dns_managed_zone',n+'_apis','name'),name:'private.googleapis.com.',type:'A',ttl:300,rrdatas:['199.36.153.8','199.36.153.9','199.36.153.10','199.36.153.11']});
+ locals.document_job_configuration={format:'enterprise-google-document-job-v1',projectId:destination,region,bucket:r('google_storage_bucket',n,'name'),parserImage:v('parser_image'),transferImage:v('transfer_image'),workerServiceAccount:worker,vmServiceAccount:r('google_service_account',n+'_vm','email'),network:'${format("projects/%s/global/networks/%s",var.project_id,google_compute_network.'+n+'.name)}',subnetwork:'${format("projects/%s/regions/%s/subnetworks/%s",var.project_id,var.region,google_compute_subnetwork.'+n+'.name)}'};
+ output.document_job_configuration={value:'${var.images_ready ? local.document_job_configuration : null}',description:'Exact runtime adapter shape; not evidence of worker wiring, crash recovery or account acceptance.',depends_on:Object.entries(resource).flatMap(([type,items])=>Object.keys(items).map(name=>type+'.'+name))};
+ locals.document_executor_configuration={format:'enterprise-document-executor-v1',provider:'gcp',parserRevision:v('parser_revision'),configuration:l('document_job_configuration')};
+ output.document_executor_configuration={value:'${var.images_ready ? local.document_executor_configuration : null}',description:'Owned worker envelope matching the approved parser revision; complete application hosting/export acceptance remains separate.'};
+ output.document_job_artifacts={value:{repository:r('google_artifact_registry_repository',n,'repository_id'),parserRevision:v('parser_revision'),parserImage:v('parser_image'),transferImage:v('transfer_image')}};
+ const main={terraform:{required_version:'>= 1.17.1, < 2.0.0',required_providers:{google:{source:'hashicorp/google',version:'7.46.2'},'google-beta':{source:'hashicorp/google-beta',version:'7.46.2'}}},provider:{google:{project:destination,region},'google-beta':{project:destination,region}},variable,locals,resource,output};
+ return{...enterpriseApplicationFiles('gcp',n),'main.tf.json':JSON.stringify(main,null,2)+'\n','.terraform.lock.hcl':CLOUD_PROVIDER_LOCKS.gcp+'\n'+CLOUD_PROVIDER_LOCKS.gcpBeta,
+  'deployment.tfvars.json.example':JSON.stringify(examples,null,2)+'\n',
+  'tests/document-jobs.tftest.hcl':googleDocumentJobTests(n,seed,row.region),
+  'document-job-boundary.json':JSON.stringify({provider:'gcp',component:row.id,address:n,environment,region:row.region,designRevision:project.revision,scope:'Temporary parser substrate only; not the complete private assistant.',existingWorker:'Referenced, not recreated. Other existing IAM memberships are not changed.',crashRecovery:'Unfinished. Lifecycle age=1 is an asynchronous fallback request, not a maximum retention guarantee.',productionQualified:false,cloudOperations:false},null,2)+'\n',
+  'README.md':'# Private Google document substrate\n\nGenerated from the owned design; this is one unfinished composition block, not a complete project. Use the same selected region, owned destination and existing question-worker identity. Terraform manages only the declared bucket, parser VM identity, custom roles, private registry/network/DNS and API prerequisites. It does not create a user website, company identity provider or document sources.\n\nThe controller gets four project-scoped Batch permissions and actAs only on the transfer VM identity. Object permissions are separate custom roles bound solely to the ephemeral bucket; the transfer VM cannot delete objects or access source/model/SQL credentials through these grants. Existing inherited permissions still require account inspection.\n\nBuild/review immutable artifacts after the foundation and set images_ready only with real build receipts. Foundation output is null; image inputs contain no synthetic published digest. Generated runtime configuration matches enterprise_google_jobs.py. Application hosting, provider/artifact binding, durable orphan recovery, key/audit operations and complete Spec Kit/export integration remain unfinished. No private capability or whole-case acceptance is implied.\n\nOrdinary completion deletes temporary input/results. Bucket versioning and soft deletion are disabled to avoid hidden retained copies. No retention lock or replication is requested. Age-one-day lifecycle is an asynchronous last-resort cleanup request; it does not provide a strict upper retention bound or replace the required reconciler. Observe organization policies and deletion propagation in the destination before release.\n\nVMs have no external IP in the emitted runtime request. Private Google Access, private googleapis.com/pkg.dev DNS, explicit private API routes, TCP443 allow rules and deny-all egress/ingress supply the substrate. Batch-container network isolation and actual VM/agent/IAM/DNS behavior require destination testing; mock plans do not prove those behaviors. No cloud apply or deployment was performed.\n'};
+}

package/src/enterprise-google-tests.mjs

@@ -0,0 +1,25 @@
+// Credential-free provider mock plans are shipped with this partial module.
+// They verify emitted composition, never account IAM/network enforcement.
+export function googleDocumentJobTests(n,seed,region){
+ const digest='a'.repeat(64),name=`format("doc-%s",substr(sha256(${JSON.stringify(seed)}),0,12))`;
+ const image=purpose=>`format("%s-docker.pkg.dev/reviewed-project/%s/${purpose}@sha256:${digest}",${JSON.stringify(region)},${name})`;
+ const run=(title,body)=>`run "${title}" {\n command = plan\n${body}\n}\n`;
+ const assertion=(condition,message)=>` assert {\n condition = ${condition}\n error_message = ${JSON.stringify(message)}\n }`;
+ const ref=(type,suffix='')=>type+'.'+n+suffix;
+ let text=`mock_provider "google" {}\nmock_provider "google-beta" {}\n`;
+ text+=`override_resource {\n override_during = plan\n target = ${ref('google_service_account','_vm')}\n values = {\n email = "document-vm@reviewed-project.iam.gserviceaccount.com"\n name = "projects/reviewed-project/serviceAccounts/document-vm@reviewed-project.iam.gserviceaccount.com"\n }\n}\n`;
+ text+=`override_resource {\n override_during = plan\n target = ${ref('google_project_service_identity','_batch_agent')}\n values = {\n email = "service-123456789012@gcp-sa-cloudbatch.iam.gserviceaccount.com"\n member = "serviceAccount:service-123456789012@gcp-sa-cloudbatch.iam.gserviceaccount.com"\n }\n}\n`;
+ text+=`variables {\n review_approved = true\n images_ready = true\n project_id = "reviewed-project"\n worker_service_account = "owned-worker@reviewed-project.iam.gserviceaccount.com"\n parser_image = ${image('parser')}\n transfer_image = ${image('transfer')}\n parser_revision = "${digest}"\n}\n`;
+ text+=run('private_document_substrate',assertion(`${ref('google_storage_bucket')}.uniform_bucket_level_access && ${ref('google_storage_bucket')}.public_access_prevention == "enforced" && !${ref('google_storage_bucket')}.versioning[0].enabled && ${ref('google_storage_bucket')}.soft_delete_policy[0].retention_duration_seconds == 0 && !${ref('google_storage_bucket')}.force_destroy`,'No public access, mutable history or hidden soft-delete retention for temporary document bytes.')+'\n'+assertion(`output.document_executor_configuration.provider == "gcp" && output.document_executor_configuration.parserRevision == var.parser_revision && output.document_executor_configuration.configuration == output.document_job_configuration && output.document_job_configuration.format == "enterprise-google-document-job-v1" && output.document_job_configuration.region == ${JSON.stringify(region)} && output.document_job_configuration.workerServiceAccount == var.worker_service_account && output.document_job_configuration.vmServiceAccount == ${ref('google_service_account','_vm')}.email`,'Keep exact runtime configuration, selected region and separate identities.'));
+ text+=run('scoped_job_identity',assertion(`toset(${ref('google_project_iam_custom_role','_control')}.permissions) == toset(["batch.jobs.create","batch.jobs.get","batch.jobs.delete","batch.operations.get"]) && ${ref('google_service_account_iam_member','_worker_act_as')}.service_account_id == ${ref('google_service_account','_vm')}.name && ${ref('google_service_account_iam_member','_worker_act_as')}.role == "roles/iam.serviceAccountUser"`,'Do not grant generic administrator or project-wide actAs authority.')+'\n'+assertion(`toset(${ref('google_project_iam_custom_role','_transfer_objects')}.permissions) == toset(["storage.objects.get","storage.objects.create"]) && toset(${ref('google_project_iam_custom_role','_worker_objects')}.permissions) == toset(["storage.objects.get","storage.objects.create","storage.objects.delete"]) && ${ref('google_storage_bucket_iam_member','_transfer')}.bucket == ${ref('google_storage_bucket')}.name`,'Transfer identities receive temporary-byte access only; deletion stays with the controller.'));
+ text+=run('private_network',assertion(`${ref('google_compute_subnetwork')}.private_ip_google_access && !${ref('google_compute_network')}.auto_create_subnetworks && ${ref('google_compute_network')}.delete_default_routes_on_create && ${ref('google_compute_route','_api')}.dest_range == "199.36.153.8/30" && ${ref('google_compute_route','_direct')}.dest_range == "34.126.0.0/18"`,'Retain explicit private Google routing without a default internet route.')+'\n'+assertion(`${ref('google_compute_firewall','_allow_api')}.priority < ${ref('google_compute_firewall','_deny_egress')}.priority && ${ref('google_compute_firewall','_deny_egress')}.direction == "EGRESS" && ${ref('google_dns_record_set','_private_vip')}.type == "A" && toset(${ref('google_dns_record_set','_registry_wildcard')}.rrdatas) == toset(["private.googleapis.com."])`,'Private API/registry DNS and restrictive firewall ordering must remain connected.'));
+ text+=run('foundation_configuration_not_ready',` variables {\n images_ready = false\n parser_image = ""\n transfer_image = ""\n parser_revision = ""\n }\n`+assertion('output.document_job_configuration == null','Do not advertise a configured parser before real artifacts are published.'));
+ text+=run('review_required',` variables { review_approved = false }\n expect_failures = [terraform_data.${n}_review]`);
+ text+=run('foreign_worker_rejected',` variables { worker_service_account = "owned-worker@foreign-project.iam.gserviceaccount.com" }\n expect_failures = [terraform_data.${n}_review]`);
+ text+=run('same_worker_and_vm_rejected',` variables { worker_service_account = format("%s-vm@reviewed-project.iam.gserviceaccount.com",${name}) }\n expect_failures = [terraform_data.${n}_review]`);
+ text+=run('mutable_image_rejected',` variables { parser_image = "unreviewed:latest" }\n expect_failures = [var.parser_image]`);
+ text+=run('foreign_registry_rejected',` variables { transfer_image = "foreign.example/transfer@sha256:${digest}" }\n expect_failures = [terraform_data.${n}_review]`);
+ text+=run('missing_parser_receipt_rejected',` variables { parser_revision = "" }\n expect_failures = [var.parser_revision]`);
+ text+=run('selected_region_cannot_drift',` variables { region = "us-central1" }\n expect_failures = [var.region]`);
+ return text;
+}

package/src/estimate.mjs

@@ -0,0 +1,188 @@
+// Monthly run-cost estimate. See specs/004-cost-estimate.
+// Every line is quantity (from usage inputs) × unit price (entered with a source).
+// No prices ship with AtMem AI Architect; a missing input or price leaves the estimate incomplete.
+import { roleOf } from "./review.mjs";
+
+export const DISCLAIMER = "Estimate — not a bill or guarantee.";
+
+export const INPUTS = [
+  { id: "requests_per_month", label: "Requests per month", unit: "requests", fact: "requests.per_month" },
+  { id: "tokens_per_request", label: "Tokens per request (in + out)", unit: "tokens", hint: "A short question and answer with a few retrieved passages is often 2,000–4,000 tokens." },
+  { id: "data_gb", label: "Data stored", unit: "GB", fact: "data.gb" },
+  { id: "endpoint_hours", label: "Model endpoint hours per month", unit: "hours", assumption: 730, assumptionText: "always on (730 h/month)" },
+  { id: "events_per_month", label: "Events or messages per month", unit: "events" },
+  { id: "training_hours", label: "Training hours per month", unit: "hours" },
+];
+
+// Planning assumptions, not provider prices or capacity guarantees. Explicit inputs
+// and discovered business facts always take precedence over these presets.
+export const PROJECT_SIZES = Object.freeze([
+  {id:'small', label:'Small', requests_per_month:10000, data_gb:10, events_per_month:10000},
+  {id:'medium', label:'Medium', requests_per_month:100000, data_gb:100, events_per_month:100000},
+  {id:'large', label:'Large', requests_per_month:1000000, data_gb:1000, events_per_month:1000000},
+  {id:'extra-large', label:'Extra Large', requests_per_month:10000000, data_gb:10000, events_per_month:10000000},
+].map(size=>Object.freeze({...size,tokens_per_request:3000,endpoint_hours:730})));
+export function setProjectSize(project, id) {
+  if (!PROJECT_SIZES.some(size=>size.id===id)) throw Error('Choose a listed project size.');
+  return {...project,estimate:{...project.estimate,projectSize:id}};
+}
+
+// role/kind → how it is charged
+const DRIVERS = {
+  llm: { name: "Model tokens", unit: "1k tokens", inputs: ["requests_per_month", "tokens_per_request"], qty: (u) => (u.requests_per_month * u.tokens_per_request) / 1000 },
+  index: { name: "Index storage", unit: "GB-month", inputs: ["data_gb"], qty: (u) => u.data_gb },
+  ingest: { name: "Data processed", unit: "GB", inputs: ["data_gb"], qty: (u) => u.data_gb },
+  data: { name: "Storage", unit: "GB-month", inputs: ["data_gb"], qty: (u) => u.data_gb },
+  model: { name: "Endpoint hours", unit: "hours", inputs: ["endpoint_hours"], qty: (u) => u.endpoint_hours },
+  guard: { name: "Checked requests", unit: "1k requests", inputs: ["requests_per_month"], qty: (u) => u.requests_per_month / 1000 },
+  stream: { name: "Messages", unit: "million events", inputs: ["events_per_month"], qty: (u) => u.events_per_month / 1e6 },
+  train: { name: "Training hours", unit: "hours", inputs: ["training_hours"], qty: (u) => u.training_hours },
+};
+function driverOf(n) {
+  if (n.data.kind === "stream") return DRIVERS.stream;
+  if (n.data.kind === "train") return DRIVERS.train;
+  return DRIVERS[roleOf(n)] || null;
+}
+
+// Usage values with where they came from: entered, discovery, or a stated assumption.
+export function usage(project) {
+  const est = project.estimate || {};
+  const facts = project.facts || [];
+  return Object.fromEntries(
+    INPUTS.map((i) => {
+      const entered = est.usage?.[i.id];
+      const fromFact = i.fact && [...facts].reverse().find((f) => f.name === i.fact);
+      if (Number.isFinite(entered) && entered >= 0) return [i.id, { value: entered, source: "entered" }];
+      if (fromFact && Number.isFinite(fromFact.value) && fromFact.value >= 0) return [i.id, { value: fromFact.value, source: `discovery (${fromFact.madeAt})` }];
+      const preset = PROJECT_SIZES.find(size=>size.id===est.projectSize);
+      if (preset && Number.isFinite(preset[i.id])) return [i.id, {value:preset[i.id], source:`${preset.label} planning assumption`}];
+      if (i.assumption != null) return [i.id, { value: i.assumption, source: `assumption: ${i.assumptionText}` }];
+      return [i.id, { value: null, source: "needed" }];
+    }),
+  );
+}
+
+export function estimate(project, now = new Date()) {
+  const est = project.estimate || {};
+  const u = usage(project);
+  const values = Object.fromEntries(Object.entries(u).map(([k, v]) => [k, v.value]));
+  const low = Number.isFinite(est.low) && est.low >= 0 && est.low <= 1 ? est.low : 0.7;
+  const high = Number.isFinite(est.high) && est.high >= 1 ? est.high : 1.5;
+  const lines = [];
+  const notCosted = [];
+  for (const n of project.nodes.filter((x) => x.data.kind !== "note")) {
+    const detail = (est.details || []).filter((l) => l.componentId === n.id);
+    if (detail.length) {
+      for (const l of detail) {
+        const validNumber = (v) => Number.isFinite(v) && v >= 0;
+        const missing = validNumber(l.quantity) ? [] : ["quantity"];
+        const priced = validNumber(l.price) && /^[A-Z]{3}$/.test(l.currency || "") && l.source?.trim() && l.unit?.trim();
+        lines.push({ id: l.id, component: n.data.label, componentId: n.id, detailed: true,
+          driver: l.description || "Charge", unit: l.unit, inputs: [], quantity: missing.length ? null : l.quantity,
+          missing, price: priced ? l : null,
+          cost: !missing.length && priced ? Math.round(l.quantity * l.price * 100) / 100 : null,
+          status: missing.length ? "input needed" : priced ? "priced" : "price needed" });
+      }
+      continue;
+    }
+    const d = driverOf(n);
+    if (!d) {
+      notCosted.push(n.data.label);
+      continue;
+    }
+    const missing = d.inputs.filter((k) => values[k] == null);
+    const quantity = missing.length ? null : Math.round(d.qty(values) * 100) / 100;
+    const price = est.prices?.[n.id];
+    const priced = price && Number.isFinite(price.price) && price.price >= 0 && /^[A-Z]{3}$/.test(price.currency || "") && String(price.source || "").trim() && !(price.tierLimit && quantity > price.tierLimit);
+    lines.push({
+      id: n.id,
+      component: n.data.label,
+      driver: d.name,
+      unit: d.unit,
+      inputs: d.inputs,
+      quantity,
+      missing,
+      price: priced ? price : null,
+      cost: quantity != null && priced ? Math.round(quantity * price.price * 100) / 100 : null,
+      status: missing.length ? "input needed" : priced ? "priced" : "price needed",
+    });
+  }
+  const costed = lines.filter((l) => l.cost != null);
+  const currencies = [...new Set(costed.map((l) => l.price.currency || "?"))];
+  const total = costed.reduce((sum, l) => sum + l.cost, 0);
+  const budget = [...(project.facts || [])].reverse().find((f) => f.name === "budget.per_month");
+  const budgetCurrency = budget?.unit?.split("/")[0];
+  const gaps = [
+    ...(est.details || []).filter((l) => !project.nodes.some((n) => n.id === l.componentId && n.data.kind !== "note")).map((l) => `${l.description || l.id}: linked component was removed; reassign this charge (excluded from totals).`),
+    ...lines.filter((l) => l.status !== "priced").map((l) => `${l.component} / ${l.driver}: ${l.status}${l.missing.length ? ` (${l.missing.join(", ")})` : ""}.`),
+    ...notCosted.map((name) => `${name}: no cost lines; add charges or an explicit zero-cost line with a reason.`),
+    ...(currencies.length > 1 ? ["Choose one currency; different currencies cannot be added."] : []),
+    ...lines.filter((l) => l.price && (!l.price.region?.trim() || !l.price.service?.trim() || !l.price.date || !Number.isFinite(Date.parse(l.price.date)))).map((l) => `${l.component} / ${l.driver}: confirm region, service/SKU and price date.`),
+    ...lines.filter((l) => l.price?.date && (now - new Date(l.price.date)) / 86400000 > 90).map((l) => `${l.component} / ${l.driver}: price is over 90 days old; review it.`),
+    ...lines.filter((l) => l.price?.date && new Date(l.price.date) > now).map((l) => `${l.component} / ${l.driver}: price date is in the future.`),
+  ];
+  return {
+    lines,
+    notCosted,
+    usage: u,
+    currency: currencies.length === 1 ? currencies[0] : null,
+    mixedCurrencies: currencies.length > 1,
+    expected: currencies.length > 1 || !costed.length ? null : Math.round(total * 100) / 100,
+    low: currencies.length > 1 || !costed.length ? null : Math.round(total * low * 100) / 100,
+    high: currencies.length > 1 || !costed.length ? null : Math.round(total * high * 100) / 100,
+    factors: { low, high },
+    complete: lines.length > 0 && lines.every((l) => l.status === "priced") && !gaps.length,
+    drivers: [...costed].sort((a, b) => b.cost - a.cost).slice(0, 3),
+    budget: budget ? { amount: budget.value, currency: budgetCurrency, comparable: budgetCurrency === currencies[0] && currencies.length === 1 } : null,
+    maturity: costed.length === 0 ? "Not estimated" : lines.every((l) => l.detailed && l.status === "priced") && !notCosted.length && currencies.length === 1 ? "Detailed worksheet" : "ROM",
+    gaps,
+  };
+}
+
+export function setPrice(project, componentId, price) {
+  const est = project.estimate || {};
+  const editedRate = ('price' in price || 'currency' in price) && !('source' in price);
+  const provenance = editedRate ? {source:'entered by you',url:undefined,tierLimit:undefined,note:undefined,date:new Date().toLocaleDateString('en-CA')} : {};
+  return {
+    ...project,
+    estimate: {
+      ...est,
+      prices: {
+        ...(est.prices || {}),
+        [componentId]: { source: "entered by you", date: new Date().toLocaleDateString("en-CA"), currency: "USD", ...(est.prices?.[componentId] || {}), ...provenance, ...price },
+      },
+    },
+  };
+}
+
+export function setUsage(project, id, value) {
+  const est = project.estimate || {};
+  const next = { ...(est.usage || {}) };
+  if (value === "" || value == null || !Number.isFinite(Number(value))) delete next[id];
+  else if (Number(value) >= 0) next[id] = Number(value);
+  return { ...project, estimate: { ...est, usage: next } };
+}
+
+export const WORK_PHASES = [
+  ["discovery", "Discovery & specification"], ["design", "Architecture & security"],
+  ["build", "Implementation & integration"], ["test", "Testing & acceptance"],
+  ["deploy", "Deployment & handover"],
+];
+
+export function consultingEstimate(project) {
+  const c = project.estimate?.consulting || {};
+  const valid = (v) => Number.isFinite(v) && v >= 0;
+  const lines = WORK_PHASES.map(([id, label]) => {
+    const l = c.phases?.[id] || {};
+    const complete = [l.lowDays, l.days, l.highDays, l.rate].every(valid) && l.lowDays <= l.days && l.days <= l.highDays && !!l.basis?.trim();
+    return { id, label, ...l, complete, low: complete ? l.lowDays * l.rate : null, expected: complete ? l.days * l.rate : null, high: complete ? l.highDays * l.rate : null };
+  });
+  const currencyValid = /^[A-Z]{3}$/.test(c.currency || "USD");
+  const sum = (key) => currencyValid && lines.some((l) => l.complete) ? Math.round(lines.reduce((s, l) => s + (l[key] || 0), 0) * 100) / 100 : null;
+  return { lines, currency: c.currency || "USD", complete: currencyValid && lines.every((l) => l.complete), expected: sum("expected"), low: sum("low"), high: sum("high") };
+}
+
+export function setDetail(project, id, patch) {
+  const est = project.estimate || {};
+  return { ...project, estimate: { ...est, details: (est.details || []).map((l) => l.id === id ? { ...l, ...patch } : l) } };
+}

package/src/existing-references.mjs

@@ -0,0 +1,18 @@
+// External ownership is not evidence that an application or integration works.
+// These references never create/import resources or make requests to the endpoint.
+import {externalIdentity,validateExternalReferences} from './external-identities.mjs';
+export function existingReference(node,identity=null) {
+ const d=node.data;
+ if(!['existing','imported Pulumi state'].includes(d.origin)||d.deploymentMode==='create')return null;
+ const explicit=d.binding==='existing-service'||d.origin==='imported Pulumi state'||!!identity;
+ if(d.implementation&&!explicit)return null;
+ const firebase=!d.binding&&d.provider==='gcp'&&/^(?:Google )?Firebase (?:App )?Hosting$/i.test(String(d.service||'').trim());
+ if(!explicit&&!firebase)return null;
+ return {id:node.id,label:d.label,provider:d.provider,service:d.service||d.label,ownership:'external',provision:false,import:false,behaviorValidated:false,...(identity?{identity:structuredClone(identity)}:{})};
+}
+export function existingReferenceFiles(project){
+ validateExternalReferences(project);
+ const references=project.nodes.filter(n=>n.data.kind!=='note').map(n=>existingReference(n,externalIdentity(project,n.id))).filter(Boolean);
+ if(!references.length)return {};
+ return {'existing-references.json':JSON.stringify({version:1,references},null,2),'EXISTING-SYSTEMS.md':'# Existing systems\n\nThese components remain externally managed. This export does not create, import, replace or modify them. Their presence in the diagram is not proof of availability, authentication, permissions or integration behavior. Connection implementations and runtime tests remain separate requirements.\n\n'+references.map(r=>`- ${JSON.stringify(r.label)} (${JSON.stringify(r.id)}): reference only, preserve existing system.`).join('\n')+'\n'};
+}

package/src/external-identities.mjs

@@ -0,0 +1,17 @@
+// Sanitised provenance of externally managed resources. This is neither an
+// executable import request nor a claim about their native physical IDs/behavior.
+export function validateExternalReferences(project){
+ const value=project.extensions?.externalReferences;if(value===undefined)return;
+ const plain=v=>!!v&&typeof v==='object'&&!Array.isArray(v)&&[Object.prototype,null].includes(Object.getPrototypeOf(v));
+ if(!plain(value)||value.version!==1||Object.keys(value).some(k=>!['version','references'].includes(k))||!Array.isArray(value.references)||value.references.length>200)throw Error('Invalid external reference provenance; preserve the original file.');
+ const components=new Set(),identities=new Set();
+ for(const entry of value.references){
+  if(!plain(entry)||Object.keys(entry).some(k=>!['componentId','source','externalId','resourceType'].includes(k))||entry.source!=='pulumi-stack-export')throw Error('Unsupported external identity provenance; no source was substituted.');
+  for(const [key,max]of [['componentId',100],['externalId',600],['resourceType',200]])if(typeof entry[key]!=='string'||!entry[key].trim()||entry[key].length>max)throw Error('Invalid external identity '+key+'; no value was clipped.');
+  if(!entry.externalId.startsWith('urn:pulumi:')||components.has(entry.componentId)||identities.has(entry.externalId))throw Error('Duplicate or invalid external identity; resolve ownership without adopting another resource.');
+  components.add(entry.componentId);identities.add(entry.externalId);
+  const node=project.nodes.find(n=>n.id===entry.componentId);
+  if(node&&(!['existing','imported Pulumi state'].includes(node.data.origin)||node.data.deploymentMode==='create'))throw Error('External state provenance identifies a preserved deployment. Keep its reference or model a separate proposed component; do not turn it into new infrastructure.');
+ }
+}
+export const externalIdentity=(project,id)=>project.extensions?.externalReferences?.references.find(r=>r.componentId===id)||null;