@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/protected-state.mjs

@@ -0,0 +1,43 @@
+const definitions={
+ s3:{type:'s3',settings:{encrypt:true,use_lockfile:true},example:'bucket = "REVIEWED_PROTECTED_STATE_BUCKET"\nkey = "REVIEWED_PROJECT/production.tfstate"\nregion = "REVIEWED_STATE_REGION"\n',guide:'Use a separate private, encrypted, versioned S3 state bucket under the accepted custody/residency boundary. Terraform 1.17 uses native S3 lock files (use_lockfile=true), not an invented DynamoDB dependency. Restrict ListBucket to the project prefix and GetObject/PutObject to its state key; the corresponding .tflock also needs DeleteObject. Do not grant state DeleteObject merely for locking. Use the standard authorized AWS credential chain, never backend access_key/secret_key values.',source:'https://developer.hashicorp.com/terraform/language/backend/s3'},
+ azurerm:{type:'azurerm',settings:{use_azuread_auth:true},example:'storage_account_name = "REVIEWED_PRIVATE_STATE_ACCOUNT"\ncontainer_name = "REVIEWED_STATE_CONTAINER"\nkey = "REVIEWED_PROJECT/production.tfstate"\ntenant_id = "REVIEWED_DIRECTORY_TENANT_UUID"\nsubscription_id = "REVIEWED_STATE_SUBSCRIPTION_UUID"\n',guide:'Use a separate reviewed private Azure Blob state container with versioning/recovery and the accepted residency. Native Blob leases implement state locking. use_azuread_auth=true uses Entra data-plane authentication; grant only reviewed container-scoped state access. Configure the approved Azure CLI, managed identity or workload federation through its documented environment chain; do not export storage account keys, SAS tokens or client secrets into backend.hcl. Verify the exact state subscription/tenant and effective inherited rights independently.',source:'https://developer.hashicorp.com/terraform/language/backend/azurerm'},
+ gcs:{type:'gcs',settings:{},example:'bucket = "REVIEWED_PRIVATE_VERSIONED_STATE_BUCKET"\nprefix = "REVIEWED_PROJECT/production"\n',guide:'Use a separately bootstrapped private, versioned GCS state bucket under the reviewed project/custody/residency boundary. Terraform supports native state locking. Give the authorized state operator scoped object access, preserving unrelated bucket IAM; use the reviewed Google credential/workload-identity chain, never an embedded service-account key. Review encryption/key ownership, inherited grants, version recovery and the exact project/bucket/prefix. The state bucket is not the invoice originals bucket.',source:'https://developer.hashicorp.com/terraform/language/backend/gcs'},
+ http:{type:'http',settings:{},example:'address = "https://REVIEWED_PRIVATE_STATE_SERVICE/EXACT_PROJECT_PRODUCTION_STATE"\nlock_address = "https://REVIEWED_PRIVATE_STATE_SERVICE/EXACT_PROJECT_PRODUCTION_STATE/lock"\nunlock_address = "https://REVIEWED_PRIVATE_STATE_SERVICE/EXACT_PROJECT_PRODUCTION_STATE/lock"\nlock_method = "POST"\nunlock_method = "DELETE"\nretry_wait_min = 5\n',guide:'Use the existing reviewed private platform state service implementing Terraform HTTP state and lock/unlock semantics, not a generic object URL or an unverified S3-compatible IBM COS lock assumption. The example selects POST/DELETE locking; verify the actual platform protocol and owner-safe lock behavior before use. Keep the service in the accepted custody/residency boundary. Configure TF_HTTP_USERNAME/TF_HTTP_PASSWORD or reviewed mutual-TLS environment credentials, never credentials in backend.hcl. No state platform is deployed by this module.',source:'https://developer.hashicorp.com/terraform/language/backend/http'}
+};
+
+export const PROTECTED_BACKENDS=Object.freeze(Object.keys(definitions));
+export function protectedState(backendType,{title='Terraform state and environment ownership',environment='production'}={}){
+ const definition=definitions[backendType];if(!definition)throw Error('Choose an explicit supported state backend; no target-provider fallback.');
+ if(!['staging','production','qualification'].includes(environment))throw Error('Use an explicit supported state environment.');
+ return {backend:{[definition.type]:structuredClone(definition.settings)},files:{'backend.hcl.example':definition.example.replaceAll('production',environment).replaceAll('PRODUCTION',environment.toUpperCase()),'STATE.md':'# '+title+'\n\nSelected backend contract: '+definition.type+'.\n\n'+definition.guide.replace('invoice originals bucket','application data bucket')+'\n\n'+COMMON+'\nReference: '+definition.source+'\n'}};
+}
+
+const COMMON=`Staging/qualification default to local state only for isolated local validation.
+Production declares the provider-specific protected backend with no account names,
+endpoints or credentials embedded. The existing state store is a separate platform
+prerequisite, not an application resource. If the destination repository
+already has another reviewed backend, preserve it through an explicit state/owner
+decision and validate compatibility before any authorized migration.
+
+Keep backend.hcl private and excluded from source. Do not put authentication values
+in configuration or command arguments: Terraform can retain backend arguments in
+its local metadata and saved plans. State can contain provider-computed identity
+credentials even when runtime SQL/accounting secret payloads are supplied outside
+Terraform. Restrict readers, protect backups/plans, and review retention/key policy.
+Never disable TLS verification or use -lock=false to bypass an unavailable lock.
+
+Local-only checks: terraform init -backend=false, terraform validate, terraform test.
+Before authorized production planning, verify the existing protected state store
+on an isolated approved state: concurrent clients must conflict on one lock, an
+unrelated identity must not unlock it, and version recovery must preserve the
+expected digest. Record actual service version, access, custody and recovery proof.
+Then run terraform init -backend-config=backend.hcl through the approved credential
+chain. Platform/account access, store creation and migrations require authorization.
+
+Each deployment environment has a distinct physical resource-name seed. Use separate
+staging/production state paths and reviewed immutable image/account/policy inputs;
+never point production at staging state. Keep a verified private state backup before
+an authorized migration and inspect exact lineage. Do not -reconfigure/-migrate-state
+over a mismatched lineage. No external accounting service or actor is imported or
+recreated. Resource deletion protections do not prove backup, restore or availability.
+`;

package/src/public-faq-builder.mjs

@@ -0,0 +1,19 @@
+import {publicFaqFiles} from './public-faq.mjs';
+import {existingReferenceFiles} from './existing-references.mjs';
+export const v=n=>'${var.'+n+'}',ref=(type,n,key)=>'${'+type+'.'+n+'.'+key+'}';
+export const UUID='^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$';
+export function builder(project,plan,environment,provider){
+ if(!plan.publicFaqPlan?.entries.length||plan.publicFaqPlan.entries.some(e=>e.provider!==provider))throw Error('A public FAQ adapter must match every proposed application provider; no cross-cloud substitution.');
+ const variable={review_approved:{type:'bool',default:false}},examples={review_approved:false},resource={},output={},files={},data={},assertions=[];
+ const gaps=[...plan.gapDetails.map(g=>g.id),...(environment==='production'?['production-state-backup-and-operating-review-required']:[])];
+ resource.terraform_data={review_gate:{input:{design_revision:project.revision,environment},lifecycle:{precondition:[{condition:'${var.review_approved && length(local.unfinished_work) == 0}',error_message:'Review the source, public-only publication boundary, destination, native roles, model policy, costs and unresolved scope before deployment.'}]}}};
+ const input=(name,description,example,pattern)=>{variable[name]={type:'string',nullable:false,description,validation:{condition:pattern?'${can(regex('+JSON.stringify(pattern)+', var.'+name+'))}':'${length(trimspace(var.'+name+')) > 0}',error_message:'Supply the reviewed '+name+' value.'}};examples[name]=example;return v(name);};
+ const add=(type,name,body)=>((resource[type]||={})[name]={...body,depends_on:['terraform_data.review_gate',...(body.depends_on||[])]});
+ const source=row=>Object.assign(files,publicFaqFiles(provider,row.address));
+ function finish(config,lock,mock,guide){
+  const values=Object.entries({...examples,review_approved:true}).map(([name,value])=>name+' = '+JSON.stringify(value)).join('\n');
+  return {...files,...existingReferenceFiles(project),'.terraform.lock.hcl':lock,'main.tf.json':JSON.stringify({...config,variable,data,locals:{unfinished_work:gaps},resource,output},null,2),'resource-schedule.json':JSON.stringify(plan,null,2),'deployment.tfvars.json.example':JSON.stringify(examples,null,2),'.gitignore':'.terraform/\n*.tfstate*\n*.tfplan\n*.tfvars\n*.tfvars.json\n!deployment.tfvars.json.example\n.venv/\nbuild/\n*.zip\n__pycache__/\n','tests/public-faq.tftest.hcl':mock+'\nvariables {\n'+values+'\n}\n'+assertions.join('\n')+'\nrun "unapproved_blocked" {\n command = plan\n variables { review_approved = false }\n expect_failures = [terraform_data.review_gate]\n}\n','README.md':guide};
+ }
+ return {variable,examples,resource,output,files,data,assertions,input,add,source,finish};
+}
+

package/src/public-faq-clouds.mjs

@@ -0,0 +1,251 @@
+import {ibmRegistryHostExpression,ibmRegistryRegionValidation}from'./ibm-registry.mjs';
+import {azurePlanMocks} from './azure-plan-mocks.mjs';
+import {CLOUD_PROVIDER_LOCKS} from './cloud-provider-locks.mjs';
+export {awsPublicFaqTerraform} from './aws-public-faq.mjs';
+import {builder,v,ref,UUID} from './public-faq-builder.mjs';
+
+export function azurePublicFaqTerraform(project,plan,environment='staging'){
+ const b=builder(project,plan,environment,'azure'),{input,add}=b;
+ const subscription=input('subscription_id','Expected destination Azure subscription; operator credential chain only.','11111111-1111-1111-1111-111111111111',UUID);
+ const tenant=input('tenant_id','Expected destination tenant. Existing editor identity is preserved.','22222222-2222-2222-2222-222222222222',UUID);
+ const rg=input('resource_group_name','Existing reviewed resource group; not recreated or imported.','reviewed-applications','^[A-Za-z0-9_.()-]{1,90}$');
+ const registry=input('registry_name','Existing RBAC-mode ACR that accepts the ARM audience for managed identity.','reviewedregistry','^[a-z0-9]{5,50}$');
+ const registryRg=input('registry_resource_group_name','Existing registry resource group in this subscription.','reviewed-registry-rg','^[A-Za-z0-9_.()-]{1,90}$');
+ b.data.azurerm_client_config={destination:{}};
+ b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${data.azurerm_client_config.destination.subscription_id == var.subscription_id && data.azurerm_client_config.destination.tenant_id == var.tenant_id}',error_message:'Operator identity must match the reviewed tenant and subscription.'});
+ const registryId='/subscriptions/'+subscription+'/resourceGroups/'+registryRg+'/providers/Microsoft.ContainerRegistry/registries/'+registry;
+ for(const {row}of plan.publicFaqPlan.entries){
+  const n=row.address,name=input(n+'_name','Unique public application name; internal managed services belong to this composition.','reviewed-public-help','^[a-z][a-z0-9-]{3,18}[a-z0-9]$');
+  const region=input(n+'_region','Reviewed application, storage and Regional Standard model location. Verify actual model/version/quotas and processing geography.','australiaeast','^[a-z][a-z0-9]{2,39}$');
+  if(/^[a-z][a-z0-9]{2,39}$/.test(row.region)){b.variable[n+'_region'].default=row.region;b.examples[n+'_region']=row.region;}
+  const repository=input(n+'_repository','Build/publish path for this emitted application in the existing registry.','architect/public-help','^[a-z0-9]+(?:[._/-][a-z0-9]+)*$');
+  const digest=input(n+'_image_digest','Exact built, scanned, tested and authorized-published image digest.','sha256:'+'0'.repeat(64),'^sha256:[0-9a-f]{64}$');
+  const model=input(n+'_model_name','Reviewed regional model supporting strict JSON Schema output; no availability or price is invented.','REVIEW_MODEL');
+  const version=input(n+'_model_version','Exact supported model version; verify lifecycle and Standard regional availability.','REVIEW_VERSION');
+  const editor=input(n+'_editor_group_object_id','Existing Entra editor security-group object ID; no group/users are created. It receives only public-container data access.','33333333-3333-3333-3333-333333333333',UUID);
+  const tags={ManagedBy:'AtMem AI Architect',Environment:environment,Component:n};
+  add('azurerm_user_assigned_identity',n,{name:name+'-runtime',location:region,resource_group_name:rg,tags});
+  add('azurerm_service_plan',n,{name:name+'-plan',location:region,resource_group_name:rg,os_type:'Linux',sku_name:'B1',worker_count:1,tags});
+  add('azurerm_cognitive_account',n,{name:name+'-ai',location:region,resource_group_name:rg,kind:'OpenAI',sku_name:'S0',custom_subdomain_name:name+'-ai',local_auth_enabled:false,public_network_access_enabled:true,tags,lifecycle:{prevent_destroy:true}});
+  add('azurerm_cognitive_deployment',n,{name:'public-faq',cognitive_account_id:ref('azurerm_cognitive_account',n,'id'),version_upgrade_option:'NoAutoUpgrade',model:{format:'OpenAI',name:model,version},sku:{name:'Standard',capacity:1}});
+  const storage='${format("faq%s", substr(sha256(format("%s:%s", var.subscription_id, var.'+n+'_name)), 0, 20))}';
+  add('azurerm_storage_account',n,{name:storage,location:region,resource_group_name:rg,account_tier:'Standard',account_replication_type:'LRS',https_traffic_only_enabled:true,min_tls_version:'TLS1_2',allow_nested_items_to_be_public:false,shared_access_key_enabled:false,default_to_oauth_authentication:true,public_network_access_enabled:true,blob_properties:{versioning_enabled:true,delete_retention_policy:{days:7},container_delete_retention_policy:{days:7}},tags,lifecycle:{prevent_destroy:true}});
+  add('azurerm_storage_container',n,{name:'public-catalog',storage_account_id:ref('azurerm_storage_account',n,'id'),container_access_type:'private',lifecycle:{prevent_destroy:true}});
+  const principal=ref('azurerm_user_assigned_identity',n,'principal_id');
+  for(const [suffix,scope,role]of [['',ref('azurerm_cognitive_account',n,'id'),'Cognitive Services OpenAI User'],['_policy',ref('azurerm_cognitive_account',n,'id'),'Reader'],['_pull',registryId,'AcrPull'],['_catalog',ref('azurerm_storage_container',n,'id'),'Storage Blob Data Reader']])add('azurerm_role_assignment',n+suffix,{scope,role_definition_name:role,principal_id:principal,principal_type:'ServicePrincipal',skip_service_principal_aad_check:true});
+  add('azurerm_role_assignment',n+'_editor',{scope:ref('azurerm_storage_container',n,'id'),role_definition_name:'Storage Blob Data Contributor',principal_id:editor,principal_type:'Group'});
+  add('azurerm_linux_web_app',n,{name,location:region,resource_group_name:rg,service_plan_id:ref('azurerm_service_plan',n,'id'),https_only:true,ftp_publish_basic_authentication_enabled:false,webdeploy_publish_basic_authentication_enabled:false,identity:{type:'UserAssigned',identity_ids:[ref('azurerm_user_assigned_identity',n,'id')]},site_config:{always_on:true,minimum_tls_version:'1.2',scm_minimum_tls_version:'1.2',ftps_state:'Disabled',http2_enabled:true,remote_debugging_enabled:false,health_check_path:'/healthz',health_check_eviction_time_in_min:2,container_registry_use_managed_identity:true,container_registry_managed_identity_client_id:ref('azurerm_user_assigned_identity',n,'client_id'),application_stack:{docker_registry_url:'https://'+registry+'.azurecr.io',docker_image_name:repository+'@'+digest}},app_settings:{WEBSITES_PORT:'8080',MANAGED_IDENTITY_CLIENT_ID:ref('azurerm_user_assigned_identity',n,'client_id'),MODEL_RESOURCE_ID:ref('azurerm_cognitive_account',n,'id'),MODEL_ENDPOINT:ref('azurerm_cognitive_account',n,'endpoint'),MODEL_DEPLOYMENT:ref('azurerm_cognitive_deployment',n,'name'),MAX_OUTPUT_TOKENS:'1024',CATALOG_ACCOUNT:ref('azurerm_storage_account',n,'name'),CATALOG_CONTAINER:ref('azurerm_storage_container',n,'name')},tags,depends_on:['azurerm_role_assignment.'+n,'azurerm_role_assignment.'+n+'_policy','azurerm_role_assignment.'+n+'_pull','azurerm_role_assignment.'+n+'_catalog']});
+  b.output[n+'_url']={value:'https://'+ref('azurerm_linux_web_app',n,'default_hostname')+'/'};
+  b.output[n+'_catalog']={value:{storage_account:ref('azurerm_storage_account',n,'name'),container:ref('azurerm_storage_container',n,'name'),region}};
+  b.source(row);
+  b.assertions.push(`run "${n}_public_boundary" {\n command = plan\n assert {\n condition = azurerm_storage_container.${n}.container_access_type == "private" && !azurerm_storage_account.${n}.shared_access_key_enabled && !azurerm_storage_account.${n}.allow_nested_items_to_be_public\n error_message = "Public answers must not make the object store public or enable storage keys."\n }\n assert {\n condition = azurerm_role_assignment.${n}_catalog.role_definition_name == "Storage Blob Data Reader" && azurerm_role_assignment.${n}_editor.role_definition_name == "Storage Blob Data Contributor" && azurerm_role_assignment.${n}_catalog.principal_id != azurerm_role_assignment.${n}_editor.principal_id\n error_message = "Runtime read and authorized editor write identities must remain separate."\n }\n assert {\n condition = azurerm_linux_web_app.${n}.https_only && !azurerm_cognitive_account.${n}.local_auth_enabled\n error_message = "TLS and workload identity are required."\n }\n}\nrun "${n}_mutable_image_blocked" {\n command = plan\n variables { ${n}_image_digest = "latest" }\n expect_failures = [var.${n}_image_digest]\n}`);
+ }
+ const config={terraform:{required_version:'>= 1.17.1, < 2.0.0',required_providers:{azurerm:{source:'hashicorp/azurerm',version:'4.81.0'}}},provider:{azurerm:{subscription_id:subscription,tenant_id:tenant,features:{},storage_use_azuread:true}}};
+ return b.finish(config,CLOUD_PROVIDER_LOCKS.azure,azurePlanMocks({subscription:b.examples.subscription_id,tenant:b.examples.tenant_id,resourceGroup:b.examples.resource_group_name,addresses:plan.publicFaqPlan.entries.map(e=>e.row.address)}),AZURE_PUBLIC_FAQ_GUIDE);
+}
+
+export const AZURE_PUBLIC_FAQ_GUIDE=`# Azure public-only FAQ composition
+
+The generated Python browser/API is intentionally anonymous. Its dedicated managed
+identity can read only this private public-article container and invoke/read policy
+on its generated regional model account. A separate existing Entra editor group
+receives container-scoped data contributor access. No application HTTP endpoint
+edits articles. No users/groups, existing resource group or ACR are recreated.
+This is not a private enterprise knowledge assistant or existing-SSO integration.
+
+Shared storage keys and anonymous blob access are disabled; the Azure provider
+uses Entra for storage access. App Service basic publishing/debug/FTP are disabled;
+the application uses managed identity for image pulls. Verify the existing registry
+uses standard RBAC and accepts the ARM audience. No registry credential or model
+key is exported. Public TLS endpoints use IAM/RBAC; private networking is not
+implemented. Review inherited permissions and current tenant/subscription context.
+
+See applications/*/BUILD.md for exact source/test/build and conditional editor CLI
+steps. Protect Terraform state and variables. Seed only genuinely public articles
+with the authorized editor before admitting traffic; a missing/inaccessible source
+does not become an empty catalog or a cached answer. Blob versions and seven-day
+soft deletion are recovery features, not an immediate erasure guarantee. Review
+recovery and costs. Anonymous access plus concurrency/instance/output limits is
+not an invoice cap; approve and test destination abuse controls and budget policy.
+
+Choose a compatible regional Standard structured-output model/version and verify
+actual quotas, prices and geography. Runtime requires approved ContentLogging=false
+before inference and never writes that account-wide setting. Provider/platform
+logging and identity/control-plane processing require separate review. No app
+question/answer persistence or content-bearing application logs are implemented.
+Real model answer/citation/abstention and latency tests remain required.
+
+Use Terraform 1.17.1+, terraform init -backend=false, terraform validate and
+terraform test. These mock checks do not prove real Azure IAM, managed identity,
+storage conditionals or model quality. Obtain explicit authorization for registry
+publication, cloud access, a real account plan and deployment. Production state,
+backup and operating review remain gated; no export proves deployment.
+`;
+
+export function gcpPublicFaqTerraform(project,plan,environment='staging'){
+ const b=builder(project,plan,environment,'gcp'),{input,add}=b;
+ const projectId=input('project_id','Existing reviewed Google project with billing; no project is recreated.','reviewed-project','^[a-z][a-z0-9-]{4,28}[a-z0-9]$');
+ const registryLocation=input('registry_location','Location of the existing Artifact Registry Docker repository.','australia-southeast1','^[a-z]+(?:-[a-z]+[0-9])?$');
+ const registry=input('registry_repository','Existing Docker repository in this project; preserved.','reviewed-images','^[a-z][a-z0-9-]{1,61}[a-z0-9]$');
+ b.data.google_project={destination:{project_id:projectId}};
+ for(const [name,service]of Object.entries({run:'run.googleapis.com',model:'aiplatform.googleapis.com',storage:'storage.googleapis.com',registry:'artifactregistry.googleapis.com'}))add('google_project_service','required_'+name,{project:projectId,service,disable_on_destroy:false});
+ add('google_project_service_identity','run',{provider:'google-beta',project:projectId,service:'run.googleapis.com',depends_on:['google_project_service.required_run']});
+ add('google_artifact_registry_repository_iam_member','image_pull',{project:projectId,location:registryLocation,repository:registry,role:'roles/artifactregistry.reader',member:ref('google_project_service_identity','run','member'),depends_on:['google_project_service.required_registry']});
+ const number='${data.google_project.destination.number}';
+ for(const {row}of plan.publicFaqPlan.entries){
+  const n=row.address,name=input(n+'_name','Unique short Cloud Run/runtime name. The generated deterministic URL is used for this public browser.','reviewed-public-help','^[a-z][a-z0-9-]{3,18}[a-z0-9]$');
+  const region=input(n+'_region','Reviewed single-region application, catalog and model location; no global model fallback.','australia-southeast1','^[a-z]+-[a-z]+[0-9]$');
+  if(/^[a-z]+-[a-z]+[0-9]$/.test(row.region)){b.variable[n+'_region'].default=row.region;b.examples[n+'_region']=row.region;}
+  const repository=input(n+'_image_repository','Path for the emitted image in the existing registry.','architect/public-help','^[a-z0-9]+(?:[._/-][a-z0-9]+)*$');
+  const digest=input(n+'_image_digest','Built, scanned, tested and authorized-published emitted image digest.','sha256:'+'0'.repeat(64),'^sha256:[0-9a-f]{64}$');
+  const model=input(n+'_model_id','Compatible reviewed regional Gemini model/version with structured JSON output; verify lifecycle, quota, context size and prices.','gemini-reviewed-version','^gemini-[a-z0-9.-]{1,80}$');
+  const editor=input(n+'_editor_group','Existing authorized Google editor group email. No users/groups are created.','help-editors@example.test','^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$');
+  const review=n+'_policy_review';b.variable[review]={type:'object({ projectId = string, region = string, model = string, abuseLogging = string, approvedBy = string, evidenceSha256 = string, expiresAt = string })',nullable:false,description:'Scoped expiring destination-owner review of actual abuse-monitoring terms/exemption. Operator attestation, not a fabricated approval API; runtime separately reads caching/model logging/sharing settings.'};b.examples[review]={projectId:'reviewed-project',region:b.examples[n+'_region'],model:'gemini-reviewed-version',abuseLogging:'REVIEW_REQUIRED',approvedBy:'REVIEW_REQUIRED',evidenceSha256:'0'.repeat(64),expiresAt:'REPLACE_AFTER_REVIEW'};
+  add('google_service_account',n,{project:projectId,account_id:name,display_name:'Public FAQ runtime; no catalog edit permission'});
+  const member='serviceAccount:'+ref('google_service_account',n,'email');
+  add('google_project_iam_custom_role',n,{project:projectId,role_id:'${replace(var.'+n+'_name, "-", "_")}_model',title:'FAQ model invocation and read-only policy',permissions:['aiplatform.endpoints.predict','aiplatform.cacheConfigs.get','aiplatform.endpoints.fetchPublisherModelConfig'],stage:'GA'});
+  add('google_project_iam_member',n,{project:projectId,role:ref('google_project_iam_custom_role',n,'name'),member,depends_on:['google_project_service.required_model']});
+  add('google_storage_bucket',n,{project:projectId,name:projectId+'-'+name+'-public',location:region,storage_class:'STANDARD',uniform_bucket_level_access:true,public_access_prevention:'enforced',force_destroy:false,versioning:{enabled:true},soft_delete_policy:{retention_duration_seconds:604800},lifecycle_rule:{action:{type:'Delete'},condition:{days_since_noncurrent_time:7}},lifecycle:{prevent_destroy:true},depends_on:['google_project_service.required_storage']});
+  for(const [suffix,permissions]of [['_catalog',['storage.objects.get']],['_editor',['storage.objects.get','storage.objects.create','storage.objects.delete']]])add('google_project_iam_custom_role',n+suffix,{project:projectId,role_id:'${replace(var.'+n+'_name, "-", "_")}'+suffix,title:suffix==='_catalog'?'FAQ current catalog reader':'FAQ conditional catalog editor',permissions,stage:'GA'});
+  add('google_storage_bucket_iam_member',n,{bucket:ref('google_storage_bucket',n,'name'),role:ref('google_project_iam_custom_role',n+'_catalog','name'),member});
+  add('google_storage_bucket_iam_member',n+'_editor',{bucket:ref('google_storage_bucket',n,'name'),role:ref('google_project_iam_custom_role',n+'_editor','name'),member:'group:'+editor});
+  const origin='https://'+name+'-'+number+'.'+region+'.run.app',settings={PROJECT_ID:projectId,REGION:region,MODEL_ID:model,PUBLIC_ORIGIN:origin,MAX_OUTPUT_TOKENS:'1024',CATALOG_BUCKET:ref('google_storage_bucket',n,'name'),POLICY_REVIEW_BASE64:'${base64encode(jsonencode(var.'+review+'))}'};
+  add('google_cloud_run_v2_service',n,{project:projectId,name,location:region,deletion_protection:true,ingress:'INGRESS_TRAFFIC_ALL',invoker_iam_disabled:false,iap_enabled:false,labels:{managed_by:'atmem-ai-architect',environment},template:{service_account:ref('google_service_account',n,'email'),timeout:'30s',max_instance_request_concurrency:5,scaling:{min_instance_count:0,max_instance_count:2},containers:{name:'application',image:registryLocation+'-docker.pkg.dev/'+projectId+'/'+registry+'/'+repository+'@'+digest,ports:{container_port:8080},resources:{limits:{cpu:'1',memory:'512Mi'},cpu_idle:true,startup_cpu_boost:true},env:Object.entries(settings).map(([name,value])=>({name,value})),startup_probe:{http_get:{path:'/healthz',port:8080},initial_delay_seconds:0,period_seconds:5,timeout_seconds:2,failure_threshold:12}}},depends_on:['google_project_service.required_run','google_project_service_identity.run','google_artifact_registry_repository_iam_member.image_pull','google_project_iam_member.'+n,'google_storage_bucket_iam_member.'+n]});
+  // Anonymous invocation is intentional for this public-only application, never
+  // applied to a private module or the bucket itself. Org policy must allow it.
+  add('google_cloud_run_v2_service_iam_member',n,{project:projectId,location:region,name:ref('google_cloud_run_v2_service',n,'name'),role:'roles/run.invoker',member:'allUsers'});
+  b.output[n+'_url']={value:origin};b.output[n+'_catalog']={value:{bucket:ref('google_storage_bucket',n,'name'),region}};b.source(row);
+  b.assertions.push(`run "${n}_public_boundary" {\n command = plan\n assert {\n condition = google_storage_bucket.${n}.public_access_prevention == "enforced" && google_storage_bucket.${n}.uniform_bucket_level_access && !google_storage_bucket.${n}.force_destroy\n error_message = "Only the app is public; the catalog bucket stays private and protected."\n }\n assert {\n condition = google_cloud_run_v2_service_iam_member.${n}.member == "allUsers" && google_cloud_run_v2_service_iam_member.${n}.role == "roles/run.invoker" && !google_cloud_run_v2_service.${n}.iap_enabled\n error_message = "This explicit public-only application has anonymous invocation, not an invented end-user identity."\n }\n assert {\n condition = toset(google_project_iam_custom_role.${n}_catalog.permissions) == toset(["storage.objects.get"]) && google_storage_bucket_iam_member.${n}_editor.member == "group:\${var.${n}_editor_group}"\n error_message = "Runtime read and native editor write authority must remain separate."\n }\n}\nrun "${n}_mutable_image_blocked" {\n command = plan\n variables { ${n}_image_digest = "latest" }\n expect_failures = [var.${n}_image_digest]\n}`);
+ }
+ const config={terraform:{required_version:'>= 1.17.1, < 2.0.0',required_providers:{google:{source:'hashicorp/google',version:'7.46.2'},'google-beta':{source:'hashicorp/google-beta',version:'7.46.2'}}},provider:{google:{project:projectId},'google-beta':{project:projectId}}};
+ return b.finish(config,CLOUD_PROVIDER_LOCKS.gcp+'\n'+CLOUD_PROVIDER_LOCKS.gcpBeta,'mock_provider "google" {\n override_during = plan\n mock_data "google_project" { defaults = { number = "123456789012" } }\n mock_resource "google_service_account" { defaults = { email = "runtime@reviewed-project.iam.gserviceaccount.com" } }\n}\nmock_provider "google-beta" {\n override_during = plan\n mock_resource "google_project_service_identity" { defaults = { email = "service-123456789012@serverless-robot-prod.iam.gserviceaccount.com", member = "serviceAccount:service-123456789012@serverless-robot-prod.iam.gserviceaccount.com" } }\n}\n',GCP_PUBLIC_FAQ_GUIDE);
+}
+
+export const GCP_PUBLIC_FAQ_GUIDE=`# Google public-only FAQ composition
+
+Only this explicitly selected public Cloud Run browser/API receives anonymous
+run.invoker access. Its catalog bucket remains private with public access
+prevention and uniform IAM. The dedicated runtime has a bucket-scoped custom
+object-reader role; a separate existing company editor group has get/create/delete
+only on that public catalog bucket. There is no HTTP editing route. No private
+source, arbitrary URL fetch, user identity or enterprise authorization is implied.
+
+Existing project, registry and editor group are preserved. Required APIs are never
+disabled on destroy. The Cloud Run platform agent, not the application, receives
+reader access on the exact existing image repository. The runtime has narrow
+project-level prediction and read-only cache/model-policy access; no policy writes
+or user-managed key is emitted. Google-beta is used only for the documented service
+identity resource. Reconcile inherited IAM and organization restrictions on public
+invocation; do not disable organization policy to bypass a failure.
+
+See applications/*/BUILD.md. Seed genuinely public articles using the authorized
+editor and native generation preconditions; updates/deletes never fall back to
+stale or inaccessible evidence. Versioning, noncurrent-version expiry and seven-day
+soft deletion support recovery and are not an immediate erasure guarantee. Runtime
+never retrieves a historical generation selected by a visitor. No question/answer
+persistence or content-bearing app logs are implemented; review platform logging.
+
+The owner policy review is scoped/expiring operator-attested evidence, not an IBM,
+Google or other fabricated provider approval API. Runtime separately requires
+disabled project caching and disabled model request/response logging/sharing.
+The documented global cache-control read sends no question text; review that
+control-plane processing and actual model geography/terms against residency needs.
+Model availability/context/quotas, prices, anonymous abuse controls, budgets and
+real answer/citation/abstention/latency tests remain destination checks. Concurrency,
+token and instance bounds are not an invoice cap or SLA.
+
+Use Terraform 1.17.1+; run init -backend=false, validate and test. These native schema
+and mock plans do not establish actual IAM, model or deployed behavior. Build, scan
+and test the exact source/image; obtain authorization before publishing, cloud
+access, real account plan or deployment. Production state/operations remain gated.
+`;
+
+export function ibmPublicFaqTerraform(project,plan,environment='staging'){
+ const b=builder(project,plan,environment,'ibm'),{input,add}=b;
+ const account=input('account_id','Existing destination IBM account; no account is created.','a'.repeat(32),'^[0-9a-f]{32}$');
+ const region=input('region','Reviewed regional Code Engine, COS and watsonx model destination.','au-syd','^[a-z]{2}-[a-z]+$');
+ const entries=plan.publicFaqPlan.entries;
+ if(entries.every(e=>e.row.region===entries[0].row.region)&&/^[a-z]{2}-[a-z]+$/.test(entries[0].row.region)){b.variable.region.default=entries[0].row.region;b.examples.region=entries[0].row.region;}
+ b.variable.region.validation=ibmRegistryRegionValidation();
+ const ceProject=input('code_engine_project_id','Existing reviewed Code Engine project; never recreate or import it.','11111111-1111-1111-1111-111111111111',UUID);
+ const registry=input('registry_namespace','Existing regional IBM Container Registry namespace.','reviewed-namespace','^[a-z0-9]+(?:[-_][a-z0-9]+)*$');
+ const pullSecret=input('registry_pull_secret','Existing registry-pull secret NAME in that project; no credential value is exported.','reviewed-registry-pull','^[a-z][a-z0-9-]{1,61}[a-z0-9]$');
+ b.data.ibm_code_engine_project={destination:{project_id:ceProject}};
+ b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${data.ibm_code_engine_project.destination.account_id == var.account_id && data.ibm_code_engine_project.destination.region == var.region}',error_message:'Existing Code Engine project must match the reviewed account and region.'});
+ for(const {row}of entries){
+  const n=row.address,name=input(n+'_name','Unique application and trusted-profile name.','reviewed-public-help','^[a-z][a-z0-9-]{2,38}[a-z0-9]$');
+  const repository=input(n+'_image_repository','Path for this emitted image in the existing namespace.','architect/public-help','^[a-z0-9]+(?:[._/-][a-z0-9]+)*$');
+  const digest=input(n+'_image_digest','Built, scanned, tested and authorized-published image digest.','sha256:'+'0'.repeat(64),'^sha256:[0-9a-f]{64}$');
+  const wxProject=input(n+'_watsonx_project_id','Existing watsonx data-platform project. Add the trusted profile as an authorized collaborator and associate the runtime instance.','22222222-2222-2222-2222-222222222222',UUID);
+  const instance=input(n+'_runtime_instance_id','Existing associated watsonx Runtime instance GUID.','33333333-3333-3333-3333-333333333333',UUID);
+  const model=input(n+'_model_id','Reviewed regional Text Chat JSON-object model; verify lifecycle, quotas and geography.','ibm/reviewed-model','^[a-z0-9][a-z0-9_.-]{0,79}/[a-z0-9][a-z0-9_.-]{0,99}$');
+  const editor=input(n+'_editor_access_group_id','Existing authorized company editor access-group ID. No group or user is created.','AccessGroup-44444444-4444-4444-4444-444444444444','^AccessGroup-[0-9a-fA-F-]{36}$');
+  const bucket=input(n+'_catalog_bucket','Globally unique regional bucket dedicated to genuinely public article content; the bucket itself remains private.','reviewed-public-catalog-unique','^[a-z][a-z0-9-]{1,61}[a-z0-9]$');
+  const review=n+'_policy_review';b.variable[review]={type:'object({ accountId = string, projectId = string, runtimeInstanceId = string, region = string, model = string, retentionReview = string, approvedBy = string, evidenceSha256 = string, expiresAt = string })',nullable:false,description:'Scoped expiring destination-owner review of actual model/provider retention and processing terms. Operator-attested evidence, not a provider approval API.'};b.examples[review]={accountId:b.examples.account_id,projectId:b.examples[n+'_watsonx_project_id'],runtimeInstanceId:b.examples[n+'_runtime_instance_id'],region:b.examples.region,model:b.examples[n+'_model_id'],retentionReview:'REVIEW_REQUIRED',approvedBy:'REVIEW_REQUIRED',evidenceSha256:'0'.repeat(64),expiresAt:'REPLACE_AFTER_REVIEW'};
+  add('ibm_resource_instance',n+'_catalog',{name:name+'-public-catalog',service:'cloud-object-storage',plan:'standard',location:'global',resource_group_id:'${data.ibm_code_engine_project.destination.resource_group_id}',lifecycle:{prevent_destroy:true,postcondition:[{condition:'${self.account_id == var.account_id}',error_message:'Catalog instance must belong to the reviewed account.'}]}});
+  add('ibm_cos_bucket',n,{bucket_name:bucket,resource_instance_id:ref('ibm_resource_instance',n+'_catalog','id'),region_location:region,storage_class:'standard',endpoint_type:'public',force_delete:false,object_versioning:{enable:true},noncurrent_version_expiration:{enable:true,noncurrent_days:7,prefix:'',rule_id:'expire-old-catalog-versions'},lifecycle:{prevent_destroy:true}});
+  add('ibm_iam_trusted_profile',n,{name,description:'Public FAQ compute identity; no catalog write or end-user authority'});
+  add('ibm_iam_trusted_profile_link',n,{profile_id:ref('ibm_iam_trusted_profile',n,'profile_id'),cr_type:'CE',link:{crn:'${data.ibm_code_engine_project.destination.crn}',component_name:ref('ibm_code_engine_app',n,'name'),component_type:'app'}});
+  add('ibm_iam_trusted_profile_policy',n,{iam_id:ref('ibm_iam_trusted_profile',n,'iam_id'),roles:['Writer'],resources:{service:'pm-20',resource_instance_id:instance,region},description:'Existing watsonx runtime-instance scope. Writer is broader than prediction-only; project membership remains separate.'});
+  const catalogScope={service:'cloud-object-storage',resource_instance_id:ref('ibm_resource_instance',n+'_catalog','guid'),resource_type:'bucket',resource:ref('ibm_cos_bucket',n,'bucket_name')};
+  add('ibm_iam_trusted_profile_policy',n+'_catalog',{iam_id:ref('ibm_iam_trusted_profile',n,'iam_id'),roles:['Object Reader'],resources:catalogScope});
+  // Article deletion rewrites catalog.json; object DELETE is intentionally absent.
+  // Object Writer includes object metadata/retention writes; it is not a custom
+  // put-only role. It cannot administer this bucket or grant public access.
+  add('ibm_iam_access_group_policy',n+'_editor',{access_group_id:editor,roles:['Object Reader','Object Writer'],resources:catalogScope});
+  const settings={ACCOUNT_ID:account,WATSONX_PROJECT_ID:wxProject,RUNTIME_INSTANCE_ID:instance,MODEL_REGION:region,MODEL_ID:model,IAM_PROFILE_ID:ref('ibm_iam_trusted_profile',n,'profile_id'),MAX_OUTPUT_TOKENS:'1024',CATALOG_BUCKET:ref('ibm_cos_bucket',n,'bucket_name'),POLICY_REVIEW_BASE64:'${base64encode(jsonencode(var.'+review+'))}'};
+  add('ibm_code_engine_app',n,{project_id:ceProject,name,image_reference:ibmRegistryHostExpression()+'/'+registry+'/'+repository+'@'+digest,image_secret:pullSecret,image_port:8080,managed_domain_mappings:'local_public',run_as_user:10001,run_compute_resource_token_enabled:true,scale_cpu_limit:'0.5',scale_memory_limit:'1G',scale_min_instances:0,scale_max_instances:2,scale_concurrency:5,scale_concurrency_target:5,scale_request_timeout:30,run_env_variables:Object.entries(settings).map(([name,value])=>({name,value,type:'literal'})),probe_readiness:{type:'http',path:'/healthz',port:8080,initial_delay:2,interval:5,timeout:2,failure_threshold:12},depends_on:['ibm_iam_trusted_profile_policy.'+n,'ibm_iam_trusted_profile_policy.'+n+'_catalog']});
+  b.assertions.push(`run "${n}_sydney_registry" {\n command = plan\n assert {\n condition = var.region != "au-syd" || startswith(ibm_code_engine_app.${n}.image_reference,"au.icr.io/")\n error_message = "Sydney uses au.icr.io; region concatenation cannot select a valid registry."\n }\n}`);
+  b.output[n+'_url']={value:ref('ibm_code_engine_app',n,'endpoint')};b.output[n+'_catalog']={value:{bucket,region}};b.output[n+'_trusted_profile_iam_id']={value:ref('ibm_iam_trusted_profile',n,'iam_id')};b.source(row);
+  b.assertions.push(`run "${n}_public_boundary" {\n command = plan\n assert {\n condition = ibm_iam_trusted_profile_policy.${n}_catalog.roles == tolist(["Object Reader"]) && ibm_iam_trusted_profile_policy.${n}_catalog.resources[0].resource_type == "bucket" && ibm_iam_trusted_profile_policy.${n}_catalog.resources[0].resource == var.${n}_catalog_bucket\n error_message = "Runtime may read only the dedicated catalog bucket; no write or public-access grant."\n }\n assert {\n condition = toset(ibm_iam_access_group_policy.${n}_editor.roles) == toset(["Object Reader", "Object Writer"]) && ibm_iam_access_group_policy.${n}_editor.resources[0].resource_type == "bucket" && ibm_iam_access_group_policy.${n}_editor.access_group_id == var.${n}_editor_access_group_id\n error_message = "Separate existing editors have bucket-scoped object access, never Manager or bucket Writer."\n }\n assert {\n condition = !ibm_cos_bucket.${n}.force_delete && ibm_cos_bucket.${n}.object_versioning[0].enable && ibm_code_engine_app.${n}.run_compute_resource_token_enabled && ibm_code_engine_app.${n}.run_as_user == 10001\n error_message = "Protect catalog recovery and use nonroot keyless compute identity."\n }\n}\nrun "${n}_mutable_image_blocked" {\n command = plan\n variables { ${n}_image_digest = "latest" }\n expect_failures = [var.${n}_image_digest]\n}`);
+ }
+ const config={terraform:{required_version:'>= 1.17.1, < 2.0.0',required_providers:{ibm:{source:'IBM-Cloud/ibm',version:'1.89.0'}}},provider:{ibm:{region}}};
+ const mocks=`mock_provider "ibm" {\n override_during = plan\n mock_data "ibm_code_engine_project" { defaults = { account_id = "${b.examples.account_id}", region = "${b.examples.region}", resource_group_id = "${'b'.repeat(32)}", crn = "crn:v1:bluemix:public:codeengine:${b.examples.region}:a/${b.examples.account_id}:11111111-1111-1111-1111-111111111111::" } }\n mock_resource "ibm_resource_instance" { defaults = { account_id = "${b.examples.account_id}", id = "crn:v1:bluemix:public:cloud-object-storage:global:a/${b.examples.account_id}:55555555-5555-5555-5555-555555555555::", guid = "55555555-5555-5555-5555-555555555555" } }\n}\n`;
+ b.assertions.push(`run "wrong_account_blocked" {\n command = plan\n variables { account_id = "${'c'.repeat(32)}" }\n expect_failures = [terraform_data.review_gate]\n}`);
+ return b.finish(config,CLOUD_PROVIDER_LOCKS.ibm,mocks,IBM_PUBLIC_FAQ_GUIDE);
+}
+
+export const IBM_PUBLIC_FAQ_GUIDE=`# IBM public-only FAQ composition
+
+The anonymous browser/API uses a dedicated Code Engine trusted profile linked only
+to this existing project and this new app. The runtime receives Object Reader on
+the exact private COS bucket; a separate existing company access group receives
+Object Reader and Object Writer on that bucket. Object Writer includes object
+metadata and retention operations, not merely PUT; it does not administer buckets
+or make them public. Article deletion conditionally replaces catalog.json; no
+object DELETE grant or application HTTP editing route is needed. No public-access
+group policy is emitted. Reconcile inherited account/group policies, which can
+override narrower grants. Public endpoint routing does not mean anonymous storage.
+
+COS uses a global service instance with a single regional data bucket, encryption
+at rest managed by IBM and TLS. Control-plane geography requires separate review.
+Versioning and seven-day noncurrent expiry aid recovery, not immediate erasure.
+The runtime reads only the current catalog, checks it again before returning an
+answer and withholds stale/unsupported evidence. Questions/answers are not persisted
+or written to application logs. Private networking/customer-managed keys are not
+implemented. This public-only application is not a private knowledge assistant.
+
+Existing Code Engine project, namespace/pull-secret, watsonx project and associated
+runtime instance remain intact. The profile gets Writer on that exact pm-20
+instance; this is broader than prediction-only. Add the generated profile as a
+minimum supported project collaborator and verify the association/model separately.
+App creation precedes its compute link to avoid a Terraform cycle; health is
+liveness, not model readiness. No app API key or end-user identity is invented.
+
+See applications/*/BUILD.md for editor/build/testing commands. Supply a scoped,
+expiring destination-owner policy review and test real IAM, compute token exchange,
+conditional storage edits, source updates/deletions, model citations/abstention and
+latency. The policy review is operator evidence, not a fabricated provider API.
+Review current model availability, quotas, processing terms, prices, anonymous
+abuse controls and budget policy. Instance/concurrency/token limits are not an
+invoice cap. Protect state/variables. Native schema/mocks and local runtime tests
+do not establish account-plan or deployed behavior. Obtain authorization before
+image publication, cloud access, real plans or deployment; production operating
+and state/backup review remain gated.
+
+References:
+- https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam-bucket-permissions
+- https://cloud.ibm.com/docs/iam?topic=iam-iam-service-roles-actions
+- https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-upload
+- https://cloud.ibm.com/docs/codeengine?topic=codeengine-trusted-profiles-authentication-file
+`;

package/src/public-faq.mjs

@@ -0,0 +1,122 @@
+import outputSchema from './runtime/faq-output-contract.json' with {type:'json'};
+import sources from './runtime/public-faq-sources.json' with {type:'json'};
+import awsLock from './runtime/aws-web-python-lock.json' with {type:'json'};
+import azureLock from './runtime/azure-python-lock.json' with {type:'json'};
+import webLock from './runtime/web-python-lock.json' with {type:'json'};
+import ibmLock from './runtime/ibm-python-lock.json' with {type:'json'};
+import testLock from './runtime/azure-test-lock.json' with {type:'json'};
+import base from './runtime/python-container-lock.json' with {type:'json'};
+import {pythonContainer} from './python-container.mjs';
+import {existingDeployment} from './deployment-ownership.mjs';
+
+export const PUBLIC_FAQ_SERVICES={aws:'AWS Lambda',azure:'Azure App Service',gcp:'Google Cloud Run',ibm:'IBM Code Engine'};
+const locks={aws:awsLock,azure:azureLock,gcp:webLock,ibm:ibmLock};
+const adapters={aws:['aws_json_model.py','lambda_faq.py'],azure:['azure_structured.py'],gcp:['gcp_structured.py','policy_review.py'],ibm:['ibm_structured.py','policy_review.py']};
+
+export function publicFaqPlan(project,rows){
+ const entries=[];
+ for(const node of project.nodes){
+  const d=node.data,row=rows.find(r=>r.id===node.id);
+  if(!row||d.implementation!=='public-faq-app'||d.service!==PUBLIC_FAQ_SERVICES[d.provider]||existingDeployment(node)||d.origin==='existing')continue;
+  if(d.config?.outputContract)throw Error('Public FAQ uses its built-in cited-answer contract; preserve custom operation requirements as separate implementation work.');
+  for(const [key,value]of Object.entries({maxInputBytes:2000,maxArticleBytes:30000,maxArticles:100}))if(d.config?.[key]!==undefined&&d.config[key]!==value)throw Error('The public FAQ recipe declares '+key+' = '+value+'; a different explicit limit requires generator implementation, not silent substitution.');
+  entries.push({row,provider:d.provider});
+ }
+ const ids=new Set(entries.map(e=>e.row.id)),browsers=new Set(project.nodes.filter(n=>existingDeployment(n)&&n.data.provider==='tools'&&n.data.binding==='web-browser').map(n=>n.id));
+ const editors=new Set(project.nodes.filter(n=>existingDeployment(n)&&n.data.provider==='tools'&&n.data.binding==='public-catalog-editor').map(n=>n.id));
+ const editorEdges=project.edges.filter(e=>e.integration==='public-catalog-edit'&&editors.has(e.source)&&ids.has(e.target));
+ return {entries,componentIds:[...ids],editorIds:[...new Set(editorEdges.map(e=>e.source))],edgeIds:[...project.edges.filter(e=>e.integration==='browser-https'&&browsers.has(e.source)&&ids.has(e.target)),...editorEdges].map(e=>e.id)};
+}
+
+// This emits source, not a coverage claim. Public registration requires each
+// provider's complete hosting/storage/identity composition and qualification.
+export function publicFaqFiles(provider,address){
+ if(!adapters[provider]||!/^block_[0-9a-f]+$/.test(address))throw Error('Invalid owned public FAQ application address/provider');
+ const folder='applications/'+address+'/',files={},modules=['public_faq.py','public_catalog_store.py','public_faq_app.py','structured_http.py','structured_output.py',...adapters[provider]];
+ for(const name of [...modules,'public_catalog_admin.py'])files[folder+name]=sources[name];
+ for(const name of ['web/index.html','web/app.css','web/app.js'])files[folder+name]=sources[name];
+ for(const kind of ['core','http','catalog_admin','catalog_store']){
+  const name='faq_'+kind+'_acceptance.py';let code=sources[name];
+  if(kind==='catalog_store'&&provider!=='aws'){
+   const start=code.indexOf('class S3CatalogContractTests('),end=code.indexOf('class ConditionalConcurrencyTests(');
+   if(start<0||end<=start)throw Error('Provider-specific test boundary changed; review it before emission');
+   code=code.slice(0,start)+code.slice(end);
+   code=code.replace(/^import boto3\n/m,'').replace(/^from botocore\.[^\n]+\n/gm,'');
+  }
+  files[folder+name]=code;
+ }
+ if(provider==='aws')files[folder+'faq_lambda_acceptance.py']=sources['faq_lambda_acceptance.py'];
+ files[folder+'faq_acceptance.py']='"""Local public-only lifecycle/HTTP/transport checks; not cloud IAM or model quality."""\nfrom faq_core_acceptance import PublicFaqCoreTests\nfrom faq_http_acceptance import PublicFaqHttpTests\nfrom faq_catalog_admin_acceptance import CatalogAdminTests\nfrom faq_catalog_store_acceptance import HttpCatalogContractTests,ConditionalConcurrencyTests'+(provider==='aws'?',S3CatalogContractTests':'')+(provider==='aws'?'\nfrom faq_lambda_acceptance import PublicFaqLambdaTests':'')+'\nimport unittest\nif __name__=="__main__":unittest.main()\n';
+ const lock=locks[provider];files[folder+'requirements.lock']=lock.requirements;files[folder+'dependency-sources.json']=JSON.stringify(lock.sources,null,2);
+ files[folder+'test-requirements.lock']=testLock.requirements;files[folder+'test-dependency-sources.json']=JSON.stringify(testLock.sources,null,2);
+ files[folder+'container-base.json']=JSON.stringify(base,null,2);
+ files[folder+'output-contract.json']=JSON.stringify(outputSchema,null,2);
+ files[folder+'faq-deployment.json']=JSON.stringify({format:'public-faq-v1',provider},null,2);
+ files[folder+'Dockerfile']=pythonContainer('public_faq_app',modules,['faq-deployment.json']);
+ files[folder+'.dockerignore']='*\n!requirements.lock\n!output-contract.json\n!faq-deployment.json\n'+modules.map(n=>'!'+n+'\n').join('')+'!web/\n!web/*\n';
+ files[folder+'BUILD.md']=provider==='aws'?PUBLIC_FAQ_BUILD.replace(/Build this directory as Linux\/amd64[\s\S]*?host applies identical filesystem isolation[.]\n/, 'For AWS deployment, run python3 build-runtime.py from the Terraform root. This builds a deterministic Python 3.13 Linux x86_64 Lambda ZIP with hash-locked wheels, source, owned metadata and browser assets. Retain build/artifact-hashes.json. Test the actual ZIP in the reviewed Lambda Linux runtime and scan its dependencies. The Dockerfile is an optional portable local web-runtime check; it is not the Lambda deployment artifact. No registry publication or image input is required. Obtain explicit cloud authorization before any account plan or deployment.\n'):PUBLIC_FAQ_BUILD;
+ return files;
+}
+
+export const PUBLIC_FAQ_BUILD=`# Generated public FAQ application
+
+Use an isolated Python 3.13 environment. Install test-requirements.lock with
+--only-binary=:all: --require-hashes, then run faq_acceptance.py -v. The source
+tests use synthetic public articles and explicit transport fixtures. They do not
+establish real IAM, model quality, service availability or deployment behavior.
+
+Build this directory as Linux/amd64 with its emitted Dockerfile, run startup and
+acceptance checks on the exact image, scan it and retain source/image digests.
+Obtain authorization before authenticating to a registry or publishing an image.
+Supply the reviewed immutable release inputs required by this provider's Terraform.
+The runtime runs nonroot; use a read-only filesystem and writable temporary space
+where the destination supports it. Local read-only checks do not prove the cloud
+host applies identical filesystem isolation.
+
+The anonymous API can only read the dedicated public catalog and invoke the
+reviewed regional model. It has no HTTP editing endpoint. Never grant the runtime
+catalog write, private-source, account-admin or model-policy-write permissions.
+Review inherited destination IAM in addition to the emitted grants. An explicit
+public marker does not automatically classify or approve document content: the
+authorized editor is responsible for selecting genuinely public help articles.
+
+Authorize the separate editor using the emitted native role and a short-lived
+credential. Keep credentials and article files outside this source bundle. Use
+public_catalog_admin.py --help, then inspect, init, upsert or delete as appropriate.
+Initial creation requires --expected-version create. Later edits require the exact
+observed version and --confirm-write. The native conditional write must succeed;
+conflicts require reloading and reviewing the change. Never retry a write blindly
+after an unconfirmed response. Editor flags express intent; the cloud IAM role
+remains the authorization boundary. Do not pass a browser user token as an editor
+credential. Token files must be operator-owned and private.
+
+Seed the catalog explicitly before allowing traffic. Initialization reads every
+file in a dedicated public .txt/.md directory, supports spaces/Unicode names and
+creates stable distinct source IDs. It rejects symlinks, invalid UTF-8, oversized
+files or unsupported entries rather than silently omitting articles. Later updates
+and deletions change the current manifest; any retained backup versions require a
+separately reviewed operator recovery path. The API never falls back to cached or
+inaccessible source data. A changed source during inference withholds that answer.
+
+The bounded lexical retriever admits up to 100 articles of 30000 UTF-8 bytes each;
+the acceptance project starts with twenty. It supplies at most two full relevant
+articles, without cutting sentences. Citation IDs and quotes are independently
+verified against that exact evidence. URLs/titles come from the approved catalog,
+not the model. Syntax and quote membership do not prove factual entailment: run a
+representative real-model answer/citation/abstention evaluation before deployment.
+
+The provider schema remains stable across queries to avoid a new grammar for every
+source combination. The bounded synchronous AWS adapter uses independently decoded
+JSON, not a claimed provider-constrained grammar: Bedrock's new-schema compilation
+can take around 90 seconds and cannot silently fit a 29-second HTTP path. Other
+adapters use their documented output modes with the same independent decoder.
+Unsupported model/output responses fail closed; no model or region is silently
+substituted. The browser does not retry model calls automatically.
+
+Verify current regional model support, data handling, identity/control-plane
+processing, quotas and prices with retained evidence. Limits on input, output,
+concurrency and instance count are not an invoice cap, availability or latency SLA.
+No question/answer persistence or content-bearing application logs are implemented;
+review provider/platform logging and retention separately. Private enterprise
+connectors, user tenancy, payments and durable workflows are different capabilities.
+`;

package/src/pulumi.mjs

@@ -0,0 +1,123 @@
+/** AtMem AI Architect's initial Pulumi interchange. Does not execute infrastructure commands. */
+export function importPulumiSnapshot(raw) {
+  const deployment = raw?.deployment || raw;
+  if (
+    !deployment ||
+    !Array.isArray(deployment.resources) ||
+    deployment.resources.length > 1000
+  )
+    throw Error(
+      "Expected a Pulumi stack export with deployment.resources (up to 1,000 resources).",
+    );
+  if(deployment.resources.some(r=>!r||typeof r!=='object'||typeof r.type!=='string'||typeof r.urn!=='string'))throw Error('Pulumi resource metadata is invalid; no resource was silently discarded.');
+  const resources = deployment.resources
+    .filter(
+      (r) =>
+        typeof r.type === "string" &&
+        typeof r.urn === "string" &&
+        !r.type.startsWith("pulumi:"),
+    )
+    .map((r, i) => {
+      const name=r.urn.split("::").at(-1);
+      if(!r.urn.startsWith('urn:pulumi:')||r.urn.length>600||!r.type||r.type.length>200||!name||name.length>150)throw Error('Pulumi resource identity exceeds the supported metadata bounds or is invalid; nothing was clipped. Preserve the original export.');
+      return ({
+      id: `observed-${i}`,
+      urn: r.urn,
+      type: r.type,
+      name,
+      provider: r.type.startsWith("aws:")
+        ? "aws"
+        : r.type.startsWith("azure")
+          ? "azure"
+          : r.type.startsWith("gcp:")
+            ? "gcp"
+            : r.type.startsWith("ibm:")
+              ? "ibm"
+              : "tools",
+    });});
+  if(new Set(resources.map(r=>r.urn)).size!==resources.length)throw Error('Duplicate Pulumi resource identities require an explicit ownership decision; no resource was selected or discarded.');
+  // Never retain inputs, outputs, secret envelopes, credentials, provider config or raw state.
+  return {
+    kind: "imported-pulumi-snapshot",
+    importedAt: new Date().toISOString(),
+    liveRefresh: false,
+    resources,
+    notice:
+      "Imported state metadata only. Not a live cloud refresh. Inputs and outputs were discarded.",
+  };
+}
+export function snapshotToProject(snapshot) {
+  if (snapshot.resources.length > 100)
+    throw Error("Select a snapshot with at most 100 resources for the canvas.");
+  return {
+    version: 1,
+    revision: 1,
+    name: "Pulumi snapshot — proposed design import",
+    provider: "tools",
+    requirements:
+      "Explicitly imported resource references from a Pulumi stack export. No properties, secrets, cloud access or live drift verification are included.",
+    ...(snapshot.resources.some(r=>r.urn)?{extensions:{externalReferences:{version:1,references:snapshot.resources.filter(r=>r.urn).map(r=>({componentId:r.id,source:'pulumi-stack-export',externalId:r.urn,resourceType:r.type}))}}}:{}),
+    nodes: snapshot.resources.map((r, i) => ({
+      id: r.id,
+      type: "resource",
+      position: { x: (i % 3) * 310, y: Math.floor(i / 3) * 230 },
+      data: {
+        label: r.name,
+        provider: r.provider,
+        kind: "resource",
+        description: r.type,
+        origin: "existing",
+        binding: "existing-service",
+        service: r.type,
+        config: {
+          region: "Unknown — not imported",
+          classification: "Internal",
+          timeout: 5000,
+        },
+      },
+    })),
+    edges: [],
+  };
+}
+export function pulumiScaffold(project, environment = "staging") {
+  const graph = project.nodes.map((n) => ({
+    id: n.id,
+    name: n.data.label,
+    provider: n.data.provider,
+    kind: n.data.kind,
+    dependsOn: project.edges
+      .filter((e) => e.target === n.id)
+      .map((e) => e.source),
+  }));
+  return {
+    "Pulumi.yaml":
+      "name: atforma-design\nruntime: nodejs\ndescription: AtMem AI Architect architecture scaffold; no cloud resource implementations\n",
+    "package.json": JSON.stringify(
+      {
+        name: "atforma-design",
+        private: true,
+        scripts: { typecheck: "tsc --noEmit" },
+        dependencies: { "@pulumi/pulumi": "3.273.0" },
+        devDependencies: { typescript: "5.9.3", "@types/node": "22.19.11" },
+      },
+      null,
+      2,
+    ),
+    "tsconfig.json": JSON.stringify(
+      {
+        compilerOptions: {
+          target: "ES2022",
+          module: "commonjs",
+          strict: true,
+          esModuleInterop: true,
+          skipLibCheck: true,
+        },
+        include: ["index.ts"],
+      },
+      null,
+      2,
+    ),
+    "index.ts": `import * as pulumi from '@pulumi/pulumi';\n\n// AtMem AI Architect revision ${project.revision}; ${environment}.\n// These metadata components are NOT cloud resources.\n// Implement reviewed provider-native resources before any infrastructure deployment.\nconst design = ${JSON.stringify(graph, null, 2)};\nconst blocks = new Map<string, pulumi.ComponentResource>();\nconst remaining = new Map(design.map(block => [block.id, block]));\nwhile (remaining.size) {\n  let progress = false;\n  for (const [id, block] of remaining) {\n    if (block.dependsOn.every(parent => blocks.has(parent))) {\n      blocks.set(id, new pulumi.ComponentResource('atforma:design:Block', id, { label: block.name, provider: block.provider, kind: block.kind }, { protect: true, dependsOn: block.dependsOn.map(parent => blocks.get(parent)!) }));\n      remaining.delete(id); progress = true;\n    }\n  }\n  if (!progress) throw new Error('Design contains cycles or missing dependencies');\n}\nexport const designRevision = ${project.revision};\nexport const environment = ${JSON.stringify(environment)};\nexport const cloudResourcesImplemented = false;\n`,
+    "README.md": `# AtMem AI Architect Pulumi scaffold\n\nDesign revision ${project.revision}; environment ${environment}.\n\nThis scaffold registers metadata ComponentResources only. It does not provision cloud resources, create network connections, enforce IAM, or implement AI inference. Wire dependencies express ordering only. Do not treat a successful preview of this scaffold as cloud validation.\n\nNext: implement provider-specific resource constructors and configuration, review costs/permissions, then run Pulumi preview in a separately configured staging stack.\n\nPulumi import brings existing resources into management; refresh updates recorded state from cloud reality. Neither automatically reconstructs an arbitrary application graph or edits its source code. AtMem AI Architect currently imports sanitised metadata from stack-export JSON; it does not execute import, refresh, preview, or update.\n`,
+  };
+}