@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/review.mjs

@@ -0,0 +1,252 @@
+// Architecture review: deterministic, provider-neutral rules over the project model.
+// See specs/003-architecture-review. Each finding names its rule, so it can be traced.
+
+export const RULES_VERSION = "1.0.0";
+export const ATTRIBUTES = [
+  ["security", "Security & controls"],
+  ["reliability", "Reliability"],
+  ["availability", "Availability"],
+  ["scalability", "Scalability"],
+  ["performance", "Performance"],
+  ["maintainability", "Maintainability"],
+  ["cost", "Cost"],
+];
+export const SEVERITIES = ["blocker", "major", "minor", "info"];
+
+// What a block does, whether runnable (kind) or sketched (role).
+export function roleOf(n) {
+  const { kind, role } = n.data;
+  if (role) return role;
+  return (
+    { source: "data", stream: "data", history: "data", features: "ingest", train: "model", registry: "model", predict: "model", monitor: "monitor", agent: "llm", guard: "guard", tool: "app", output: "output" }[kind] || "other"
+  );
+}
+const isHuman = (n) => roleOf(n) === "human" || /\b(approv|human|review queue|person)\b/i.test(n.data.label);
+const isGuard = (n) => roleOf(n) === "guard" || isHuman(n);
+
+function downstream(p, id, seen = new Set()) {
+  for (const e of p.edges)
+    if (e.source === id && !seen.has(e.target)) {
+      seen.add(e.target);
+      downstream(p, e.target, seen);
+    }
+  return seen;
+}
+// Paths from `from` to any node matching `to` that avoid nodes matching `via`.
+function reachesAvoiding(p, from, to, via) {
+  const stack = [from],
+    seen = new Set([from]);
+  while (stack.length) {
+    const id = stack.pop();
+    for (const e of p.edges.filter((x) => x.source === id)) {
+      const n = p.nodes.find((x) => x.id === e.target);
+      if (!n || seen.has(n.id) || via(n)) continue;
+      if (to(n)) return true;
+      seen.add(n.id);
+      stack.push(n.id);
+    }
+  }
+  return false;
+}
+
+const hasNeed = (p, category, re) =>
+  (p.needs || []).some((r) => r.category === category && (!re || re.test(`${r.statement} ${r.measure?.metric || ""}`)));
+const fact = (p, name) => [...(p.facts || [])].reverse().find((f) => f.name === name);
+
+const RULES = [
+  {
+    id: "SEC-001",
+    attribute: "security",
+    severity: "blocker",
+    check(p) {
+      const llms = p.nodes.filter((n) => roleOf(n) === "llm");
+      const exits = (n) => ["app", "output"].includes(roleOf(n));
+      const open = llms.filter((n) => reachesAvoiding(p, n.id, exits, isGuard));
+      return open.map((n) => ({
+        statement: `${n.data.label} can reach users or systems without a guardrail or approval step.`,
+        rationale: "Generated content can be wrong, unsafe or leak data; it needs a check before it leaves the system.",
+        action: "Define and represent output validation or an approval control where needed; specify failure behavior and test it. Verify source authorization before retrieval and citation grounding separately: a guardrail block alone proves neither.",
+        components: [n.id],
+      }));
+    },
+  },
+  {
+    id: "SEC-002",
+    attribute: "security",
+    severity: "major",
+    check(p) {
+      const sensitive = p.nodes.filter((n) => n.data.config?.classification === "Confidential");
+      const flagged = fact(p, "data.sensitive")?.value === true;
+      if (!sensitive.length && !flagged) return [];
+      if (hasNeed(p, "compliance", /stay|resid|region|locat/i)) return [];
+      return [
+        {
+          statement: "Sensitive data is involved but where it must be stored is not stated.",
+          rationale: "Data residency rules decide which regions and services are allowed.",
+          action: "Add a compliance requirement such as “data stays in the EU”, and set regions on data blocks.",
+          components: sensitive.map((n) => n.id),
+        },
+      ];
+    },
+  },
+  {
+    id: "SEC-003",
+    attribute: "security",
+    severity: "major",
+    check(p) {
+      const actors = p.nodes.filter((n) => ["llm", "model"].includes(roleOf(n)));
+      // Systems that receive actions (integrations), not the interface people read.
+      const apps = p.nodes.filter((n) => roleOf(n) === "app" && (n.data.kind === "tool" || /integration/i.test(n.data.category || "")));
+      const unchecked = apps.filter((a) => actors.some((m) => downstream(p, m.id).has(a.id) && reachesAvoiding(p, m.id, (x) => x.id === a.id, isHuman)));
+      if (!unchecked.length || hasNeed(p, "security", /person|human|approv/i)) return [];
+      return [
+        {
+          statement: "Automated results reach other systems with no person approving them.",
+          rationale: "Actions taken on model output (orders, emails, records) need clear human accountability.",
+          action: "Add an approval step, or record a requirement that states which actions need approval.",
+          components: unchecked.map((n) => n.id),
+        },
+      ];
+    },
+  },
+  {
+    id: "REL-001",
+    attribute: "reliability",
+    severity: "major",
+    check(p) {
+      const models = p.nodes.filter((n) => ["llm", "model"].includes(roleOf(n)));
+      if (!models.length || p.nodes.some((n) => roleOf(n) === "monitor")) return [];
+      return [
+        {
+          statement: "No monitoring for model quality or drift.",
+          rationale: "Model answers and predictions degrade quietly; someone needs to see it happen.",
+          action: "Add a monitoring block (quality, drift, cost) and decide who is alerted.",
+          components: models.map((n) => n.id),
+        },
+      ];
+    },
+  },
+  {
+    id: "REL-002",
+    attribute: "reliability",
+    severity: "minor",
+    check(p) {
+      const apps = p.nodes.filter((n) => roleOf(n) === "app" && n.data.origin === "existing");
+      return apps.length
+        ? [
+            {
+              statement: "The design depends on existing systems; their failure behaviour is not described.",
+              rationale: "If an integration is down, requests may be lost or duplicated.",
+              action: "State what happens when each existing system is unavailable (retry, queue, fallback).",
+              components: apps.map((n) => n.id),
+            },
+          ]
+        : [];
+    },
+  },
+  {
+    id: "AVL-001",
+    attribute: "availability",
+    severity: "minor",
+    check: (p) =>
+      p.nodes.length && !hasNeed(p, "availability")
+        ? [{ statement: "No availability target.", rationale: "Without one, nobody can say whether a single region or a single endpoint is enough.", action: "Add a requirement such as “available 99.5% of the time” or “business hours only”.", components: [] }]
+        : [],
+  },
+  {
+    id: "PRF-001",
+    attribute: "performance",
+    severity: "minor",
+    check: (p) =>
+      p.nodes.some((n) => ["llm", "model"].includes(roleOf(n))) && !hasNeed(p, "performance")
+        ? [{ statement: "No response-time target.", rationale: "Model size, retrieval depth and region all trade speed against cost.", action: "Add a requirement such as “responds within 5 seconds”.", components: [] }]
+        : [],
+  },
+  {
+    id: "SCL-001",
+    attribute: "scalability",
+    severity: "info",
+    check: (p) =>
+      p.nodes.length && !fact(p, "requests.per_month") && !fact(p, "users")
+        ? [{ statement: "Expected usage is unknown, so scale can't be assessed.", rationale: "Usage drives capacity, limits and cost.", action: "Tell us in the chat roughly how many people use it and how often.", components: [] }]
+        : [],
+  },
+  {
+    id: "MNT-001",
+    attribute: "maintainability",
+    severity: "minor",
+    check: (p) => {
+      const loose = (p.needs || []).filter((r) => r.kind === "nonfunctional" && !r.measure);
+      return loose.length
+        ? [{ statement: `${loose.length} quality requirement${loose.length > 1 ? "s have" : " has"} no measurable target.`, rationale: "A target makes it testable and lets the review say met or not met.", action: `Add a metric and target to: ${loose.map((r) => `“${r.statement}”`).join(", ")}.`, components: [] }]
+        : [];
+    },
+  },
+  {
+    id: "MNT-002",
+    attribute: "maintainability",
+    severity: "minor",
+    check: (p) => {
+      const unowned = (p.decisions || []).filter((d) => d.status === "Accepted" && !d.owner?.trim());
+      return unowned.length
+        ? [{ statement: `${unowned.length} accepted decision${unowned.length > 1 ? "s have" : " has"} no owner.`, rationale: "Someone must be accountable for each choice before build.", action: "Assign an owner in Design → Decisions.", components: [] }]
+        : [];
+    },
+  },
+  {
+    id: "CST-001",
+    attribute: "cost",
+    severity: "info",
+    check: (p) =>
+      p.nodes.length && !fact(p, "budget.per_month") && !hasNeed(p, "cost")
+        ? [{ statement: "No budget stated.", rationale: "Without one, the estimate can't flag an option as too expensive.", action: "Mention a monthly running budget, or a range, in the chat.", components: [] }]
+        : [],
+  },
+  {
+    id: "DSN-001",
+    attribute: "maintainability",
+    severity: "info",
+    check: (p) => {
+      const sketch = p.nodes.filter((n) => n.data.kind === "resource");
+      return sketch.length
+        ? [{ statement: `${sketch.length} block${sketch.length > 1 ? "s are" : " is"} sketch-only and can't be test-run yet.`, rationale: "Sketch blocks describe intent; runnable fixtures exist only for some workflows.", action: "Keep designing; assign a runnable behaviour in block detail when one exists.", components: sketch.map((n) => n.id) }]
+        : [];
+    },
+  },
+];
+
+const keyOf = (rule, components) => `${rule}:${[...components].sort().join(",")}`;
+
+// Findings are recomputed from current data; accepted risks persist by rule + components.
+export function review(full) {
+  const notes = new Set(full.nodes.filter((n) => n.data.kind === "note").map((n) => n.id));
+  const project = { ...full, nodes: full.nodes.filter((n) => !notes.has(n.id)), edges: full.edges.filter((e) => !notes.has(e.source) && !notes.has(e.target)) };
+  const accepted = project.reviewAccepted || {};
+  return RULES.flatMap((rule) =>
+    rule.check(project).map((f, i) => {
+      const key = keyOf(rule.id, f.components);
+      return {
+        id: `${rule.id}-${i + 1}`,
+        key,
+        rule: rule.id,
+        version: RULES_VERSION,
+        attribute: rule.attribute,
+        severity: rule.severity,
+        ...f,
+        source: `AtMem AI Architect rule ${rule.id} v${RULES_VERSION}`,
+        status: accepted[key] ? "accepted" : "open",
+        ...(accepted[key] ? { acceptance: accepted[key] } : {}),
+      };
+    }),
+  );
+}
+
+export function acceptRisk(project, finding, reason, owner) {
+  if (!String(reason || "").trim() || !String(owner || "").trim()) throw Error("Accepting a risk needs a reason and an owner.");
+  return {
+    ...project,
+    reviewAccepted: { ...(project.reviewAccepted || {}), [finding.key]: { reason, owner, date: new Date().toLocaleDateString("en-CA") } },
+  };
+}
+
+export const blockers = (findings) => findings.filter((f) => f.severity === "blocker" && f.status === "open");

package/src/runtime/EnterpriseDocument.java

@@ -0,0 +1,89 @@
+/* Credentialless, single-document Tika bridge. Configuration is operator-owned.
+ * Run inside a network-isolated, resource-limited container; Tika is not a sandbox.
+ * No URL, filename, parser option or environment setting comes from a document.
+ */
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.Set;
+import org.apache.tika.detect.DefaultDetector;
+import org.apache.tika.io.TikaInputStream;
+import org.apache.tika.metadata.Metadata;
+import org.apache.tika.metadata.TikaCoreProperties;
+import org.apache.tika.parser.AutoDetectParser;
+import org.apache.tika.parser.ParseContext;
+import org.apache.tika.parser.RecursiveParserWrapper;
+import org.apache.tika.parser.microsoft.OfficeParserConfig;
+import org.apache.tika.parser.ocr.TesseractOCRConfig;
+import org.apache.tika.sax.BasicContentHandlerFactory;
+import org.apache.tika.sax.RecursiveParserWrapperHandler;
+
+public final class EnterpriseDocument {
+    private static final int LIMIT = 200000;
+    private static final Set<String> TYPES = Set.of(
+        "text/plain", "text/html", "application/rtf",
+        "application/msword", "application/vnd.ms-excel", "application/vnd.ms-powerpoint",
+        "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+        "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+        "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+        "application/vnd.oasis.opendocument.text", "application/vnd.oasis.opendocument.spreadsheet",
+        "application/vnd.oasis.opendocument.presentation");
+
+    public static void main(String[] args) {
+        try {
+            if (args.length != 1) throw new IllegalArgumentException();
+            Path input = Path.of(args[0]);
+            if (!Files.isRegularFile(input) || Files.size(input) > 10000000 || Files.size(input) == 0)
+                throw new IllegalArgumentException();
+            Metadata root = new Metadata();
+            String detected;
+            try (TikaInputStream stream = TikaInputStream.get(input)) {
+                detected = new DefaultDetector().detect(stream, root).toString();
+            }
+            if (!TYPES.contains(detected)) {
+                System.out.print("rejected\nunsupported_format\n");
+                System.exit(2);
+            }
+            AutoDetectParser parser = new AutoDetectParser();
+            ParseContext context = new ParseContext();
+            OfficeParserConfig office = new OfficeParserConfig();
+            office.setExtractMacros(false);
+            office.setIncludeDeletedContent(false);
+            office.setIncludeMoveFromContent(false);
+            office.setIncludeHeadersAndFooters(true);
+            office.setIncludeSlideNotes(true);
+            context.set(OfficeParserConfig.class, office);
+            TesseractOCRConfig ocr = new TesseractOCRConfig();
+            ocr.setLanguage("eng");
+            ocr.setTimeoutSeconds(15);
+            ocr.setEnableImagePreprocessing(false);
+            context.set(TesseractOCRConfig.class, ocr);
+            RecursiveParserWrapperHandler handler = new RecursiveParserWrapperHandler(
+                new BasicContentHandlerFactory(BasicContentHandlerFactory.HANDLER_TYPE.TEXT, LIMIT), 64);
+            // Recursive metadata exposes caught embedded/parse exceptions and write
+            // limits, which plain CLI text output can otherwise quietly conceal.
+            try (TikaInputStream stream = TikaInputStream.get(input)) {
+                new RecursiveParserWrapper(parser).parse(stream, handler, root, context);
+            }
+            StringBuilder text = new StringBuilder();
+            for (Metadata item : handler.getMetadataList()) {
+                for (String name : item.names()) {
+                    if (name.startsWith("X-TIKA:EXCEPTION") || name.startsWith("X-TIKA:WARN") ||
+                        name.contains("write_limit_reached") || name.contains("embedded_resource_limit_reached"))
+                        throw new IllegalArgumentException();
+                }
+                String content = item.get(TikaCoreProperties.TIKA_CONTENT);
+                if (content != null && !content.isBlank()) text.append(content.strip()).append('\n');
+                if (text.length() > LIMIT) throw new IllegalArgumentException();
+            }
+            byte[] result = text.toString().strip().getBytes(StandardCharsets.UTF_8);
+            if (result.length == 0 || result.length > LIMIT) throw new IllegalArgumentException();
+            System.out.print("ok\n" + detected + "\n" + Base64.getEncoder().encodeToString(result) + "\n");
+        } catch (Throwable failure) {
+            // Native parser messages can contain private text, filenames and URLs.
+            System.out.print("rejected\nextraction_failed\n");
+            System.exit(2);
+        }
+    }
+}

package/src/runtime/approved_http_destination.py

@@ -0,0 +1,72 @@
+"""A concrete, explicit normalized external-action HTTP contract.
+
+This is not an invented vendor API. Destination operators must verify this exact
+idempotent contract or implement a reviewed native mapping. A model/visitor cannot
+choose the endpoint, credentials, identity header, method or replay policy.
+"""
+import hashlib
+import http.client
+import json
+import re
+import ssl
+from urllib.parse import urlsplit
+from durable_workflow import canonical,identifier
+from workflow_errors import ExternalOutcomeUnknown,DestinationNotAttempted,InvalidDispatch
+from workflow_contract import normalized_contract,bind_payload_contract,bind_application_contract,bind_review_policy
+
+class ApprovedHttpDestination:
+    def __init__(self,endpoint,credential,*,destination_scope,idempotency_verified=False,tls_context=None,allowed_kinds=('document',),payload_contract=None,application_contract_sha256=None,review_policy=None):
+        try:target=urlsplit(endpoint)
+        except (TypeError,ValueError):raise ValueError('Invalid operator destination')from None
+        if (not isinstance(endpoint,str)or len(endpoint)>2000 or target.scheme!='https' or not target.hostname or target.username or target.password
+            or target.query or target.fragment or any(ord(c)<33 for c in endpoint)):raise ValueError('Use a fixed reviewed HTTPS destination without embedded credentials, query or fragment')
+        try:port=target.port or 443
+        except ValueError:raise ValueError('Invalid destination port')from None
+        if not 1<=port<=65535 or not callable(credential)or type(idempotency_verified)is not bool:raise ValueError('Invalid owned destination configuration')
+        if not isinstance(allowed_kinds,(tuple,list,set,frozenset))or not allowed_kinds or not set(allowed_kinds)<={'document','draft','account_change'}:raise ValueError('Invalid owned operation allowlist')
+        context=tls_context or ssl.create_default_context()
+        if not isinstance(context,ssl.SSLContext)or context.verify_mode!=ssl.CERT_REQUIRED or not context.check_hostname:raise ValueError('TLS certificate and hostname verification are mandatory')
+        self.host=target.hostname;self.port=port;self.path=target.path or'/';self.credential=credential;self.idempotency_verified=idempotency_verified;self.context=context;self.allowed_kinds=frozenset(allowed_kinds)
+        self.contract=bind_payload_contract(normalized_contract(endpoint,destination_scope),payload_contract)
+        if application_contract_sha256 is not None:self.contract=bind_application_contract(self.contract,application_contract_sha256)
+        self.contract=bind_review_policy(self.contract,payload_contract,review_policy)
+        self.review_policy=review_policy
+        self.payload_contract=payload_contract
+    def __call__(self,row,*,idempotency_key,payload_sha256):
+        try:identifier(idempotency_key)
+        except (ValueError,TypeError):raise InvalidDispatch('Invalid approved operation identity')from None
+        if (str(row.get('id'))!=idempotency_key or row.get('state')!='dispatching' or not row.get('approved_by')or row.get('approved_hash')!=payload_sha256
+            or row.get('kind')not in self.allowed_kinds or not isinstance(payload_sha256,str)or not re.fullmatch(r'[0-9a-f]{64}',payload_sha256)):raise InvalidDispatch('A current allowed approved dispatch snapshot is required')
+        if row.get('destination_contract')!=self.contract:raise InvalidDispatch('Approved integration identity no longer matches this destination')
+        if self.payload_contract is not None:
+            try:
+                if self.contract['payloadContractSha256']!=self.payload_contract.sha256:raise ValueError()
+                self.payload_contract.validate('source',row['source_ref']);self.payload_contract.validate('result',row['result'])
+                if self.review_policy:self.review_policy.validate_result(row['source_ref'],row['result'])
+            except (KeyError,ValueError):raise InvalidDispatch('Approved application contract no longer matches this destination')from None
+        snapshot={'kind':row['kind'],'source':row['source_ref'],'destination':row['destination_contract'],'result':row['result'],'revision':row['result_revision']}
+        if hashlib.sha256(canonical(snapshot,140000)).hexdigest()!=payload_sha256:raise InvalidDispatch('Approved payload snapshot changed')
+        # Source storage references and credentials stay inside our boundary.
+        body=canonical({'operation_id':idempotency_key,'payload_sha256':payload_sha256,'kind':row['kind'],'result':row['result']},70000)
+        try:token=self.credential()
+        except Exception:raise DestinationNotAttempted('Destination credential unavailable; no request made')from None
+        if not isinstance(token,str)or not 1<=len(token)<=16000 or any(ord(c)<33 or ord(c)>126 for c in token):raise DestinationNotAttempted('Destination credential unavailable; no request made')
+        connection=http.client.HTTPSConnection(self.host,self.port,timeout=8,context=self.context)
+        try:
+            connection.request('POST',self.path,body=body,headers={'Content-Type':'application/json','Accept':'application/json','Authorization':'Bearer '+token,'Idempotency-Key':idempotency_key})
+            response=connection.getresponse();raw=response.read(8193)
+            # No redirects, inferred success, 202-as-completed, or error-body logs.
+            if response.status not in {200,201}or len(raw)>8192 or response.getheader('Content-Type','').split(';')[0].lower()!='application/json':raise ExternalOutcomeUnknown('Destination completion is unconfirmed')
+            def unique(pairs):
+                result={}
+                for key,value in pairs:
+                    if key in result:raise ValueError('Duplicate receipt field')
+                    result[key]=value
+                return result
+            reply=json.loads(raw,object_pairs_hook=unique)
+            if (not isinstance(reply,dict)or set(reply)!={'operation_id','payload_sha256','external_id','status'}or reply['operation_id']!=idempotency_key
+                or reply['payload_sha256']!=payload_sha256 or reply['status']!='completed' or not isinstance(reply['external_id'],str)or not re.fullmatch(r'[A-Za-z0-9_.:/-]{1,200}',reply['external_id'])):raise ExternalOutcomeUnknown('Destination completion is unconfirmed')
+            return {'externalId':reply['external_id'],'operationId':idempotency_key,'payloadSha256':payload_sha256}
+        except ExternalOutcomeUnknown:raise
+        except Exception:raise ExternalOutcomeUnknown('Destination completion is unconfirmed')from None
+        finally:connection.close()

package/src/runtime/aws-lambda-qualification-lock.json

@@ -0,0 +1,7 @@
+{
+  "image": "public.ecr.aws/lambda/python:3.13@sha256:181a54632ba2cb7945ac633bdac72c13d7b0e461a32931966ae93b429a3436b9",
+  "platform": "linux/amd64",
+  "reviewedAt": "2026-11-10",
+  "source": "https://docs.aws.amazon.com/lambda/latest/dg/python-image.html",
+  "boundary": "Official AWS Python 3.13 x86_64 image manifest observed from public ECR. Local qualification only; Lambda managed-runtime patch level and account behavior require separate destination evidence."
+}

package/src/runtime/aws-python-lock.json

@@ -0,0 +1,82 @@
+{
+  "requirements": "boto3==1.43.123 --hash=sha256:d18d66e1e13faa0c25d0b1b8c5ce946e29fb5fc0b6456b655a93a678ff4cc313\nbotocore==1.43.123 --hash=sha256:e30580f9c1282c321529238ff8ff75066096a2adbd0a293c8ae592c21d1733a3\ns3transfer==0.19.3 --hash=sha256:24eb7535804306355e31c952a90022bf5b2f9d760f9a11062c7493a217c08553\njmespath==1.1.0 --hash=sha256:a5663118de4908c91729bea0acadca56526eb2698e83de10cd116ae0f4e97c64\npython-dateutil==2.9.0.post0 --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427\nsix==1.17.0 --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274\nurllib3==2.8.0 --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3\n",
+  "sources": [
+    {
+      "package": "boto3",
+      "version": "1.43.123",
+      "source": "https://pypi.org/pypi/boto3/1.43.123/json",
+      "wheels": [
+        {
+          "filename": "boto3-1.43.123-py3-none-any.whl",
+          "sha256": "d18d66e1e13faa0c25d0b1b8c5ce946e29fb5fc0b6456b655a93a678ff4cc313"
+        }
+      ]
+    },
+    {
+      "package": "botocore",
+      "version": "1.43.123",
+      "source": "https://pypi.org/pypi/botocore/1.43.123/json",
+      "wheels": [
+        {
+          "filename": "botocore-1.43.123-py3-none-any.whl",
+          "sha256": "e30580f9c1282c321529238ff8ff75066096a2adbd0a293c8ae592c21d1733a3"
+        }
+      ]
+    },
+    {
+      "package": "s3transfer",
+      "version": "0.19.3",
+      "source": "https://pypi.org/pypi/s3transfer/0.19.3/json",
+      "wheels": [
+        {
+          "filename": "s3transfer-0.19.3-py3-none-any.whl",
+          "sha256": "24eb7535804306355e31c952a90022bf5b2f9d760f9a11062c7493a217c08553"
+        }
+      ]
+    },
+    {
+      "package": "jmespath",
+      "version": "1.1.0",
+      "source": "https://pypi.org/pypi/jmespath/1.1.0/json",
+      "wheels": [
+        {
+          "filename": "jmespath-1.1.0-py3-none-any.whl",
+          "sha256": "a5663118de4908c91729bea0acadca56526eb2698e83de10cd116ae0f4e97c64"
+        }
+      ]
+    },
+    {
+      "package": "python-dateutil",
+      "version": "2.9.0.post0",
+      "source": "https://pypi.org/pypi/python-dateutil/2.9.0.post0/json",
+      "wheels": [
+        {
+          "filename": "python_dateutil-2.9.0.post0-py2.py3-none-any.whl",
+          "sha256": "a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427"
+        }
+      ]
+    },
+    {
+      "package": "six",
+      "version": "1.17.0",
+      "source": "https://pypi.org/pypi/six/1.17.0/json",
+      "wheels": [
+        {
+          "filename": "six-1.17.0-py2.py3-none-any.whl",
+          "sha256": "4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274"
+        }
+      ]
+    },
+    {
+      "package": "urllib3",
+      "version": "2.8.0",
+      "source": "https://pypi.org/pypi/urllib3/2.8.0/json",
+      "wheels": [
+        {
+          "filename": "urllib3-2.8.0-py3-none-any.whl",
+          "sha256": "0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3"
+        }
+      ]
+    }
+  ]
+}