@atmem/architect 0.0.0-stage → 0.2.0

package/src/invoice-aws.mjs

@@ -0,0 +1,143 @@
+import {invoiceBuilder,v,r,l}from'./invoice-builder.mjs';
+import {awsInvoiceOperations}from'./invoice-aws-operations.mjs';
+import {CLOUD_PROVIDER_LOCKS}from'./cloud-provider-locks.mjs';
+
+// Isolated adapter under qualification. Not registered as a complete invoice
+// capability until application, operations and whole-export checks pass.
+export function awsInvoiceTerraform(project,row,environment='staging'){
+ if(row.provider!=='aws')throw Error('AWS invoice adapter cannot substitute another provider');
+ const b=invoiceBuilder(project,row,environment),{input,add,region}=b,n=row.address;
+ const account=input('account_id','Expected commercial AWS account, using an approved operator identity.','123456789012','^[0-9]{12}$');
+ const zone=input('public_zone_id','Existing owned public Route53 zone. Referenced, never recreated or imported.','Z0123456789EXAMPLE','^[A-Z0-9]{5,40}$');
+ const model=input('model_id','Reviewed direct regional Bedrock foundation model ID. Verify regional availability, quotas, terms and retention-none policy.','anthropic.reviewed-model-v1:0','^[a-z0-9][a-z0-9.-]*:[0-9]+$');
+ const endpoint=input('accounting_endpoint','Existing accounting HTTPS adapter endpoint; no vendor or replacement system is provisioned.','https://accounting.example.test/actions','^https://[A-Za-z0-9.-]+(:[0-9]{1,5})?(/[^?#@ ]*)?$');
+ const scope=input('accounting_scope','Reviewed opaque destination account/scope, bound into every approval.','owned-account','^[A-Za-z0-9_.:/-]{1,200}$');
+ const seed=b.seed;
+ for(const key of ['runtime_image','parser_image']){
+  input(key,'Published, reviewed immutable image in the emitted ECR repository. Empty during foundation setup.',key==='runtime_image'?'123456789012.dkr.ecr.ap-southeast-2.amazonaws.com/reviewed-runtime@sha256:'+'a'.repeat(64):'123456789012.dkr.ecr.ap-southeast-2.amazonaws.com/reviewed-parser@sha256:'+'b'.repeat(64));
+  b.variable[key].default='';b.variable[key].validation={condition:'${!('+(key==='runtime_image'?'var.applications_enabled || var.operations_enabled':'var.applications_enabled')+') || (can(regex("@sha256:[0-9a-f]{64}$",var.'+key+')) && !endswith(var.'+key+',"@sha256:'+ '0'.repeat(64)+'"))}',error_message:'Application release requires a reviewed immutable image digest.'};
+  b.testExpressions[key]='format("123456789012.dkr.ecr.'+(row.region||'ap-southeast-2')+'.amazonaws.com/invoice-%s-'+(key==='runtime_image'?'runtime':'parser')+'@sha256:'+(key==='runtime_image'?'a':'b').repeat(64)+'",substr(sha256('+JSON.stringify(seed)+'),0,12))';
+  b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${!('+(key==='runtime_image'?'var.applications_enabled || var.operations_enabled':'var.applications_enabled')+') || startswith(var.'+key+',format("%s.dkr.ecr.%s.amazonaws.com/%s-'+(key==='runtime_image'?'runtime':'parser')+'@sha256:",var.account_id,var.region,local.name))}',error_message:'Use the package-owned regional ECR repository; a digest from another repository is not an admitted release.'});
+ }
+ b.variable.replay_review_base64={type:'string',default:'',description:'Scoped expiring operator receipt for the real endpoint idempotency contract. Empty disables automatic replay of uncertain deliveries.'};b.examples.replay_review_base64='';
+ b.data.aws_caller_identity={destination:{}};b.data.aws_availability_zones={destination:{state:'available',filter:{name:'zone-type',values:['availability-zone']}}};b.data.aws_route53_zone={destination:{zone_id:zone,private_zone:false}};
+ b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${data.aws_caller_identity.destination.account_id == var.account_id && !data.aws_route53_zone.destination.private_zone && length(data.aws_availability_zones.destination.names) >= 2}',error_message:'Use the reviewed account, owned public DNS zone and at least two regional availability zones.'});
+ Object.assign(b.locals,{api_hostname:'${format("%s.%s",local.name,trimsuffix(data.aws_route53_zone.destination.name,"."))}',parser_zone:'${format("%s.internal.%s",local.name,trimsuffix(data.aws_route53_zone.destination.name,"."))}',parser_hostname:'${format("parse.%s",local.parser_zone)}',public_origin:'${format("https://%s",local.api_hostname)}',parser_endpoint:'${format("https://%s/extract",local.parser_hostname)}',destination_contract:{id:'normalized-action-v1',endpointSha256:'${sha256(var.accounting_endpoint)}',scope,mappingVersion:1},destination_contract_base64:'${base64encode(jsonencode(local.destination_contract))}'});
+ add('aws_vpc',n,{cidr_block:'10.82.0.0/16',enable_dns_support:true,enable_dns_hostnames:true,tags:{Name:l('name')}});
+ add('aws_internet_gateway',n,{vpc_id:r('aws_vpc',n,'id')});
+ for(let i=0;i<2;i++){
+  add('aws_subnet',n+'_public_'+i,{vpc_id:r('aws_vpc',n,'id'),availability_zone:'${data.aws_availability_zones.destination.names['+i+']}',cidr_block:'10.82.'+i+'.0/24',map_public_ip_on_launch:false});
+  add('aws_subnet',n+'_private_'+i,{vpc_id:r('aws_vpc',n,'id'),availability_zone:'${data.aws_availability_zones.destination.names['+i+']}',cidr_block:'10.82.'+(16+i)+'.0/24',map_public_ip_on_launch:false});
+ }
+ add('aws_eip',n,{domain:'vpc'});add('aws_nat_gateway',n,{allocation_id:r('aws_eip',n,'id'),subnet_id:r('aws_subnet',n+'_public_0','id'),depends_on:['aws_internet_gateway.'+n]});
+ add('aws_route_table',n+'_public',{vpc_id:r('aws_vpc',n,'id')});
+ add('aws_route',n+'_public',{route_table_id:r('aws_route_table',n+'_public','id'),destination_cidr_block:'0.0.0.0/0',gateway_id:r('aws_internet_gateway',n,'id')});
+ add('aws_route_table',n+'_private',{vpc_id:r('aws_vpc',n,'id')});
+ add('aws_route',n+'_private',{route_table_id:r('aws_route_table',n+'_private','id'),destination_cidr_block:'0.0.0.0/0',nat_gateway_id:r('aws_nat_gateway',n,'id')});
+ const publicSubnets=[],privateSubnets=[];
+ for(let i=0;i<2;i++){publicSubnets.push(r('aws_subnet',n+'_public_'+i,'id'));privateSubnets.push(r('aws_subnet',n+'_private_'+i,'id'));for(const kind of ['public','private'])add('aws_route_table_association',n+'_'+kind+'_'+i,{subnet_id:r('aws_subnet',n+'_'+kind+'_'+i,'id'),route_table_id:r('aws_route_table',n+'_'+kind,'id')});}
+ for(const purpose of ['api_lb','api','worker','parser_lb','parser','database'])add('aws_security_group',n+'_'+purpose,{name_prefix:l('name')+'-'+purpose+'-',description:'Owned invoice '+purpose+' boundary',vpc_id:r('aws_vpc',n,'id')});
+ const ingress=(name,target,port,source)=>add('aws_vpc_security_group_ingress_rule',n+'_'+name,{security_group_id:r('aws_security_group',n+'_'+target,'id'),ip_protocol:'tcp',from_port:port,to_port:port,...(source==='public'?{cidr_ipv4:'0.0.0.0/0'}:{referenced_security_group_id:r('aws_security_group',n+'_'+source,'id')})});
+ const egress=(name,source,port,target)=>add('aws_vpc_security_group_egress_rule',n+'_'+name,{security_group_id:r('aws_security_group',n+'_'+source,'id'),ip_protocol:'tcp',from_port:port,to_port:port,...(target==='internet'?{cidr_ipv4:'0.0.0.0/0'}:{referenced_security_group_id:r('aws_security_group',n+'_'+target,'id')})});
+ ingress('public_https','api_lb',443,'public');ingress('api_from_lb','api',8080,'api_lb');egress('lb_to_api','api_lb',8080,'api');
+ ingress('parser_from_worker','parser_lb',443,'worker');ingress('parser_from_lb','parser',8080,'parser_lb');egress('lb_to_parser','parser_lb',8080,'parser');
+ for(const purpose of ['api','worker']){ingress('database_from_'+purpose,'database',5432,purpose);egress(purpose+'_database',purpose,5432,'database');egress(purpose+'_https',purpose,443,'internet');}
+ add('aws_db_subnet_group',n,{name:l('name'),subnet_ids:privateSubnets});
+ add('aws_db_parameter_group',n,{name:l('name'),family:'postgres17',parameter:[{name:'rds.force_ssl',value:'1'},{name:'log_statement',value:'none'},{name:'log_min_error_statement',value:'panic'},{name:'log_parameter_max_length_on_error',value:'0'}]});
+ add('aws_db_instance',n,{identifier:l('name'),engine:'postgres',engine_version:'17.11',instance_class:'db.t4g.small',allocated_storage:20,max_allocated_storage:100,storage_type:'gp3',storage_encrypted:true,db_name:'invoice',username:'invoice_operator',manage_master_user_password:true,iam_database_authentication_enabled:true,port:5432,publicly_accessible:false,multi_az:true,db_subnet_group_name:r('aws_db_subnet_group',n,'name'),vpc_security_group_ids:[r('aws_security_group',n+'_database','id')],parameter_group_name:r('aws_db_parameter_group',n,'name'),backup_retention_period:7,copy_tags_to_snapshot:true,deletion_protection:true,skip_final_snapshot:false,final_snapshot_identifier:l('name')+'-final',delete_automated_backups:false,auto_minor_version_upgrade:true,allow_major_version_upgrade:false,ca_cert_identifier:'rds-ca-rsa2048-g1',lifecycle:{prevent_destroy:true}});
+ add('aws_s3_bucket',n,{bucket:account+'-'+l('name')+'-invoices',force_destroy:false,lifecycle:{prevent_destroy:true}});const bucket=r('aws_s3_bucket',n,'id'),bucketArn=r('aws_s3_bucket',n,'arn'),objects=bucketArn+'/accounts/'+l('account_uuid')+'/invoices/*';
+ add('aws_s3_bucket_public_access_block',n,{bucket,block_public_acls:true,block_public_policy:true,ignore_public_acls:true,restrict_public_buckets:true});add('aws_s3_bucket_ownership_controls',n,{bucket,rule:{object_ownership:'BucketOwnerEnforced'}});add('aws_s3_bucket_server_side_encryption_configuration',n,{bucket,rule:{apply_server_side_encryption_by_default:{sse_algorithm:'AES256'}}});add('aws_s3_bucket_versioning',n,{bucket,versioning_configuration:{status:'Enabled'}});
+ add('aws_s3_bucket_lifecycle_configuration',n,{bucket,rule:[{id:'invoice-retention',status:'Enabled',filter:{prefix:'accounts/'},expiration:{days:90},noncurrent_version_expiration:{noncurrent_days:1},abort_incomplete_multipart_upload:{days_after_initiation:1}}],depends_on:['aws_s3_bucket_versioning.'+n]});
+ add('aws_s3_bucket_policy',n,{bucket,policy:JSON.stringify({Version:'2012-10-17',Statement:[{Sid:'TLSOnly',Effect:'Deny',Principal:'*',Action:'s3:*',Resource:[bucketArn,bucketArn+'/*'],Condition:{Bool:{'aws:SecureTransport':'false','aws:PrincipalIsAWSService':'false'}}}]})});
+ add('aws_secretsmanager_secret',n+'_destination',{name:l('name')+'/accounting-token',recovery_window_in_days:30,lifecycle:{prevent_destroy:true}});
+ add('aws_cognito_user_pool',n,{name:l('name'),username_attributes:['email'],auto_verified_attributes:['email'],admin_create_user_config:{allow_admin_create_user_only:true},mfa_configuration:'ON',software_token_mfa_configuration:{enabled:true},password_policy:{minimum_length:14,require_lowercase:true,require_uppercase:true,require_numbers:true,require_symbols:true,temporary_password_validity_days:3},account_recovery_setting:{recovery_mechanism:{name:'admin_only',priority:1}},lifecycle:{prevent_destroy:true}});
+ add('aws_cognito_resource_server',n,{identifier:l('name'),name:'Invoice processing',user_pool_id:r('aws_cognito_user_pool',n,'id'),scope:{scope_name:'process',scope_description:'Signed-in invoice workspace access; approval roles are checked independently in SQL.'}});
+ add('aws_cognito_user_pool_client',n,{name:l('name')+'-browser',user_pool_id:r('aws_cognito_user_pool',n,'id'),generate_secret:false,allowed_oauth_flows_user_pool_client:true,allowed_oauth_flows:['code'],allowed_oauth_scopes:['openid',l('name')+'/process'],callback_urls:[l('public_origin')+'/'],logout_urls:[l('public_origin')+'/'],supported_identity_providers:['COGNITO'],prevent_user_existence_errors:'ENABLED',enable_token_revocation:true,access_token_validity:30,id_token_validity:30,refresh_token_validity:1,token_validity_units:{access_token:'minutes',id_token:'minutes',refresh_token:'days'},depends_on:['aws_cognito_resource_server.'+n]});
+ add('aws_cognito_user_pool_domain',n,{domain:account+'-'+l('name'),user_pool_id:r('aws_cognito_user_pool',n,'id')});
+ for(const purpose of ['runtime','parser'])add('aws_ecr_repository',n+'_'+purpose,{name:l('name')+'-'+purpose,image_tag_mutability:'IMMUTABLE',image_scanning_configuration:{scan_on_push:true},encryption_configuration:{encryption_type:'AES256'},force_delete:false,lifecycle:{prevent_destroy:true}});
+ const trust=JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Principal:{Service:'ecs-tasks.amazonaws.com'},Action:'sts:AssumeRole',Condition:{StringEquals:{'aws:SourceAccount':account},ArnLike:{'aws:SourceArn':'arn:aws:ecs:'+region+':'+account+':*'}}}]});
+ for(const purpose of ['api','worker','parser']){
+  add('aws_cloudwatch_log_group',n+'_'+purpose,{name:'/ecs/'+l('name')+'/'+purpose,retention_in_days:7});add('aws_iam_role',n+'_'+purpose+'_execution',{name:l('name')+'-'+purpose+'-execution',assume_role_policy:trust});
+  const repo=r('aws_ecr_repository',n+'_'+(purpose==='parser'?'parser':'runtime'),'arn');
+  add('aws_iam_role_policy',n+'_'+purpose+'_execution',{role:r('aws_iam_role',n+'_'+purpose+'_execution','id'),policy:JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Action:['ecr:GetAuthorizationToken'],Resource:'*'},{Effect:'Allow',Action:['ecr:BatchGetImage','ecr:GetDownloadUrlForLayer','ecr:BatchCheckLayerAvailability'],Resource:repo},{Effect:'Allow',Action:['logs:CreateLogStream','logs:PutLogEvents'],Resource:r('aws_cloudwatch_log_group',n+'_'+purpose,'arn')+':*'},...(purpose==='worker'?[{Effect:'Allow',Action:['secretsmanager:GetSecretValue'],Resource:r('aws_secretsmanager_secret',n+'_destination','arn')}]:[])]})});
+  if(purpose!=='parser'){
+   add('aws_iam_role',n+'_'+purpose,{name:l('name')+'-'+purpose,assume_role_policy:trust});
+   add('aws_iam_role_policy',n+'_'+purpose,{role:r('aws_iam_role',n+'_'+purpose,'id'),policy:JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Action:purpose==='api'?['s3:PutObject','s3:GetObject','s3:GetObjectVersion']:['s3:GetObject','s3:GetObjectVersion'],Resource:objects},{Effect:'Allow',Action:['rds-db:connect'],Resource:'arn:aws:rds-db:'+region+':'+account+':dbuser:'+r('aws_db_instance',n,'resource_id')+'/'+l(purpose+'_db_user')},...(purpose==='worker'?[{Effect:'Allow',Action:['bedrock:InvokeModel'],Resource:'arn:aws:bedrock:'+region+'::foundation-model/'+model},{Effect:'Allow',Action:['bedrock:GetAccountDataRetention','bedrock:GetModelInvocationLoggingConfiguration'],Resource:'*',Condition:{StringEquals:{'aws:RequestedRegion':region}}}]:[])]})});
+  }
+ }
+ add('aws_acm_certificate',n,{domain_name:l('api_hostname'),subject_alternative_names:[l('parser_hostname')],validation_method:'DNS',lifecycle:{create_before_destroy:true}});
+ add('aws_route53_record',n+'_certificate',{for_each:{api:l('api_hostname'),parser:l('parser_hostname')},zone_id:zone,...Object.fromEntries([['name','resource_record_name'],['type','resource_record_type']].map(([key,attribute])=>[key,'${one([for dvo in aws_acm_certificate.'+n+'.domain_validation_options : dvo.'+attribute+' if dvo.domain_name == each.value])}'])),records:['${one([for dvo in aws_acm_certificate.'+n+'.domain_validation_options : dvo.resource_record_value if dvo.domain_name == each.value])}'],ttl:60,allow_overwrite:false});
+ add('aws_acm_certificate_validation',n,{certificate_arn:r('aws_acm_certificate',n,'arn'),validation_record_fqdns:'${[for record in aws_route53_record.'+n+'_certificate : record.fqdn]}'});
+ add('aws_route53_zone',n+'_parser',{name:l('parser_zone'),vpc:{vpc_id:r('aws_vpc',n,'id')}});
+ for(const purpose of ['api','parser']){
+  add('aws_lb',n+'_'+purpose,{name:l('name')+'-'+purpose,internal:purpose==='parser',load_balancer_type:'application',security_groups:[r('aws_security_group',n+'_'+purpose+'_lb','id')],subnets:purpose==='api'?publicSubnets:privateSubnets,idle_timeout:150,drop_invalid_header_fields:true,enable_deletion_protection:true});
+  add('aws_lb_target_group',n+'_'+purpose,{name:l('name')+'-'+purpose,port:8080,protocol:'HTTP',target_type:'ip',vpc_id:r('aws_vpc',n,'id'),deregistration_delay:120,health_check:{enabled:true,path:'/healthz',protocol:'HTTP',port:'traffic-port',matcher:'200',interval:30,timeout:5,healthy_threshold:2,unhealthy_threshold:3}});
+  add('aws_lb_listener',n+'_'+purpose,{load_balancer_arn:r('aws_lb',n+'_'+purpose,'arn'),port:443,protocol:'HTTPS',ssl_policy:'ELBSecurityPolicy-TLS13-1-2-2021-06',certificate_arn:r('aws_acm_certificate_validation',n,'certificate_arn'),default_action:{type:'forward',target_group_arn:r('aws_lb_target_group',n+'_'+purpose,'arn')}});
+  add('aws_route53_record',n+'_'+purpose,{zone_id:purpose==='api'?zone:r('aws_route53_zone',n+'_parser','zone_id'),name:l(purpose==='api'?'api_hostname':'parser_hostname'),type:'A',alias:{name:r('aws_lb',n+'_'+purpose,'dns_name'),zone_id:r('aws_lb',n+'_'+purpose,'zone_id'),evaluate_target_health:true}});
+ }
+ add('aws_ecs_cluster',n,{name:l('name'),setting:{name:'containerInsights',value:'enabled'}});
+ const common={REGION:region,ACCOUNT_ID:l('account_uuid'),WORKFLOW_NAMESPACE:'invoice',DATABASE_NAME:'invoice',DATABASE_HOST:r('aws_db_instance',n,'address'),DATABASE_CA_FILE:'/app/rds-global-ca.pem',DOCUMENT_BUCKET:bucket,AWS_ACCOUNT_ID:account,DESTINATION_CONTRACT_BASE64:l('destination_contract_base64')};
+ for(const purpose of ['api','worker','parser']){
+  const image=purpose==='parser'?v('parser_image'):v('runtime_image'),settings=purpose==='parser'?{PORT:'8080'}:purpose==='api'?{...common,DATABASE_USER:l('api_db_user'),PUBLIC_ORIGIN:l('public_origin'),POOL_ID:r('aws_cognito_user_pool',n,'id'),CLIENT_ID:r('aws_cognito_user_pool_client',n,'id'),AUTH_ORIGIN:'https://'+r('aws_cognito_user_pool_domain',n,'domain')+'.auth.'+region+'.amazoncognito.com',AUTH_SCOPE:l('name')+'/process'}:{...common,DATABASE_USER:l('worker_db_user'),PARSER_ENDPOINT:l('parser_endpoint'),MODEL_ID:model,MAX_OUTPUT_TOKENS:'2048',DESTINATION_ENDPOINT:endpoint,DESTINATION_SCOPE:scope,DESTINATION_REPLAY_REVIEW_BASE64:v('replay_review_base64')};
+  const container={name:purpose,image,essential:true,readonlyRootFilesystem:true,portMappings:[{containerPort:8080,protocol:'tcp'}],environment:Object.entries(settings).map(([name,value])=>({name,value})),mountPoints:[{sourceVolume:'runtime-tmp',containerPath:'/tmp',readOnly:false}],dependsOn:[{containerName:'prepare-tmp',condition:'SUCCESS'}],logConfiguration:{logDriver:'awslogs',options:{'awslogs-group':r('aws_cloudwatch_log_group',n+'_'+purpose,'name'),'awslogs-region':region,'awslogs-stream-prefix':purpose}},...(purpose==='api'?{}:{command:['python','-I','/app/'+(purpose==='worker'?'invoice_worker.py':'invoice_parser_service.py')]}),...(purpose==='worker'?{secrets:[{name:'DESTINATION_TOKEN',valueFrom:r('aws_secretsmanager_secret',n+'_destination','arn')}]}:{})};
+  const init={name:'prepare-tmp',image,essential:false,user:'0:0',readonlyRootFilesystem:true,command:['python','-I','-c','import os;os.chmod("/runtime-tmp",0o1777)'],mountPoints:[{sourceVolume:'runtime-tmp',containerPath:'/runtime-tmp',readOnly:false}]};
+  add('aws_ecs_task_definition',n+'_'+purpose,{count:'${var.applications_enabled ? 1 : 0}',family:l('name')+'-'+purpose,network_mode:'awsvpc',requires_compatibilities:['FARGATE'],cpu:purpose==='parser'?'1024':'512',memory:purpose==='parser'?'2048':'1024',execution_role_arn:r('aws_iam_role',n+'_'+purpose+'_execution','arn'),...(purpose!=='parser'?{task_role_arn:r('aws_iam_role',n+'_'+purpose,'arn')}:{}),volume:{name:'runtime-tmp'},runtime_platform:{operating_system_family:'LINUX',cpu_architecture:'X86_64'},container_definitions:JSON.stringify([init,container]),depends_on:['aws_iam_role_policy.'+n+'_'+purpose+'_execution',...(purpose!=='parser'?['aws_iam_role_policy.'+n+'_'+purpose]:[])]});
+  add('aws_ecs_service',n+'_'+purpose,{count:'${var.applications_enabled ? 1 : 0}',name:l('name')+'-'+purpose,cluster:r('aws_ecs_cluster',n,'id'),task_definition:r('aws_ecs_task_definition',n+'_'+purpose+'[0]','arn'),desired_count:1,launch_type:'FARGATE',platform_version:'1.4.0',deployment_circuit_breaker:{enable:true,rollback:true},network_configuration:{subnets:privateSubnets,security_groups:[r('aws_security_group',n+'_'+purpose,'id')],assign_public_ip:false},...(purpose!=='worker'?{load_balancer:{target_group_arn:r('aws_lb_target_group',n+'_'+purpose,'arn'),container_name:purpose,container_port:8080},health_check_grace_period_seconds:90}:{}),depends_on:['aws_lb_listener.'+n+'_api','aws_lb_listener.'+n+'_parser','aws_route_table_association.'+n+'_private_0','aws_route_table_association.'+n+'_private_1']});
+ }
+ b.output.application_url={value:l('public_origin')};b.output.runtime_repository={value:r('aws_ecr_repository',n+'_runtime','repository_url')};b.output.parser_repository={value:r('aws_ecr_repository',n+'_parser','repository_url')};b.output.account_identity={value:l('account_uuid')};
+ b.output.operator_deployment={value:{provider:'aws',deploymentId:l('account_uuid'),accountId:l('account_uuid'),namespace:'invoice',tenantId:null,bindings:Object.fromEntries(['api','worker'].map(purpose=>[purpose,{name:l(purpose+'_db_user'),principal:r('aws_iam_role',n+'_'+purpose,'arn')}]))}};
+ awsInvoiceOperations(b,n,{account,region,privateSubnets,trust});
+ b.output.database_bootstrap={value:{host:r('aws_db_instance',n,'address'),database:'invoice',adminSecretArn:r('aws_db_instance',n,'master_user_secret[0].secret_arn'),apiRole:l('api_db_user'),workerRole:l('worker_db_user'),apiPrincipal:r('aws_iam_role',n+'_api','arn'),workerPrincipal:r('aws_iam_role',n+'_worker','arn'),destinationSecretArn:r('aws_secretsmanager_secret',n+'_destination','arn')}};
+ b.assertions.push(`run "private_database_and_parser" {\n command = plan\n assert {\n condition = aws_db_instance.${n}.publicly_accessible == false && aws_db_instance.${n}.iam_database_authentication_enabled && aws_db_instance.${n}.storage_encrypted && aws_lb.${n}_parser.internal\n error_message = "Database and parser must retain their private, encrypted and IAM boundaries."\n }\n assert {\n condition = aws_ecs_task_definition.${n}_parser[0].task_role_arn == null\n error_message = "Parser must not inherit application data/model authority."\n }\n}\nrun "foundation_only" {\n command = plan\n variables {\n applications_enabled = false\n operations_enabled = false\n maintenance_enabled = false\n }\n assert {\n condition = length(aws_ecs_service.${n}_api) == 0 && length(aws_ecs_service.${n}_worker) == 0 && length(aws_ecs_service.${n}_parser) == 0\n error_message = "Bootstrap and publication must precede application release."\n }\n}`);
+ b.assertions.push(`run "foreign_image_rejected" {\n command = plan\n variables { runtime_image = "123456789012.dkr.ecr.ap-southeast-2.amazonaws.com/foreign@sha256:${'a'.repeat(64)}" }\n expect_failures = [terraform_data.review_gate]\n}\nrun "mutable_image_rejected" {\n command = plan\n variables { runtime_image = "unreviewed:latest" }\n expect_failures = [var.runtime_image]\n}\nrun "foreign_account_rejected" {\n command = plan\n variables {\n account_id = "999999999999"\n applications_enabled = false\n operations_enabled = false\n maintenance_enabled = false\n }\n expect_failures = [terraform_data.review_gate]\n}\n`);
+ const mock='mock_provider "aws" {\n override_during = plan\n mock_resource "aws_iam_role" { defaults = { arn="arn:aws:iam::123456789012:role/owned-fixture" } }\n override_resource {\n target = aws_iam_role.'+n+'_api\n values = { arn="arn:aws:iam::123456789012:role/owned-api-fixture" }\n }\n override_resource {\n target = aws_iam_role.'+n+'_worker\n values = { arn="arn:aws:iam::123456789012:role/owned-worker-fixture" }\n }\n mock_resource "aws_s3_bucket" { defaults = { id="fixture-invoices",arn="arn:aws:s3:::fixture-invoices" } }\n mock_resource "aws_secretsmanager_secret" { defaults = { arn="arn:aws:secretsmanager:ap-southeast-2:123456789012:secret:owned-destination-fixture" } }\n mock_resource "aws_db_instance" { defaults = { address = "fixture.abcdef.ap-southeast-2.rds.amazonaws.com", master_user_secret = [{secret_arn="arn:aws:secretsmanager:ap-southeast-2:123456789012:secret:owned-operator-fixture",kms_key_id="owned-native-key",secret_status="active"}] } }\n mock_resource "aws_cognito_user_pool" { defaults = { id = "ap-southeast-2_Fixture" } }\n mock_resource "aws_cognito_user_pool_client" { defaults = { id = "fixtureclient123" } }\n mock_data "aws_caller_identity" { defaults = { account_id = "123456789012" } }\n mock_data "aws_availability_zones" { defaults = { names = ["ap-southeast-2a","ap-southeast-2b"] } }\n mock_data "aws_route53_zone" { defaults = { name = "example.test.",private_zone = false } }\n}\n';
+ return b.finish({aws:{region,allowed_account_ids:[account]}},{aws:{source:'hashicorp/aws',version:'6.72.0'}},CLOUD_PROVIDER_LOCKS.aws,mock,AWS_INVOICE_GUIDE);
+}
+
+export const AWS_INVOICE_GUIDE=`# AWS invoice workflow infrastructure
+
+New private VPC/subnets, regional NAT, IAM-authenticated Multi-AZ PostgreSQL 17,
+private versioned invoice bucket, invited/MFA Cognito users, separate API/worker
+roles, a role-free isolated parser task, ECR repositories and regional TLS ingress.
+The public Route53 zone and external accounting system remain existing references.
+
+Run foundation first with applications_enabled=false. Build/scan/publish the exact
+emitted runtime/parser images only after authorization. Bootstrap SQL logins/grants,
+schema using the emitted fixed operator initialize task, then admit verified staff
+memberships with the separate operator CLI; populate the
+accounting secret outside Terraform state/source. Then review a plan enabling the
+application release with operations_enabled=true and maintenance_enabled=true.
+Native platform secret injection becomes a private temporary
+file; credential rotation requires an explicit workload rollout. Never put secret
+values in tfvars, source, build context or command arguments.
+
+Parser ingress is private HTTPS restricted to the worker security group. TLS ends
+at its internal regional ALB; the target HTTP hop is inside restricted private
+security groups. The parser has no task IAM role, data/model grant, secret injection
+or outbound security-group rule. A short trusted root init container prepares only
+the ephemeral temporary volume; processing containers retain nonroot image users.
+No Docker daemon is installed in the worker. Verify actual platform isolation and
+effective inherited IAM in an authorized staging environment before production.
+
+The storage lifecycle expires current originals after 90 days and noncurrent
+versions after one additional day; physical provider deletion is asynchronous.
+Application payload access expires independently of physical cleanup. The emitted
+OPERATIONS.md and invoice_operator.py implement scoped audit cleanup, restored
+delivery quarantine and explicit completion reconciliation. Fixed Fargate operator
+tasks, daily expired-only cleanup and hourly count-only monitoring are emitted;
+review their existing same-account SNS alert route and verify its subscribed
+notification/publish policy before release. Scheduler delivery failures and stopped
+operator failures reach a private encrypted queue; missing successful receipts also
+alarm. No accounting/model/object/task IAM role is given to an operator container.
+The platform execution role can fetch only the managed RDS admin secret password,
+owned image and logs. Bootstrap is manual and never scheduled. Native operating
+checks and alert delivery remain destination acceptance steps. Seven-day encrypted database backups may
+contain older data; review the stated backup/retention policy before deployment.
+No static/mock check establishes an exact deletion deadline or cloud restore.
+
+The single NAT, ALBs, managed database and continuously running tasks have fixed
+cost drivers. Review actual regional rates, service/model availability and quotas;
+no invented quote, price cap, throughput/latency SLA or deployment claim is made.
+Infrastructure emission remains under qualification until the complete project,
+operations, native account inputs and original full business brief are checked.
+`;

package/src/invoice-azure-operations.mjs

@@ -0,0 +1,147 @@
+import{v,r,l}from'./invoice-builder.mjs';
+
+// Separate trusted operator jobs. Job start permission is privileged because the
+// native API accepts execution-template overrides; never grant it to the product.
+export function azureInvoiceOperations(b,n,{rg,rgId,region,subscription,identity}){
+ const{add,input}=b;
+ for(const key of ['operations_enabled','maintenance_enabled']){b.variable[key]={type:'bool',default:false,description:key==='operations_enabled'?'Create manual fixed operator jobs after reviewed immutable image publication.':'After successful bootstrap/membership and log-query verification, schedule daily retention/hourly monitor and enable alerts.'};b.examples[key]=false;b.testExpressions[key]='true';}
+ const actionGroup=input('operator_action_group_id','Existing reviewed same-subscription Azure Monitor action group with a verified on-call route; referenced without modifying it.','/subscriptions/'+b.examples.subscription_id+'/resourceGroups/reviewed-operations/providers/Microsoft.Insights/actionGroups/on-call','^/subscriptions/[0-9a-f-]{36}/resourceGroups/[^/]+/providers/Microsoft\\.Insights/actionGroups/[^/]+$');
+ b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${!var.maintenance_enabled || var.operations_enabled}',error_message:'Maintenance requires its separate owned operator jobs.'},{condition:'${!var.applications_enabled || (var.operations_enabled && var.maintenance_enabled)}',error_message:'Complete owned SQL/membership bootstrap and operating-log acceptance before application release.'},{condition:'${startswith(lower(var.operator_action_group_id),format("/subscriptions/%s/",var.subscription_id))}',error_message:'Use the reviewed existing notification group in this subscription.'});
+ b.locals.operator_deployment=b.output.operator_deployment.value;
+ const environment=r('azurerm_container_app_environment',n,'id'),workspace=r('azurerm_log_analytics_workspace',n,'id');
+ add('azurerm_log_analytics_workspace',n,{name:l('name')+'-operations',resource_group_name:rg,location:region,sku:'PerGB2018',retention_in_days:30,lifecycle:{prevent_destroy:true}});
+ // Azure Monitor routing avoids the legacy HTTP Data Collector/_CL path. The
+ // destination alone is insufficient: both log categories are explicitly routed.
+ b.resource.azurerm_container_app_environment[n].logs_destination='azure-monitor';
+ add('azurerm_monitor_diagnostic_setting',n+'_environment',{name:'invoice-operating-logs',target_resource_id:environment,log_analytics_workspace_id:workspace,log_analytics_destination_type:'Dedicated',enabled_log:[{category:'ContainerAppConsoleLogs'},{category:'ContainerAppSystemLogs'}]});
+ const settings={DATABASE_NAME:'invoice',DATABASE_HOST:r('azurerm_postgresql_flexible_server',n,'fqdn'),DATABASE_USER:l('name')+'-operator',DATABASE_CA_FILE:'/usr/local/lib/python3.13/site-packages/certifi/cacert.pem',WORKLOAD_IDENTITY_CLIENT_ID:identity('operator','client_id'),OPERATOR_DEPLOYMENT_BASE64:'${base64encode(jsonencode(local.operator_deployment))}'};
+ const common={replicaTimeout:900,replicaRetryLimit:0,registries:[{server:r('azurerm_container_registry',n,'login_server'),identity:identity('pull','id')}],identitySettings:[{identity:identity('pull','id'),lifecycle:'None'},{identity:identity('operator','id'),lifecycle:'Main'}]};
+ for(const action of ['initialize','maintain','monitor']){
+  const manual={...common,triggerType:'Manual',manualTriggerConfig:{parallelism:1,replicaCompletionCount:1}};
+  const scheduled={...common,triggerType:'Schedule',scheduleTriggerConfig:{cronExpression:action==='maintain'?'17 2 * * *':'7 * * * *',parallelism:1,replicaCompletionCount:1}};
+  // Decode one of two complete configurations, omitting the inactive trigger
+  // rather than sending optional ARM objects as explicit null values.
+  const configuration=action==='initialize'?manual:'${jsondecode(var.maintenance_enabled ? jsonencode('+JSON.stringify(scheduled)+') : jsonencode('+JSON.stringify(manual)+'))}';
+  add('azapi_resource',n+'_operator_'+action,{count:'${var.operations_enabled ? 1 : 0}',type:'Microsoft.App/jobs@2025-07-01',name:l('name')+'-'+action,parent_id:rgId,location:region,identity:{type:'UserAssigned',identity_ids:[identity('pull','id'),identity('operator','id')]},body:{properties:{environmentId:environment,workloadProfileName:'Consumption',configuration,template:{containers:[{name:'operator',image:v('runtime_image'),command:['python','-I','/app/invoice_operator_job.py',action,'--execute'],resources:{cpu:0.5,memory:'1Gi'},env:Object.entries(settings).map(([name,value])=>({name,value}))}]}}},schema_validation_enabled:true,response_export_values:['properties.configuration.triggerType'],depends_on:['azurerm_role_assignment.'+n+'_pull','azurerm_postgresql_flexible_server_active_directory_administrator.'+n,'azurerm_postgresql_flexible_server_database.'+n,'azurerm_monitor_diagnostic_setting.'+n+'_environment']});
+  const prefix='${local.name}-'+action;
+  const owned=`| where EnvironmentName == '${l('name')}'\n| where JobName == '${prefix}' or JobName startswith '${prefix}-' or ContainerGroupName startswith '${prefix}-'`;
+  if(action!=='initialize'){
+   const hours=action==='maintain'?48:2;
+   const query=`ContainerAppConsoleLogs\n| where TimeGenerated > ago(${hours}h)\n${owned}\n| where ContainerName == 'operator'\n| extend receipt = parse_json(Log)\n| where receipt.format == 'invoice-operator-v1' and receipt.action == '${action}' and receipt.status == 'ok'\n| summarize SuccessfulRuns=count()\n| where SuccessfulRuns < 1`;
+   add('azurerm_monitor_scheduled_query_rules_alert_v2',n+'_'+action+'_missing',{name:l('name')+'-'+action+'-missing',resource_group_name:rg,location:region,scopes:[workspace],severity:2,evaluation_frequency:'PT1H',window_duration:action==='maintain'?'P2D':'PT2H',enabled:v('maintenance_enabled'),skip_query_validation:'${!var.maintenance_enabled}',auto_mitigation_enabled:true,description:'Missing count-only success receipt. Initial manual bootstrap/log ingestion precedes enabling scheduled operating jobs; verify notification delivery.',criteria:{query,time_aggregation_method:'Count',operator:'GreaterThan',threshold:0,failing_periods:{number_of_evaluation_periods:1,minimum_failing_periods_to_trigger_alert:1}},action:{action_groups:[actionGroup]},depends_on:['azurerm_monitor_diagnostic_setting.'+n+'_environment']});
+   b.files['monitoring/'+action+'-missing.kql']=query+'\n';
+  }
+  const consoleQuery=`ContainerAppConsoleLogs\n| where TimeGenerated > ago(1h)\n${owned}\n| where ContainerName == 'operator'\n| extend receipt=parse_json(Log)\n| where receipt.format == 'invoice-operator-v1' and receipt.status in ('failed','attention','backlog')\n| project TimeGenerated`;
+  // System logs use ReplicaName (not console ContainerGroupName). Include image
+  // pull/scheduling warnings so failures before Python startup are not invisible.
+  const systemOwned=`| where EnvironmentName == '${l('name')}'\n| where JobName == '${prefix}' or JobName startswith '${prefix}-' or ReplicaName startswith '${prefix}-'`;
+  const query=`union (\n${consoleQuery}\n), (\nContainerAppSystemLogs\n| where TimeGenerated > ago(1h)\n${systemOwned}\n| where Type =~ 'Warning' or Type =~ 'Error'\n| project TimeGenerated\n)\n| summarize Failures=count()\n| where Failures > 0`;
+  add('azurerm_monitor_scheduled_query_rules_alert_v2',n+'_'+action+'_failed',{name:l('name')+'-'+action+'-failed',resource_group_name:rg,location:region,scopes:[workspace],severity:2,evaluation_frequency:'PT5M',window_duration:'PT1H',enabled:v('operations_enabled'),skip_query_validation:'${!var.maintenance_enabled}',auto_mitigation_enabled:true,description:'Fixed operator failure/attention or native platform warning/error. Inspect trusted operator execution history; never replay uncertain accounting effects.',criteria:{query,time_aggregation_method:'Count',operator:'GreaterThan',threshold:0,failing_periods:{number_of_evaluation_periods:1,minimum_failing_periods_to_trigger_alert:1}},action:{action_groups:[actionGroup]},depends_on:['azurerm_monitor_diagnostic_setting.'+n+'_environment']});
+  b.files['monitoring/'+action+'-failed.kql']=query+'\n';
+ }
+ b.output.operator_jobs={value:{resourceGroup:rg,initialize:l('name')+'-initialize',maintain:l('name')+'-maintain',monitor:l('name')+'-monitor',workspace:workspace,actionGroup:actionGroup,operatorPrincipal:identity('operator','principal_id'),operatorClientId:identity('operator','client_id'),permissionBoundary:'Only a trusted destination operator may start jobs. Native start accepts execution-template overrides; no start/RBAC permission is given to API or worker.'}};
+ b.output.operator_start_urls={value:Object.fromEntries(['initialize','maintain','monitor'].map(action=>[action,rgId+'/providers/Microsoft.App/jobs/'+l('name')+'-'+action+'/start?api-version=2025-07-01']))};
+ b.output.operator_bootstrap_url={value:rgId+'/providers/Microsoft.App/jobs/'+l('name')+'-initialize/start?api-version=2025-07-01',description:'Use only after the reviewed operations-enabled resources have actually been applied. A URL is not proof the job exists.'};
+ b.files['OPERATING_JOBS.md']=AZURE_OPERATING_JOBS;
+ b.assertions.push(`run "manual_operator_before_applications" {
+ command = plan
+ variables {
+ applications_enabled = false
+ maintenance_enabled = false
+ staff_subjects = []
+ }
+ assert {
+ condition = azapi_resource.${n}_operator_initialize[0].body.properties.configuration.triggerType == "Manual" && azapi_resource.${n}_operator_maintain[0].body.properties.configuration.triggerType == "Manual" && length(azapi_resource.${n}_api) == 0
+ error_message = "Manual SQL bootstrap/log qualification must precede scheduled operations and application release."
+ }
+}
+run "scheduled_jobs_and_log_validation" {
+ command = plan
+ assert {
+ condition = azapi_resource.${n}_operator_initialize[0].body.properties.configuration.triggerType == "Manual" && azapi_resource.${n}_operator_maintain[0].body.properties.configuration.triggerType == "Schedule" && azapi_resource.${n}_operator_monitor[0].body.properties.configuration.replicaTimeout == 900 && !azurerm_monitor_scheduled_query_rules_alert_v2.${n}_monitor_missing.skip_query_validation && azurerm_container_app_environment.${n}.logs_destination == "azure-monitor"
+ error_message = "Application release must include scheduled operations and mandatory current-table query validation."
+ }
+}
+run "operating_jobs_required" {
+ command = plan
+ variables {
+ operations_enabled = false
+ maintenance_enabled = false
+ }
+ expect_failures = [terraform_data.review_gate]
+}
+run "operator_mutable_image_rejected" {
+ command = plan
+ variables {
+ applications_enabled = false
+ maintenance_enabled = false
+ runtime_image = "unreviewed:latest"
+ }
+ expect_failures = [var.runtime_image]
+}
+`);
+}
+
+const AZURE_OPERATING_JOBS=`# Azure invoice operating jobs
+
+Obtain authorization before destination writes, publication, apply or job start.
+The emitted native jobs are fixed trusted operator tools, not API/model endpoints.
+Azure job start accepts an execution template that can override image/command/env.
+Treat start permission as access to the job's available managed identity. Never
+grant job start/contributor/operator or listSecrets rights to the product, end users,
+worker, parser or an untrusted automation identity. This package assigns none.
+
+Foundation: applications_enabled=false, operations_enabled=false,
+maintenance_enabled=false. Review regional availability, model/version, identity,
+costs and existing operator_action_group_id. No existing action group or its routes
+are adopted or modified. Verify its actual notification recipients and delivery.
+Azure Monitor and resource-specific log tables are used; diagnostic routing includes
+both console and system logs. Logs retain 30 days, separate from 90-day invoices.
+Provider-managed state must remain private/encrypted; do not publish workspace keys.
+
+After authorized build/scan/publication of the immutable runtime image to owned ACR,
+set operations_enabled=true with applications_enabled/maintenance_enabled=false.
+All three jobs are Manual. The pull identity has lifecycle None; only the separate
+PostgreSQL Entra administrator identity has lifecycle Main. There is no password,
+accounting secret, model, object access or HTTP ingress on these jobs. The exact
+operator identity and login bind token acquisition to the managed database.
+
+Start initialize as the trusted destination operator:
+
+    az rest --method post --url "$(terraform output -raw operator_bootstrap_url)" --body '{}'
+
+The shared core maps owned API/worker principals in postgres, then initializes
+the application schema/grants/account in invoice. Check completed execution status,
+exit code and initialized:true log receipt; start acceptance alone proves neither.
+Admit verified staff subjects/roles using the separate membership CLI/runbook.
+Do not infer reviewer privileges from Entra app access. Keep accounting secret
+population separate from this SQL-only operator identity.
+
+The nonsecret operator_start_urls output gives the exact remaining start endpoints;
+call them with an empty JSON body as above. Do not override image/command/template.
+Start maintain and monitor manually and check count-only receipts and both native
+log tables. Query files are in monitoring/. Validate their ownership filters against
+actual JobName/replica fields at the destination. Alerts are initially unvalidated
+while fresh tables do not yet exist. Enabling maintenance_enabled makes ARM query
+validation mandatory; a missing/incorrect table/query must block release, not be
+silently skipped. Log ingestion/diagnostic activation can be delayed. Verify actual
+queries and an action-group test notification before enabling scheduled release.
+
+Release with operations_enabled=true, maintenance_enabled=true and
+applications_enabled=true. Bootstrap stays Manual. Maintain runs 02:17 UTC daily;
+monitor at minute 7 hourly. Completion/parallelism is one, native retry is zero and
+replica timeout is 900 seconds. The shared process deadline and SQL statement/lock
+bounds apply as well. Scheduling does not prove native IAM/SQL/network/alerts worked.
+
+Daily expired-only SQL cleanup is bounded to twenty 500-record transactions and
+refuses live execution jobs/leases. New/young operations survive; original-object
+expiry is a separate asynchronous lifecycle. Monitoring is a read-only count-only
+transaction. Two hours of missing monitor receipts and 48 hours of missing cleanup
+receipts alert, along with failure/attention/backlog and platform warnings/errors.
+These are explicit operating defaults, not promised availability or a client SLA.
+No KQL engine or Azure Monitor ingestion/notification execution is proved by local
+provider schemas/mocks. Retain actual destination acceptance before production.
+
+Restore/quarantine/reconciliation still require an isolated paused destination.
+Never use daily maintenance to reset or resend unknown accounting side effects.
+`;

package/src/invoice-azure.mjs

@@ -0,0 +1,134 @@
+import {invoiceBuilder,v,r,l,UUID}from'./invoice-builder.mjs';
+import {CLOUD_PROVIDER_LOCKS}from'./cloud-provider-locks.mjs';
+import {azureInvoiceOperations}from'./invoice-azure-operations.mjs';
+import azapi from'./runtime/invoice-azapi-provider-lock.json'with{type:'json'};
+
+// Native composition under qualification; not a registered complete capability.
+export function azureInvoiceTerraform(project,row,environment='staging'){
+ if(row.provider!=='azure')throw Error('Azure invoice compilation cannot substitute another cloud');
+ const b=invoiceBuilder(project,row,environment),{input,add,region}=b,n=row.address;
+ const seed=b.seed;
+ const subscription=input('subscription_id','Expected reviewed Azure subscription.','11111111-1111-1111-1111-111111111111',UUID);
+ const tenant=input('tenant_id','Expected company Entra tenant, bound in both control-plane and application identities.','22222222-2222-2222-2222-222222222222',UUID);
+ const endpoint=input('accounting_endpoint','Existing reviewed accounting HTTPS adapter; never recreated.','https://accounting.example.test/actions','^https://[A-Za-z0-9.-]+(:[0-9]{1,5})?(/[^?#@ ]*)?$');
+ const scope=input('accounting_scope','Existing accounting scope bound into approvals.','owned-team','^[A-Za-z0-9_.:/-]{1,200}$');
+ const model=input('model_name','Reviewed regional Azure OpenAI structured-output model; confirm current availability and terms.','REVIEW_MODEL');
+ const modelVersion=input('model_version','Explicit supported regional model version; no silent upgrade.','REVIEW_VERSION');
+ for(const purpose of ['runtime','parser']){
+  const key=purpose+'_image';input(key,'Reviewed immutable image published in the emitted private ACR. Empty during foundation.','reviewedregistry.azurecr.io/invoice/'+purpose+'@sha256:'+'a'.repeat(64));
+  b.variable[key].default='';b.variable[key].validation={condition:'${!('+(purpose==='runtime'?'var.applications_enabled || var.operations_enabled':'var.applications_enabled')+') || can(regex("@sha256:[0-9a-f]{64}$",var.'+key+'))}',error_message:'Application release requires an immutable reviewed image digest.'};
+ }
+ b.variable.staff_subjects={type:'set(string)',default:[],validation:{condition:'${alltrue([for subject in var.staff_subjects : can(regex('+JSON.stringify(UUID)+',subject))])}',error_message:'Supply verified native employee object IDs.'},description:'Explicit existing staff object IDs assigned application access. SQL memberships independently assign reviewer/user authority.'};
+ b.examples.staff_subjects=['55555555-5555-5555-5555-555555555555'];
+ b.variable.replay_review_base64={type:'string',default:'',description:'Scoped expiring accounting idempotency review; empty disables uncertain replay.'};b.examples.replay_review_base64='';
+ b.data.azurerm_client_config={operator:{}};
+ b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${data.azurerm_client_config.operator.subscription_id == var.subscription_id && data.azurerm_client_config.operator.tenant_id == var.tenant_id && (!var.applications_enabled || length(var.staff_subjects)>0)}',error_message:'Use the reviewed subscription/tenant and explicitly admitted staff identities.'});
+ Object.assign(b.locals,{storage_name:'${format("%sdocs",replace(local.name,"-",""))}',registry_name:'${format("%sacr",replace(local.name,"-",""))}',public_origin:'${format("https://%s-api.%s",local.name,azurerm_container_app_environment.'+n+'.default_domain)}',parser_endpoint:'${format("https://%s-parser.internal.%s/extract",local.name,azurerm_container_app_environment.'+n+'.default_domain)}',destination_contract:{id:'normalized-action-v1',endpointSha256:'${sha256(var.accounting_endpoint)}',scope,mappingVersion:1},destination_contract_base64:'${base64encode(jsonencode(local.destination_contract))}'});
+ add('azurerm_resource_group',n,{name:l('name'),location:region});const rg=r('azurerm_resource_group',n,'name'),rgId=r('azurerm_resource_group',n,'id');
+ add('azurerm_virtual_network',n,{name:l('name'),resource_group_name:rg,location:region,address_space:['10.85.0.0/16']});
+ for(const[purpose,cidr]of Object.entries({apps:'10.85.0.0/23',database:'10.85.4.0/24',endpoints:'10.85.5.0/24'}))add('azurerm_subnet',n+'_'+purpose,{name:purpose,resource_group_name:rg,virtual_network_name:r('azurerm_virtual_network',n,'name'),address_prefixes:[cidr],...(purpose==='database'?{delegation:{name:'postgres',service_delegation:{name:'Microsoft.DBforPostgreSQL/flexibleServers',actions:['Microsoft.Network/virtualNetworks/subnets/join/action']}}}:{})});
+ add('azurerm_public_ip',n,{name:l('name')+'-egress',resource_group_name:rg,location:region,allocation_method:'Static',sku:'Standard'});
+ add('azurerm_nat_gateway',n,{name:l('name'),resource_group_name:rg,location:region,sku_name:'Standard'});
+ add('azurerm_nat_gateway_public_ip_association',n,{nat_gateway_id:r('azurerm_nat_gateway',n,'id'),public_ip_address_id:r('azurerm_public_ip',n,'id')});
+ add('azurerm_subnet_nat_gateway_association',n,{subnet_id:r('azurerm_subnet',n+'_apps','id'),nat_gateway_id:r('azurerm_nat_gateway',n,'id')});
+ const dns={database:'private.postgres.database.azure.com',blob:'privatelink.blob.core.windows.net',model:'privatelink.openai.azure.com',vault:'privatelink.vaultcore.azure.net'};
+ for(const[purpose,name]of Object.entries(dns)){
+  add('azurerm_private_dns_zone',n+'_'+purpose,{name,resource_group_name:rg});
+  add('azurerm_private_dns_zone_virtual_network_link',n+'_'+purpose,{name:purpose,resource_group_name:rg,private_dns_zone_name:r('azurerm_private_dns_zone',n+'_'+purpose,'name'),virtual_network_id:r('azurerm_virtual_network',n,'id'),registration_enabled:false});
+ }
+ for(const purpose of ['api','worker','pull','operator'])add('azurerm_user_assigned_identity',n+'_'+purpose,{name:l('name')+'-'+purpose,resource_group_name:rg,location:region});
+ const identity=(purpose,attribute)=>r('azurerm_user_assigned_identity',n+'_'+purpose,attribute);
+ add('azurerm_postgresql_flexible_server',n,{name:l('name'),resource_group_name:rg,location:region,version:'17',sku_name:'GP_Standard_D2ds_v5',storage_mb:32768,auto_grow_enabled:true,backup_retention_days:7,geo_redundant_backup_enabled:false,delegated_subnet_id:r('azurerm_subnet',n+'_database','id'),private_dns_zone_id:r('azurerm_private_dns_zone',n+'_database','id'),public_network_access_enabled:false,authentication:{active_directory_auth_enabled:true,password_auth_enabled:false,tenant_id:tenant},high_availability:{mode:'ZoneRedundant'},lifecycle:{prevent_destroy:true},depends_on:['azurerm_private_dns_zone_virtual_network_link.'+n+'_database']});
+ add('azurerm_postgresql_flexible_server_database',n,{name:'invoice',server_id:r('azurerm_postgresql_flexible_server',n,'id'),charset:'UTF8',collation:'en_US.utf8',lifecycle:{prevent_destroy:true}});
+ add('azurerm_postgresql_flexible_server_active_directory_administrator',n,{server_name:r('azurerm_postgresql_flexible_server',n,'name'),resource_group_name:rg,tenant_id:tenant,object_id:identity('operator','principal_id'),principal_name:l('name')+'-operator',principal_type:'ServicePrincipal'});
+ for(const[name,value]of Object.entries({require_secure_transport:'ON',log_statement:'none',log_min_error_statement:'panic',log_parameter_max_length_on_error:'0'}))add('azurerm_postgresql_flexible_server_configuration',n+'_'+name,{name,server_id:r('azurerm_postgresql_flexible_server',n,'id'),value});
+ add('azurerm_storage_account',n,{name:l('storage_name'),resource_group_name:rg,location:region,account_tier:'Standard',account_replication_type:'ZRS',min_tls_version:'TLS1_2',shared_access_key_enabled:false,allow_nested_items_to_be_public:false,public_network_access_enabled:false,default_to_oauth_authentication:true,blob_properties:{versioning_enabled:true},lifecycle:{prevent_destroy:true}});
+ add('azurerm_storage_container',n,{name:'invoices',storage_account_id:r('azurerm_storage_account',n,'id'),container_access_type:'private',lifecycle:{prevent_destroy:true}});
+ add('azurerm_storage_management_policy',n,{storage_account_id:r('azurerm_storage_account',n,'id'),rule:[{name:'invoice-retention',enabled:true,filters:{prefix_match:['invoices/accounts/'],blob_types:['blockBlob']},actions:{base_blob:{delete_after_days_since_modification_greater_than:90},version:{delete_after_days_since_creation:1}}}]});
+ add('azurerm_container_registry',n,{name:l('registry_name'),resource_group_name:rg,location:region,sku:'Standard',admin_enabled:false,anonymous_pull_enabled:false,lifecycle:{prevent_destroy:true}});
+ add('azurerm_key_vault',n,{name:l('name'),resource_group_name:rg,location:region,tenant_id:tenant,sku_name:'standard',rbac_authorization_enabled:true,purge_protection_enabled:true,soft_delete_retention_days:90,public_network_access_enabled:false,lifecycle:{prevent_destroy:true}});
+ add('azurerm_cognitive_account',n,{name:l('name')+'-model',resource_group_name:rg,location:region,kind:'OpenAI',sku_name:'S0',custom_subdomain_name:l('name')+'-model',local_auth_enabled:false,public_network_access_enabled:false,lifecycle:{prevent_destroy:true}});
+ add('azurerm_cognitive_deployment',n,{name:'invoice-extraction',cognitive_account_id:r('azurerm_cognitive_account',n,'id'),version_upgrade_option:'NoAutoUpgrade',model:{format:'OpenAI',name:model,version:modelVersion},sku:{name:'Standard',capacity:1}});
+ for(const[purpose,type,group]of [['blob','azurerm_storage_account','blob'],['model','azurerm_cognitive_account','account'],['vault','azurerm_key_vault','vault']])add('azurerm_private_endpoint',n+'_'+purpose,{name:l('name')+'-'+purpose,resource_group_name:rg,location:region,subnet_id:r('azurerm_subnet',n+'_endpoints','id'),private_service_connection:{name:purpose,private_connection_resource_id:r(type,n,'id'),subresource_names:[group],is_manual_connection:false},private_dns_zone_group:{name:'owned',private_dns_zone_ids:[r('azurerm_private_dns_zone',n+'_'+purpose,'id')]}});
+ const role=(suffix,scope,role_definition_name,principal_id)=>add('azurerm_role_assignment',n+'_'+suffix,{scope,role_definition_name,principal_id,skip_service_principal_aad_check:true});
+ role('pull',r('azurerm_container_registry',n,'id'),'AcrPull',identity('pull','principal_id'));
+ role('model',r('azurerm_cognitive_account',n,'id'),'Cognitive Services OpenAI User',identity('worker','principal_id'));role('model_policy',r('azurerm_cognitive_account',n,'id'),'Reader',identity('worker','principal_id'));
+ // This owned vault is dedicated to the one accounting credential. Vault scope
+ // permits metadata/bootstrap before the separately populated secret exists.
+ role('destination',r('azurerm_key_vault',n,'id'),'Key Vault Secrets User',identity('worker','principal_id'));
+ role('operator_secrets',r('azurerm_key_vault',n,'id'),'Key Vault Secrets Officer',r('data.azurerm_client_config','operator','object_id'));
+ add('azurerm_role_definition',n+'_documents',{name:l('name')+'-upload-read',scope:rgId,assignable_scopes:[rgId],description:'Private invoice upload/read without object deletion or administrative account access.',permissions:{actions:[],not_actions:[],data_actions:['Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read','Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write'],not_data_actions:[]}});
+ add('azurerm_role_assignment',n+'_upload',{scope:r('azurerm_storage_container',n,'id'),role_definition_id:r('azurerm_role_definition',n+'_documents','role_definition_resource_id'),principal_id:identity('api','principal_id'),skip_service_principal_aad_check:true});
+ role('read_documents',r('azurerm_storage_container',n,'id'),'Storage Blob Data Reader',identity('worker','principal_id'));
+ add('azurerm_container_app_environment',n,{name:l('name'),resource_group_name:rg,location:region,infrastructure_subnet_id:r('azurerm_subnet',n+'_apps','id'),internal_load_balancer_enabled:false,workload_profile:{name:'Consumption',workload_profile_type:'Consumption'},depends_on:['azurerm_subnet_nat_gateway_association.'+n,'azurerm_nat_gateway_public_ip_association.'+n]});
+ for(const suffix of ['', '_spa','_parser'])add('azuread_application_registration',n+suffix,{display_name:l('name')+(suffix||'-api'),sign_in_audience:'AzureADMyOrg',requested_access_token_version:2,implicit_access_token_issuance_enabled:false,implicit_id_token_issuance_enabled:false});
+ const app=(suffix,attribute)=>r('azuread_application_registration',n+suffix,attribute),apiClient=app('','client_id'),spaClient=app('_spa','client_id'),parserClient=app('_parser','client_id');
+ const uuid=purpose=>'${uuidv5("url",format("%s:%s:'+purpose+'",var.tenant_id,local.name))}';
+ for(const suffix of ['','_parser'])add('azuread_application_identifier_uri',n+suffix,{application_id:app(suffix,'id'),identifier_uri:'api://'+app(suffix,'client_id')});
+ add('azuread_application_permission_scope',n,{application_id:app('','id'),scope_id:uuid('user-scope'),value:'access_as_user',type:'Admin',admin_consent_display_name:'Use the invoice workspace',admin_consent_description:'Submit and review invoices under independently managed staff membership.'});
+ add('azuread_application_app_role',n,{application_id:app('','id'),role_id:uuid('workspace-role'),allowed_member_types:['User'],display_name:'Invoice staff',description:'Use the invoice application; SQL authorizes individual actions.',value:'WorkspaceUser'});
+ add('azuread_application_app_role',n+'_parser',{application_id:app('_parser','id'),role_id:uuid('parser-role'),allowed_member_types:['Application'],display_name:'Parser worker',description:'Invoke the private PDF parser as the exact owned worker.',value:'Parser.Invoke'});
+ for(const suffix of ['', '_spa','_parser'])add('azuread_service_principal',n+suffix,{client_id:app(suffix,'client_id'),app_role_assignment_required:suffix!=='_spa',depends_on:suffix==='_spa'?[]:['azuread_application_app_role.'+n+suffix]});
+ add('azuread_app_role_assignment',n+'_staff',{for_each:'${var.staff_subjects}',app_role_id:uuid('workspace-role'),principal_object_id:'${each.value}',resource_object_id:r('azuread_service_principal',n,'object_id')});
+ add('azuread_app_role_assignment',n+'_parser',{app_role_id:uuid('parser-role'),principal_object_id:identity('worker','principal_id'),resource_object_id:r('azuread_service_principal',n+'_parser','object_id')});
+ add('azuread_application_api_access',n,{application_id:app('_spa','id'),api_client_id:apiClient,scope_ids:[uuid('user-scope')],depends_on:['azuread_application_permission_scope.'+n]});
+ add('azuread_application_pre_authorized',n,{application_id:app('','id'),authorized_client_id:spaClient,permission_ids:[uuid('user-scope')],depends_on:['azuread_application_permission_scope.'+n]});
+ add('azuread_application_redirect_uris',n,{application_id:app('_spa','id'),type:'SPA',redirect_uris:[l('public_origin')+'/']});
+ const common={REGION:region,ACCOUNT_ID:l('account_uuid'),WORKFLOW_NAMESPACE:'invoice',DATABASE_NAME:'invoice',DATABASE_HOST:r('azurerm_postgresql_flexible_server',n,'fqdn'),DATABASE_CA_FILE:'/usr/local/lib/python3.13/site-packages/certifi/cacert.pem',DOCUMENT_ACCOUNT:l('storage_name'),DOCUMENT_BUCKET:'invoices',DESTINATION_CONTRACT_BASE64:l('destination_contract_base64')};
+ for(const purpose of ['api','worker','parser']){
+  const image=v(purpose==='parser'?'parser_image':'runtime_image');
+  const settings=purpose==='parser'?{PORT:'8080',PARSER_AUTH_MODE:'entra-workload',PARSER_TENANT_ID:tenant,PARSER_AUDIENCE:parserClient,PARSER_WORKER_CLIENT_ID:identity('worker','client_id'),PARSER_WORKER_PRINCIPAL_ID:identity('worker','principal_id')}:purpose==='api'?{...common,DATABASE_USER:l('api_db_user'),WORKLOAD_IDENTITY_CLIENT_ID:identity('api','client_id'),TENANT_ID:tenant,API_CLIENT_ID:apiClient,SPA_CLIENT_ID:spaClient,PUBLIC_ORIGIN:l('public_origin')}:{...common,DATABASE_USER:l('worker_db_user'),WORKLOAD_IDENTITY_CLIENT_ID:identity('worker','client_id'),MANAGED_IDENTITY_CLIENT_ID:identity('worker','client_id'),PARSER_ENDPOINT:l('parser_endpoint'),PARSER_AUDIENCE:parserClient,MODEL_RESOURCE_ID:r('azurerm_cognitive_account',n,'id'),MODEL_ENDPOINT:r('azurerm_cognitive_account',n,'endpoint'),MODEL_DEPLOYMENT:r('azurerm_cognitive_deployment',n,'name'),MAX_OUTPUT_TOKENS:'2048',DESTINATION_ENDPOINT:endpoint,DESTINATION_SCOPE:scope,DESTINATION_REPLAY_REVIEW_BASE64:v('replay_review_base64')};
+  const pull=identity('pull','id'),workload=purpose==='parser'?null:identity(purpose,'id');
+  add('azapi_resource',n+'_'+purpose,{count:'${var.applications_enabled ? 1 : 0}',type:'Microsoft.App/containerApps@2025-07-01',name:l('name')+'-'+purpose,parent_id:rgId,location:region,identity:{type:'UserAssigned',identity_ids:[pull,...(workload?[workload]:[])]},body:{properties:{environmentId:r('azurerm_container_app_environment',n,'id'),workloadProfileName:'Consumption',configuration:{activeRevisionsMode:'Single',registries:[{server:r('azurerm_container_registry',n,'login_server'),identity:pull}],identitySettings:[{identity:pull,lifecycle:'None'},...(workload?[{identity:workload,lifecycle:'Main'}]:[])],...(purpose==='worker'?{secrets:[{name:'accounting-token',keyVaultUrl:r('azurerm_key_vault',n,'vault_uri')+'secrets/accounting-token',identity:workload}]}:{}),...(purpose!=='worker'?{ingress:{external:purpose==='api',targetPort:8080,transport:'http',allowInsecure:false,traffic:[{latestRevision:true,weight:100}]}}:{})},template:{scale:{minReplicas:1,maxReplicas:1},containers:[{name:purpose,image,resources:{cpu:purpose==='parser'?1:0.5,memory:purpose==='parser'?'2Gi':'1Gi'},...(purpose==='api'?{}:{command:['python','-I','/app/'+(purpose==='worker'?'invoice_worker.py':'invoice_parser_service.py')]}),env:[...Object.entries(settings).map(([name,value])=>({name,value})),...(purpose==='worker'?[{name:'DESTINATION_TOKEN',secretRef:'accounting-token'}]:[])],probes:[{type:'Liveness',httpGet:{path:'/healthz',port:8080,scheme:'HTTP'},initialDelaySeconds:15,periodSeconds:30,failureThreshold:3}]}]}}},response_export_values:['properties.configuration.ingress.fqdn'],schema_validation_enabled:true,depends_on:['azurerm_role_assignment.'+n+'_pull','azurerm_role_assignment.'+n+'_model','azurerm_role_assignment.'+n+'_model_policy','azurerm_role_assignment.'+n+'_destination','azuread_app_role_assignment.'+n+'_parser','azurerm_private_endpoint.'+n+'_blob','azurerm_private_endpoint.'+n+'_model','azurerm_private_endpoint.'+n+'_vault']});
+  b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${!('+(purpose==='parser'?'var.applications_enabled':'var.applications_enabled || var.operations_enabled')+') || startswith(var.'+(purpose==='parser'?'parser_image':'runtime_image')+',format("%s.azurecr.io/invoice/'+(purpose==='parser'?'parser':'runtime')+'@sha256:",local.registry_name))}',error_message:'Use the package-owned private regional registry and immutable image.'});
+ }
+ b.output.application_url={value:l('public_origin')};b.output.runtime_registry={value:r('azurerm_container_registry',n,'login_server')};
+ b.output.operator_deployment={value:{provider:'azure',deploymentId:l('account_uuid'),accountId:l('account_uuid'),namespace:'invoice',tenantId:tenant,bindings:Object.fromEntries(['api','worker'].map(purpose=>[purpose,{name:l(purpose+'_db_user'),principal:identity(purpose,'principal_id')}]))}};
+ azureInvoiceOperations(b,n,{rg,rgId,region,subscription,identity});
+ b.output.database_bootstrap={value:{host:r('azurerm_postgresql_flexible_server',n,'fqdn'),database:'invoice',operatorClientId:identity('operator','client_id'),operatorLogin:l('name')+'-operator',nativeRoleMappingDatabase:'postgres'}};
+ b.assertions.push(`run "private_data_and_parser" {\n command = plan\n assert {\n condition = !azurerm_postgresql_flexible_server.${n}.public_network_access_enabled && !azurerm_postgresql_flexible_server.${n}.authentication[0].password_auth_enabled && !azurerm_storage_account.${n}.public_network_access_enabled && !azurerm_cognitive_account.${n}.local_auth_enabled\n error_message = "Private data and keyless database/model boundaries are required."\n }\n assert {\n condition = azapi_resource.${n}_parser[0].body.properties.configuration.identitySettings[0].lifecycle == "None" && azapi_resource.${n}_parser[0].body.properties.configuration.ingress.external == false\n error_message = "Parser image-pull identity must not be available in the private runtime."\n }\n}\nrun "foundation_only" {\n command = plan\n variables {\n applications_enabled = false\n operations_enabled = false\n maintenance_enabled = false\n }\n assert {\n condition = length(azapi_resource.${n}_api) == 0 && length(azapi_resource.${n}_worker) == 0 && length(azapi_resource.${n}_parser) == 0\n error_message = "Release must follow bootstrap, secret population and immutable publication."\n }\n}`);
+ b.assertions.push(`run "separate_workloads_and_regional_model" {\n command = plan\n assert {\n condition = azurerm_user_assigned_identity.${n}_api.client_id != azurerm_user_assigned_identity.${n}_worker.client_id && azurerm_cognitive_deployment.${n}.sku[0].name == "Standard" && azurerm_cognitive_deployment.${n}.version_upgrade_option == "NoAutoUpgrade"\n error_message = "Separate identities and an explicit regional model version are required."\n }\n assert {\n condition = one([for entry in azapi_resource.${n}_parser[0].body.properties.template.containers[0].env : entry.value if entry.name == "PARSER_AUTH_MODE"]) == "entra-workload" && azuread_application_app_role.${n}_parser.value == "Parser.Invoke"\n error_message = "Private ingress alone does not authorize the exact worker."\n }\n}\nrun "mutable_image_rejected" {\n command = plan\n variables { runtime_image = "unreviewed:latest" }\n expect_failures = [var.runtime_image]\n}\nrun "foreign_registry_rejected" {\n command = plan\n variables { runtime_image = "foreign.azurecr.io/invoice/runtime@sha256:${'a'.repeat(64)}" }\n expect_failures = [terraform_data.review_gate]\n}\nrun "unadmitted_staff_rejected" {\n command = plan\n variables { staff_subjects = [] }\n expect_failures = [terraform_data.review_gate]\n}\n`);
+ const mock=azureInvoiceMocks(n,b.examples,seed);
+ const imageExample=purpose=>'format("%sacr.azurecr.io/invoice/'+purpose+'@sha256:'+'a'.repeat(64)+'",replace(format("invoice-%s",substr(sha256('+JSON.stringify(seed)+'),0,12)),"-",""))';
+ b.testExpressions.runtime_image=imageExample('runtime');b.testExpressions.parser_image=imageExample('parser');
+ return b.finish({azurerm:{features:{},subscription_id:subscription,tenant_id:tenant,resource_provider_registrations:'none',storage_use_azuread:true},azuread:{tenant_id:tenant},azapi:{subscription_id:subscription,tenant_id:tenant,skip_provider_registration:true,enable_preflight:false}},{azurerm:{source:'hashicorp/azurerm',version:'4.81.0'},azuread:{source:'hashicorp/azuread',version:'3.10.0'},azapi:{source:azapi.source,version:azapi.version}},CLOUD_PROVIDER_LOCKS.azure+'\n'+CLOUD_PROVIDER_LOCKS.azuread+'\n'+azapi.lock,mock,AZURE_INVOICE_GUIDE);
+}
+
+function azureInvoiceMocks(n,examples,seed){
+ const subscription=examples.subscription_id,tenant=examples.tenant_id,base='/subscriptions/'+subscription+'/resourceGroups/invoice-fixture',guid=i=>'00000000-0000-4000-8000-'+String(i).padStart(12,'0');
+ let mock='mock_provider "azurerm" {\n override_during = plan\n mock_data "azurerm_client_config" { defaults = { subscription_id="'+subscription+'",tenant_id="'+tenant+'",object_id="'+guid(1)+'" } }\n}\nmock_provider "azuread" { override_during = plan }\nmock_provider "azapi" { override_during = plan }\n';
+ const override=(target,values)=>{mock+='override_resource {\n override_during = plan\n target = '+target+'\n values = '+JSON.stringify(values)+'\n}\n';};
+ override('azurerm_resource_group.'+n,{id:base});override('azurerm_virtual_network.'+n,{id:base+'/providers/Microsoft.Network/virtualNetworks/fixture'});
+ for(const purpose of ['apps','database','endpoints'])override('azurerm_subnet.'+n+'_'+purpose,{id:base+'/providers/Microsoft.Network/virtualNetworks/fixture/subnets/'+purpose});
+ for(const[purpose,i]of ['api','worker','pull','operator'].map((x,i)=>[x,i]))override('azurerm_user_assigned_identity.'+n+'_'+purpose,{id:base+'/providers/Microsoft.ManagedIdentity/userAssignedIdentities/'+purpose,client_id:guid(100+i),principal_id:guid(200+i)});
+ for(const purpose of ['database','blob','model','vault'])override('azurerm_private_dns_zone.'+n+'_'+purpose,{id:base+'/providers/Microsoft.Network/privateDnsZones/'+purpose+'.example.test'});
+ override('azurerm_postgresql_flexible_server.'+n,{id:base+'/providers/Microsoft.DBforPostgreSQL/flexibleServers/invoice-fixture',fqdn:'invoice-fixture.postgres.database.azure.com'});
+ const storage=base+'/providers/Microsoft.Storage/storageAccounts/invoicefixture';override('azurerm_storage_account.'+n,{id:storage});override('azurerm_storage_container.'+n,{id:storage+'/blobServices/default/containers/invoices'});
+ override('azurerm_cognitive_account.'+n,{id:base+'/providers/Microsoft.CognitiveServices/accounts/invoice-fixture',endpoint:'https://invoice-fixture.openai.azure.com/'});override('azurerm_key_vault.'+n,{id:base+'/providers/Microsoft.KeyVault/vaults/invoice-fixture',vault_uri:'https://invoice-fixture.vault.azure.net/'});
+ override('azurerm_log_analytics_workspace.'+n,{id:base+'/providers/Microsoft.OperationalInsights/workspaces/invoice-fixture'});
+ override('azurerm_container_app_environment.'+n,{id:base+'/providers/Microsoft.App/managedEnvironments/invoice-fixture',default_domain:'invoice-fixture.australiaeast.azurecontainerapps.io'});
+ mock+='override_resource {\n override_during = plan\n target = azurerm_container_registry.'+n+'\n values = {\n id = '+JSON.stringify(base+'/providers/Microsoft.ContainerRegistry/registries/fixture')+'\n login_server = format("invoice%sacr.azurecr.io",substr(sha256('+JSON.stringify(seed)+'),0,12))\n }\n}\n';
+ override('azurerm_role_definition.'+n+'_documents',{role_definition_resource_id:base+'/providers/Microsoft.Authorization/roleDefinitions/'+guid(50)});
+ for(const[suffix,i]of [['',1],['_spa',2],['_parser',3]]){override('azuread_application_registration.'+n+suffix,{id:'/applications/'+guid(300+i),client_id:guid(400+i)});override('azuread_service_principal.'+n+suffix,{object_id:guid(500+i)});}
+ return mock;
+}
+
+const AZURE_INVOICE_GUIDE=`# Azure invoice workflow (under qualification)
+
+Separate Container Apps API, worker and private authenticated parser; private
+Entra-only PostgreSQL, versioned private objects, private regional model, native
+secret references and explicit staff/SQL authority. The parser's ACR pull identity
+uses lifecycle None; only the worker's exact app-only Parser.Invoke token is admitted.
+Native cloud isolation/authentication still require authorized destination checks.
+
+Foundation precedes native SQL identity/schema/membership bootstrap, accounting
+secret population and exact image publication. Never put secrets in Terraform
+variables or source. See OPERATIONS.md. Application images and direct staff role
+assignments do not imply SQL reviewer membership. No existing users, accounting
+system or external website are recreated. Review regional model/version availability,
+modified monitoring approval, quotas, fixed costs, private operator connectivity,
+state, monitoring and managed restore. OPERATING_JOBS.md supplies native manual
+bootstrap and phased daily/hourly jobs, diagnostic routing and query alerts. Job
+start authority is privileged and remains outside the product. Native operations
+and whole-export qualification remain in progress; this is not a complete invoice case.
+`;

package/src/invoice-builder.mjs

@@ -0,0 +1,35 @@
+import {invoiceApplicationFiles}from'./invoice-application.mjs';
+import {existingReferenceFiles}from'./existing-references.mjs';
+import {INVOICE_OPERATIONS}from'./invoice-operations.mjs';
+import{INVOICE_REGION_PATTERNS,validInvoiceRegion}from'./invoice-region.mjs';
+
+export const v=name=>'${var.'+name+'}';
+export const r=(type,name,attribute)=>'${'+type+'.'+name+'.'+attribute+'}';
+export const l=name=>'${local.'+name+'}';
+export const UUID='^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$';
+
+export function invoiceBuilder(project,row,environment='staging'){
+ if(!project||typeof project.id!=='string'||!project.id||!row||!/^block_[0-9a-f]+$/.test(row.address)||!['aws','azure','gcp','ibm'].includes(row.provider))throw Error('Use a stable owned invoice project, address and provider');
+ if(!['staging','production','qualification'].includes(environment))throw Error('Use an explicit supported invoice environment');
+ const seed='https://atmem.ai/workspaces/'+encodeURIComponent(project.id)+'/'+row.address+'/'+environment;
+ const variable={review_approved:{type:'bool',default:false},applications_enabled:{type:'bool',default:false,description:'Enable only after native SQL identity/schema/membership bootstrap, secret population and immutable image publication are reviewed.'}};
+ const examples={review_approved:false,applications_enabled:false},resource={},data={},output={},assertions=[],testExpressions={},files=invoiceApplicationFiles(row.provider,row.address);
+ files['OPERATIONS.md']=INVOICE_OPERATIONS;
+ const locals={name:'${format("invoice-%s",substr(sha256('+JSON.stringify(seed)+'),0,12))}',account_uuid:new RegExp(UUID).test(project.id)?project.id:'${uuidv5("url",'+JSON.stringify(seed)+')}',api_db_user:'${format("invoice_api_%s",substr(sha256('+JSON.stringify(seed)+'),0,12))}',worker_db_user:'${format("invoice_worker_%s",substr(sha256('+JSON.stringify(seed)+'),0,12))}'};
+ const input=(name,description,example,pattern)=>{
+  if(variable[name])throw Error('Duplicate invoice input '+name);
+  variable[name]={type:'string',nullable:false,description,validation:{condition:pattern?'${can(regex('+JSON.stringify(pattern)+',var.'+name+'))}':'${length(trimspace(var.'+name+')) > 0}',error_message:'Supply the reviewed '+name+' input.'}};examples[name]=example;return v(name);
+ };
+ if(row.region&&!validInvoiceRegion(row.provider,row.region))throw Error('Preserve and resolve the explicit invoice region as a canonical provider region before compilation.');
+ const region=input('region','Reviewed single deployment/data region; verify current service/model availability and quotas.',row.region||{aws:'ap-southeast-2',azure:'australiaeast',gcp:'australia-southeast1',ibm:'au-syd'}[row.provider],INVOICE_REGION_PATTERNS[row.provider]);
+ if(row.provider==='aws')variable.region.validation.condition=variable.region.validation.condition.slice(0,-1)+' && !startswith(var.region,"cn-")}';
+ if(row.region){variable.region.default=row.region;variable.region.validation={condition:'${var.region == '+JSON.stringify(row.region)+'}',error_message:'Placement is bound to this design. Update and regenerate the design before changing region.'};}
+ resource.terraform_data={review_gate:{input:{design_revision:project.revision,environment,provider:row.provider},lifecycle:{precondition:[{condition:'${var.review_approved}',error_message:'Review the actual source, placement, identities, existing accounting contract, costs, operations and destination account before any apply.'}]}}};
+ const add=(type,name,body)=>((resource[type]||={})[name]={...body,depends_on:['terraform_data.review_gate',...(body.depends_on||[])]});
+ function finish(providerConfig,requiredProviders,lock,mock,guide){
+  const values=Object.entries({...examples,review_approved:true,applications_enabled:true}).map(([key,value])=>key+' = '+(testExpressions[key]||JSON.stringify(value))).join('\n');
+  const config={terraform:{required_version:'>= 1.17.1, < 2.0.0',required_providers:requiredProviders},provider:providerConfig,variable,locals,data,resource,output};
+  return{...files,...existingReferenceFiles(project),'.terraform.lock.hcl':lock,'main.tf.json':JSON.stringify(config,null,2)+'\n','deployment.tfvars.json.example':JSON.stringify(examples,null,2)+'\n','.gitignore':'.terraform/\n*.tfstate*\n*.tfplan\n*.tfvars\n*.tfvars.json\n!deployment.tfvars.json.example\n.local/\n.venv/\nbuild/\n__pycache__/\n','tests/invoice.tftest.hcl':mock+'\nvariables {\n'+values+'\n}\n'+assertions.join('\n')+'\nrun "review_required" {\n command = plan\n variables { review_approved = false }\n expect_failures = [terraform_data.review_gate]\n}\n','README.md':guide,'invoice-deployment-boundary.json':JSON.stringify({provider:row.provider,sourceComponent:row.id,namespace:'invoice',accountIdentity:'local.account_uuid',applicationRelease:'Explicit foundation/bootstrap/application phases; no automatic cloud operations.',externalAccounting:'Preserved external dependency with a normalized, independently testable action/receipt contract; actual endpoint/credentials/idempotency acceptance remain destination inputs.',qualification:'Compiler emission alone is not full project acceptance or deployment evidence.'},null,2)+'\n'};
+ }
+ return{variable,examples,resource,data,locals,output,assertions,testExpressions,files,input,add,finish,region,seed};
+}