DMX Specification Language

// This is a line comment

/* This is a
   block comment */

service "UserService" {
  version  = "1.0.0"   // trailing comment
  port     = 8000
  database = "user_service"
}

service "UserService" {
  version = "1.0.0"
  port = 8000
  api_prefix = "/api/v1"
  database = "postgresql"

  // ... entities, api, flows, etc.
}

service "AuthService" {
  version    = "1.0.0"
  port       = 8000
  api_prefix = "/api"
  database   = "auth_service"

  identity {
    service_name      = "Auth Service"
    service_version   = "2.4.1"
    service_slug      = "auth-svc"
    internal_hostname = "auth-svc.svc.cluster.local"
    internal_port     = 8081
    description       = "identity overrides"

    gateway {
      enabled          = true
      public_port      = 8443
      public_base_path = "/v2"
      mode             = auth_precheck
    }

    architecture {
      mode        = microservices
      mode_source = explicit
    }
  }
}

service "AuthService" {
  version    = "1.0.0"
  port       = 8000
  api_prefix = "/api"
  database   = "auth_service"

  identity {
    service_version = "2.4.1"
  }
}

entity Order {
  @aggregate_root
  @description("Customer order")
  @audit(level: standard)
  @soft_delete
  @role(domain)

  id          UUID           @pk @default($computed.uuid)
  customer_id UUID           @fk(Customer.id) @not_null
  total       Decimal(12, 2) @not_null
  status      Enum(DRAFT, PENDING, PAID, SHIPPED, CANCELLED) @not_null @default("DRAFT")
  notes       Text
  created_at  DateTime       @not_null @default($computed.now)

  @unique_together(customer_id, created_at)
}

api {
  POST "/orders/{id}/cancel" {
    operation_id = "cancel_order"
    permissions  = ["orders:manage"]
    tags         = ["orders"]
    response @entity(Order)
  }

  GET "/orders/summary" {
    operation_id = "order_summary"
    permissions  = ["orders:read"]
    query {
      from Date
      to   Date
    }
    response @paginated(Order)
  }
}

api {
  GET "/widgets/{opaque}" {
    operation_id = "fetch_widget"
    addressing { opaque = Widget.arbitrary_label }
    response @entity(Widget)
  }

  GET "/widgets/{first}/{second}" {
    operation_id = "fetch_widget_scoped"
    addressing {
      second = Widget.local_ref
      first  = Widget.tenant_ref
    }
    response @entity(Widget)
  }
}

flow "Register User" {
  type    = workflow
  trigger = http(method="POST", path="/users")
  entity  = User

  step 1 "Validate input" {
    action    = validate
    condition = "$input.email is unique within tenant"
    error     = "email already registered"
  }

  step 2 "Create user" {
    action = create
    target = User
    mapping {
      email      = $input.email
      name       = $input.name
      created_at = $computed.now
    }
  }
}

state_machine Order.status {
  initial   = DRAFT
  terminal  = [DELIVERED, CANCELLED]
  sensitive = [PAID, SHIPPED]

  DRAFT   -> PENDING    @roles(MEMBER, ADMIN)
  PENDING -> PAID
  PAID    -> SHIPPED    @roles(ADMIN)
  SHIPPED -> DELIVERED
  PENDING -> CANCELLED  @roles(MEMBER, ADMIN)
  DRAFT   -> CANCELLED

  @guard(payment_confirmed) {
    condition = "$instance.paid_at != null"
  }
}

validations {
  User.email {
    type   = format
    format = "^[^@]+@[^@]+$"
    error  = "Invalid email address"
  }

  User.username {
    type        = uniqueness
    enforcement = validator
    severity    = error
    error       = "Username already taken"
  }

  User.bio {
    type     = format
    format   = "^.{0,500}$"
    severity = warning
    error    = "Bio is longer than we display"
  }

  User.age {
    type  = range
    range = "0..150"
    error = "Age must be between 0 and 150"
  }
}

security {
  auth_scheme = jwt
  jwt_algorithm = "HS256"
  token_expiry_minutes = 60
  refresh_token_enabled = true
  password_hashing = bcrypt

  rate_limit {
    login_attempts = 5
    requests_per_minute = 100
    lockout_duration = "15m"
  }

  roles = [ADMIN, MEMBER, GUEST]
}

security {
  auth_scheme = jwt
  roles = [ADMIN, MANAGER, MEMBER]

  policy "shipment_write" {
    entity = Shipment
    allow [ADMIN, MANAGER] for [create, update]
    allow [MEMBER] for [read] when owns(shipment_id)
  }
}

security {
  auth_scheme = jwt

  mfa {
    enabled          = true
    method           = totp
    code_digits      = 6
    interval_seconds = 30
    algorithm        = SHA1
    valid_window     = 1
    config_entity    = User
    enabled_field    = "mfa_enabled"
    secret_field     = "mfa_secret"
  }
}

entity MfaVerifyInput {
  id   UUID @pk
  code String(6) @otp_code
}

security {
  auth_scheme = jwt
  user_entity = "User"
  active_field = "is_active"

  credential_type_field = "credential_type"
  password_credential_kind = "password"
}

errors {
  USER_NOT_FOUND {
    status   = 404
    category = not_found
    message  = "User not found"
    entity   = User
    field    = id
  }
  INVALID_CREDENTIALS {
    status   = 401
    category = auth
    message  = "Invalid email or password"
  }
}

platform "MyPlatform" {
  jobs {
    "cleanup_expired_tokens" {
      schedule        = "0 */6 * * *"
      target_task     = "identity.handlers.cleanup_task.cleanup_expired_tokens"
      queue           = "maintenance"
      timeout_seconds = 300
      description     = "Purge tokens past their expiry window"

      retry {
        max_attempts = 3
        backoff      = "exponential"
        delay        = "30s"
      }
    }

    "send_daily_digest" {
      schedule    = "0 8 * * *"
      target_task = "notifications.handlers.digest_task.send_daily_digest"
      queue       = "low_priority"
      priority    = "low"
    }
  }
}

notifications {
  providers {
    email { adapter = smtp }
    sms   { adapter = twilio }
    push  { adapter = firebase }
  }

  event "order_confirmed" {
    entity    = Order
    channels  = [email, push]
    recipient = entity_field("customer.email")

    // The string after `template` is the CHANNEL this body belongs to, not a
    // template name: the compiler derives the name itself, as
    // <event>__<channel>__<locale>. One template per channel the event declares.
    template "email" {
      locale  = "es"
      subject = "Your order is confirmed"
      body    = "Order {{ id }} is on its way."
    }
    template "push" {
      locale  = "es"
      subject = "Order confirmed"
      body    = "Order {{ id }} is on its way."
    }
  }
}

file_storage {
  virus_scan  = true

  bucket "my-app-uploads" {
    provider      = s3
    max_size      = "10MB"
    allowed_types = ["image/png", "image/jpeg", "application/pdf"]
    access        = private
  }
}

infrastructure {
  docker {
    compose_version = "3.8"
    base_image      = "python:3.12-slim"
  }
  database {
    type = postgresql
    name = "user_service"
  }
  cache {
    type = redis
    ttl  = 600
  }
  observability {
    metrics         = true
    tracing         = true
    health_endpoint = "/health"
  }
  api_gateway {
    enabled = true
    type    = kong
  }
}

infrastructure {
  rabbitmq {
    vhost = "/tenant_a"
    user_env = "RABBITMQ_USER"
    password_env = "RABBITMQ_PASSWORD"
    use_tls = true
    tls_ca_path_env = "RABBITMQ_CA_PATH"
    pool_size = 10
    max_overflow = 5
    heartbeat_seconds = 60
    prefetch_count = 50
    quorum_replication_factor = 3
    publisher_confirms = true
    mandatory_routing = true
    management {
      port = 15672
      user_env = "RABBITMQ_MGMT_USER"
      password_env = "RABBITMQ_MGMT_PASSWORD"
    }
    cluster {
      discovery_mode = "dns"
      static_peers = ["rmq-0", "rmq-1", "rmq-2"]
    }
    exchange "events" {
      type = "topic"
      durable = true
    }
    queue "events.q" {
      durable = true
      dead_letter_exchange = "events.dlx"
      dead_letter_routing_key = "events.dlq"
      max_length = 100000
      quorum = true
    }
  }
}

infrastructure {
  kafka {
    bootstrap_servers_env = "KAFKA_BOOTSTRAP_SERVERS"
    security_protocol = "SASL_SSL"
    sasl_mechanism = "SCRAM-SHA-512"
    sasl_user_env = "KAFKA_SASL_USER"
    sasl_password_env = "KAFKA_SASL_PASSWORD"
    tls_truststore_path_env = "KAFKA_TLS_TRUSTSTORE_PATH"
    tls_truststore_password_env = "KAFKA_TLS_TRUSTSTORE_PASSWORD"
    consumer_group_id = "svc_a.consumer"
    auto_offset_reset = "earliest"
    producer_acks = "all"
    producer_idempotence = true
    compression_type = "zstd"
    schema_registry {
      url_env = "KAFKA_SCHEMA_REGISTRY_URL"
      auth_user_env = "SR_USER"
      auth_password_env = "SR_PASSWORD"
    }
    topic "events" {
      partitions = 6
      replication_factor = 3
      min_insync_replicas = 2
      retention_ms = 604800000
      cleanup_policy = "compact"
      acl_read_principals = ["User:svc_a"]
      acl_write_principals = ["User:svc_publisher"]
    }
  }
}

infrastructure {
  elasticsearch {
    hosts_env = "ELASTICSEARCH_HOSTS"
    use_https = true
    verify_certs = true
    ca_bundle_path_env = "ELASTICSEARCH_CA_BUNDLE"
    rbac_roles = ["search_user", "index_admin"]
    bulk_batch_size = 1000
    bulk_timeout_seconds = 60
    watcher_enabled = false
    auth {
      method = "api_key"
      api_key_env = "ELASTICSEARCH_API_KEY"
    }
    index "logs" {
      tenant_prefix = "tenant_a"
      number_of_shards = 3
      number_of_replicas = 2
      min_insync_replicas = 2
      refresh_interval = "30s"
      lifecycle_policy = "logs-policy"
      ingest_pipeline = "enrich-logs"
    }
    ilm_policy "logs-policy" {
      phase "hot" { min_age = "0ms" }
      phase "warm" { min_age = "7d" }
      phase "delete" { min_age = "90d" }
    }
    snapshot_repository "primary" { type = "s3" }
    ingest_pipeline "enrich-logs" { description = "Add tenant tag" }
  }
}

platform "MyPlatform" {
  version = "1.0.0"

  modules {
    UserService         { spec = "user.dmx";         dependencies = [] }
    OrderService        { spec = "order.dmx";        dependencies = [UserService] }
    NotificationService { spec = "notification.dmx"; dependencies = [OrderService] }
  }

  shared_kernel { modules = [tenant_context, jwt_utils, event_bus, audit_decorator, observability] }

  interactions {
    "order-confirmed-notifies" {
      tier     = 1
      producer = OrderService
      consumer = NotificationService
      trigger  = event("order.confirmed")
      task     = "send_confirmation"
      queue    = "notifications"
    }
  }
}

platform "MyPlatform" {
  shared_kernel {
    modules         = [errors, jwt_utils, base_repository]
    exclusions      = [legacy_reports]
    python_requires = ">=3.12"
  }
}

service "Chat" {
  version  = "1.0.0"
  database = "chat"

  audit {
    enabled       = true
    default_level = standard
    retention     = "5y"
  }
}

api {
  GET "/ws/rooms/{id}" {
    operation_id = "room_stream"
    permissions  = ["chat:read"]
    is_websocket = true

    message_types {
      "message.posted" {
        payload_fields = [room_id, author_id, body, posted_at]
      }
      "presence.changed" {
        payload_fields = [room_id, user_id, state]
      }
    }
  }
}

tenant_config {
  storage_model = "dedicated_table"

  max_rooms {
    data_type = "integer"
    default   = 50
  }
}

infrastructure {
  docker {
    compose_version = "3.8"
    base_image      = "python:3.12-slim"

    health_check {
      interval = "30s"
      timeout  = "5s"
      retries  = 3
    }
  }

  database {
    type = postgresql
    name = "orders"
  }

  test_database {
    name = "orders_test"
  }

  clickhouse {
    order_events {
      engine       = MergeTree
      order_by     = [tenant_id, occurred_at]
      partition_by = "toYYYYMM(occurred_at)"
      ttl          = "occurred_at + INTERVAL 2 YEAR"

      columns {
        tenant_id   String @low_cardinality
        occurred_at DateTime
      }
    }
  }
}

platform "MyPlatform" {
  modules {
    orders {
      spec         = "orders.dmx"
      dependencies = [identity]

      output {
        generate_tests = true
        celery_worker  = true
      }
    }
  }

  celery {
    broker_url      = "redis://redis:6379/0"
    result_backend  = "redis://redis:6379/1"
    task_serializer = "json"
    acks_late       = true
    concurrency     = 2

    worker worker_fast {
      queues = ["fast", "notifications"]
    }
  }
}

infrastructure {
  rabbitmq {
    host_env     = "RABBITMQ_HOST"
    user_env     = "RABBITMQ_USER"
    password_env = "RABBITMQ_PASSWORD"

    exchange "orders.internal" {
      type     = "topic"
      durable  = true
      internal = true
    }

    exchange "orders.public" {
      type    = "topic"
      durable = true
    }
  }
}

integration "stripe_payments" {
  type              = payment_service
  provider          = "stripe"
  version           = "2024-06-20"
  fallback_behavior = fail_fast
  is_critical       = true
  required_env_vars = ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"]
}

flow "Charge Order" {
  type            = workflow
  trigger         = http(method="POST", path="/orders/{id}/pay")
  entity          = Order
  integration_ref = "stripe_payments"

  step 1 "Charge the card" {
    action = create
    target = Order
  }
}

platform "MyPlatform" {
  interactions {
    "billing.quote_order" {
      tier          = 2
      producer      = orders
      consumer      = billing
      pattern       = request_reply
      timeout_ms    = 2000
      retry         = 2
      idempotent    = true

      request_params {
        order_id UUID   @path @required
        currency String @query
        coupon   String @body
      }

      request {
        target_entity = Order
      }

      reply {
        response_schema = Quote
        timeout_ms      = 2000
      }
    }
  }
}

entity OrderItem {
  id       UUID @pk @default($computed.uuid)
  order_id UUID @fk(Order.id, on_delete: cascade) @not_null
}

file_storage {
  virus_scan = true

  bucket "invoices" {
    provider = s3
    access   = private

    retention {
      days              = 3650
      regulatory_basis  = "AFIP RG 4291"
      allow_overwrite   = false
    }
  }
}

object_storage {
  backend             = s3
  bucket_name_env_var = "DOCS_BUCKET"

  document_type Invoice {
    retention_days   = 3650
    write_once       = true
    max_file_size_mb = 25

    lifecycle {
      after_days = 90  to_storage_class = infrequent_access
      after_days = 365 to_storage_class = archive
    }
  }
}

service_observability {
  metrics_enabled = true

  metrics {
    request_latency_seconds {
      type        = histogram
      labels      = [route, method]
      buckets     = [0.05, 0.1, 0.5, 1.0, 5.0]
      description = "Request latency distribution"
    }
  }
}

platform "MyPlatform" {
  retention {
    module orders {
      days          = 2555
      on_delete     = "archive"
      storage_class = "GLACIER"
    }
  }
}

platform "MyPlatform" {
  object_storage {
    provider = s3

    bucket "invoices" {
      name            = "acme-invoices"
      region          = "us-east-1"
      owning_service  = "billing"
      encryption_kind = SSE-S3

      lifecycle_rule {
        rule_kind     = transition
        storage_class = "GLACIER"
        after_days    = 365
      }

      lifecycle_rule {
        rule_kind  = expiration
        after_days = 2555
      }
    }
  }
}

infrastructure {
  docker {
    compose_version = "3.8"
    base_image      = "python:3.12-slim"
    db_password_env = "ORDER_SERVICE_DB_PASSWORD"
  }

  redis {
    use_ssl   = true
    pool_size = 10
    cache { enabled = true }
  }

  kafka {
    bootstrap_servers_env = "KAFKA_BOOTSTRAP_SERVERS"
    security_protocol     = "SSL"

    // what we PRESENT — our own cert + key
    tls_keystore_path_env       = "KAFKA_TLS_KEYSTORE_PATH"
    tls_keystore_password_env   = "KAFKA_TLS_KEYSTORE_PASSWORD"
    // what we ACCEPT — the CAs a broker must chain to
    tls_truststore_path_env     = "KAFKA_TLS_TRUSTSTORE_PATH"
    tls_truststore_password_env = "KAFKA_TLS_TRUSTSTORE_PASSWORD"

    consumer_group_id = "order_service.consumer"

    topic "orders" {
      partitions         = 6
      replication_factor = 3
      retention_ms       = 604800000
      retention_bytes    = 10737418240
    }
  }
}

service "OrderService" {
  version  = "1.0.0"
  database = "order_service"

  depends_on {
    UserService      imports          [User, Role]
    AuditService     optional_imports [AuditEntry]
  }
}

platform "MyPlatform" {
  modules {
    OrderService {
      spec         = "order.dmx"
      dependencies = [UserService]

      imports {
        UserService [User, Role]
        AuditService optional_imports [AuditEntry]
      }

      exports {
        entities [Order, OrderLine]
        services ["order-api"]
      }
    }
  }
}

platform "MyPlatform" {
  modules {
    OrderService {
      spec = "order.dmx"

      test_coverage {
        integration            = "required"
        e2e                    = "optional"
        contract               = "required"
        target_branch_coverage = 0.85
      }
    }
  }
}

integration "PartnerFeed" {
  type              = webhook_receiver
  provider          = "acme"
  is_critical       = true
  fallback_behavior = queue_retry
  required_env_vars = ["ACME_SIGNING_SECRET"]

  webhook {
    signature_header     = "X-Acme-Signature"
    signature_secret_env = "ACME_SIGNING_SECRET"
    signature_algorithm  = sha256
    events               = ["invoice.paid"]
    event_field          = "type"
    idempotency_field    = "delivery_id"
    retry_policy         = "exponential"
  }
}

integration "PartnerAuth" {
  type     = oauth_flow
  provider = "acme"

  oauth {
    authorization_url = "https://acme.example/oauth/authorize"
    token_url         = "https://acme.example/oauth/token"
    scopes            = ["invoices:read"]
    client_id_env     = "ACME_CLIENT_ID"
    client_secret_env = "ACME_CLIENT_SECRET"
    redirect_uri_path = "/oauth/acme/callback"
  }
}

integration "PartnerApi" {
  type     = api_client
  provider = "acme"

  api_client {
    base_url_env    = "ACME_BASE_URL"
    auth_type       = bearer_token
    auth_header     = "Authorization"
    auth_env_var    = "ACME_TOKEN"
    timeout_seconds = 30
    retry_count     = 3
    retry_backoff   = 1.5
  }
}

command "CancelOrder" {
  entity        = Order
  verb          = "cancel"
  state_field   = "status"
  state_from    = ["pending", "confirmed"]
  state_to      = "cancelled"
  endpoint_path = "/orders/{id}/cancel"
  http_method   = POST
}

flow "ExportInvoices" {
  type    = workflow
  trigger = http(method="GET", path="/invoices/export")
  entity  = Invoice

  file_operation {
    type          = export
    export_entity = Invoice
    export_fields = ["number", "issued_at", "total"]
    export_format = csv
  }

  // A flow needs at least one step: the validator rejects an empty body rather
  // than emitting a flow that does nothing, and `file_operation` configures the
  // export without being one.
  step 1 "Export the rows" {
    action        = export
    target        = Invoice
    output_format = csv
  }
}

flow "AttachReceipt" {
  type    = workflow
  trigger = http(method="POST", path="/receipts")
  entity  = Receipt

  file_operation {
    type               = upload
    allowed_types      = ["application/pdf", "image/png"]
    max_file_size      = 10485760
    upload_destination = "receipts/"
    storage_backend    = s3
    process_async      = true
  }

  step 1 "Record the upload" {
    action = create
    target = Receipt
    mapping {
      stored_path = $input.stored_path
      uploaded_at = $computed.now
    }
  }
}

conditional_append_only_entities {
  Invoice {
    state_field  = "status"
    after_state  = "issued"
  }
}

platform "MyPlatform" {
  interactions {
    "i-11-order-confirmed-notifies" {
      tier         = 1
      producer     = OrderService
      consumer     = NotificationService
      trigger      = event("order.confirmed")
      task         = "send_confirmation"
      event_schema = "order.confirmed@v2"
      ordering_key = "tenant_id"

      payload_map {
        order_id    = $instance.id
        customer_id = $instance.customer_id
        tenant_id   = $context.tenant_id
      }

      delivery {
        transport    = redis_streams
        outbox       = true
        ordering_key = "tenant_id"
        retry {
          max_attempts     = 5
          backoff          = "exponential"
          initial_delay_ms = 100
        }
        dlq {
          stream_name             = "order-confirmed.dlq"
          max_attempts_before_dlq = 5
        }
      }
    }
  }
}

platform "MyPlatform" {
  protocol_handlers {
    handler "telemetry-stream" {
      transport_kind         = "tcp"
      transport_config {
        host = "0.0.0.0"
        port = "9000"
      }
      framing_strategy       = "length_prefixed"
      wire_format_parser_ref = "binary_frame_parser"
      owner_service_or_agent = "ingest"
      delivery_semantics     = "at_least_once"
      idempotency_key_source = "header:X-Message-Id"
    }
  }
}

platform "MyPlatform" {
  modules {
    control_plane { spec = "control_plane.dmx"; dependencies = [] }
    identity      { spec = "identity.dmx";      dependencies = [control_plane] }
    registry      { spec = "registry.dmx";      dependencies = [identity] }
    catalog       { spec = "catalog.dmx";       dependencies = [identity] }
    connectivity  { spec = "connectivity.dmx";  dependencies = [registry] }
    preanalytic   { spec = "preanalytic.dmx";   dependencies = [connectivity] }
    lab           { spec = "lab.dmx";           dependencies = [connectivity, preanalytic] }
  }
}

platform "MyPlatform" {
  celery {
    broker_url      = "redis://redis:6379/0"
    result_backend  = "redis://redis:6379/1"
    task_serializer = "json"
    concurrency     = 2

    worker worker_fast {
      queues = ["fast", "ocr", "notifications"]
    }
    worker worker_standard {
      queues = ["default", "pdf", "billing"]
    }
    worker worker_beat {
      role = scheduler    // Celery Beat scheduler
    }
  }
}

platform "MyPlatform" {
  interactions {
    "i-11-order-confirmed-notifies" {
      tier         = 1
      producer     = OrderService
      consumer     = NotificationService
      trigger      = event("order.confirmed")
      task         = "send_confirmation"
      event_schema = "order.confirmed@v2"
      ordering_key = "tenant_id"

      payload_map {
        order_id    = $instance.id
        customer_id = $instance.customer_id
        tenant_id   = $context.tenant_id
      }

      delivery {
        transport    = redis_streams
        outbox       = true
        ordering_key = "tenant_id"
        retry {
          max_attempts     = 5
          backoff          = "exponential"
          initial_delay_ms = 100
        }
        dlq {
          stream_name             = "order-confirmed.dlq"
          max_attempts_before_dlq = 5
        }
      }
    }
  }
}

platform "MyPlatform" {
  infrastructure {
    api_gateway {
      enabled = true
      type    = kong
      rate_limiting {
        enabled             = true
        requests_per_minute = 100
      }
    }
    service_ports {
      control_plane = 8010
      identity      = 8001
    }
    jwt {
      algorithm              = "HS256"
      token_lifetime_minutes = 30
      issuer                 = "platform-name"
    }
  }
}

infrastructure {
  database {
    type = postgresql
    name = "user_service"

    pagination {
      default_limit = 100
      max_limit     = 1000
    }
  }
}

platform "MyPlatform" {
  compliance {
    profile "covered-entity" {
      scope                     = "protected_health_information"
      data_classes              = ["PHI", "PII"]
      retention_days            = 2190
      encryption_at_rest        = true
      encryption_in_transit     = true
      audit_required            = true
      access_review_days        = 90
      subject_rights            = ["access", "rectification", "erasure"]
      breach_notification_hours = 72
      residency                 = "US"
      validation_controls       = ["technical_safeguards", "administrative"]
      legal_basis               = "HIPAA-45-CFR-164"
      full_name                 = "Health Insurance Portability and Accountability Act"
      mode_alias                = "covered-entity"
      phi_keywords              = ["diagnosis", "patient_id", "mrn"]
      pii_keywords              = ["ssn", "passport"]
      min_retention_days        = 2190
      requires_read_audit       = true
      requires_pii_masking      = true
      requires_extended_retention = true
      requires_immutable_audit  = true
      requires_encrypted_audit  = true
      requires_actor_info       = true
      requires_digital_signature = false
      requires_request_metadata = true
      test_frameworks           = ["hipaa-test-suite"]
    }
  }
}