Prod must keep existing_vpc_id pointed at the afterhours VPC. Outputs
expose the resolved vpc_id and public subnet IDs.
Co-authored-by: Adam Moussa <amoussa1229@users.noreply.github.com>
* fix(infra): share the afterhours VPC when existing_vpc_id is set
Prod is at the account VPC quota, so the v1.0.0 apply destroyed Lambda/API Gateway then failed on CreateVpc. Skip creating a sixth VPC when the workspace supplies afterhours subnets.
* style(test): format the VPC terraform assertion for ruff
* feat(infra): add lightweight meal-order-manager-dev (PLAT-210)
Parameterize the HCP root for seahaven-dev with schedules, PITR, alarms, and Paychex gated off so a second env does not clone production cost or side effects.
* fix(infra): drop prod-only authorizer import so dev can create it (PLAT-210)
The PLAT-102 import is already in meal-order-manager-prod state. A shared import block fails in seahaven-dev because the permission does not exist there.
* fix(iam): allow creating the weekly-menu githubdeploy role in seahaven-dev (PLAT-210)
Prod imported that role. A new account needs CreateRole on tf-managed/githubdeploy-meal-order-manager-weekly-menu.
* fix(auth): accept federated portal Cognito tokens for meals admin
Google Workspace federation stores email_verified=false, which 403'd the
portal Admin probe while the public menu still loaded.
* fix(iam): grant plan role CloudFront DescribeFunction
* chore(meals): remove email_report payroll SES path (PLAT-135)
Stop Monday SES deduction emails now that Flex checkcomponents owns payroll posting.
* chore(meals): delete email_report handler and SAM resources
Remove the leftover SES Lambda source so it cannot be redeployed from template.yaml.
* feat(meals): send weekly deductions to paychex checkcomponents (PLAT-154)
* fix(meals): round checkcomponents amounts half-up
Keep SQS deduction amounts on the same rounding path as submit_order so extra-precision totals cannot diverge by a cent.
