@spottoai/types-package 1.0.2-beta.353 → 1.0.2-beta.356

package/dist/esm/aws/pluginPublicArtifactValidationHelpers.js

@@ -0,0 +1,216 @@
+import { AWS_FORBIDDEN_CREDENTIAL_FIELDS } from './requests.js';
+const FORBIDDEN_PUBLIC_KEYS = new Set([
+    ...AWS_FORBIDDEN_CREDENTIAL_FIELDS,
+    'externalId',
+    'roleArn',
+    'secretArn',
+    'secretReference',
+    'credentialReference',
+    'storagePath',
+    'sourcePath',
+    'path',
+    'blobPath',
+    'containerPath',
+    'chunk',
+    'chunks',
+    'lease',
+    'retries',
+    'retry',
+    'refreshState',
+    'lastRefreshExecutionRequestId',
+    'lastRefreshExecutionRequestedAt',
+    'prompt',
+    'promptInput',
+    'sourceBytes',
+    'maxSourceBytes',
+    'bedrockRegion',
+    'guardrailId',
+    'guardrailVersion',
+    'etag',
+    'eTag',
+    'retiredAt',
+]);
+const NORMALIZED_FORBIDDEN_PUBLIC_KEYS = new Set(Array.from(FORBIDDEN_PUBLIC_KEYS, key => key.toLowerCase()));
+const FORBIDDEN_PUBLIC_KEY_PATTERN = /^(?:source|storage|blob|container)(?:path|uri|url|key)$|^s3(?:bucket|key|uri|url)$/i;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const ISO_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+export function asRecord(value, field) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${field} must be a JSON object.`);
+    return value;
+}
+export function requiredArray(value, field) {
+    if (!Array.isArray(value) || value.length === 0)
+        throw new Error(`${field} must be a non-empty array.`);
+    return value;
+}
+export function stringArray(value, field) {
+    if (!Array.isArray(value))
+        throw new Error(`${field} must be an array.`);
+    const strings = value.map((item, index) => requiredString(item, `${field}[${index}]`));
+    if (new Set(strings).size !== strings.length)
+        throw new Error(`${field} must not contain duplicates.`);
+    const sorted = [...strings].sort((left, right) => left.localeCompare(right));
+    if (JSON.stringify(strings) !== JSON.stringify(sorted))
+        throw new Error(`${field} must be sorted.`);
+    return strings;
+}
+export function requiredString(value, field) {
+    if (typeof value !== 'string' || value.trim() !== value || value.length === 0)
+        throw new Error(`${field} must be a non-empty trimmed string.`);
+    return value;
+}
+export function isoTimestamp(value, field) {
+    const timestamp = requiredString(value, field);
+    if (!ISO_TIMESTAMP_PATTERN.test(timestamp) || Number.isNaN(Date.parse(timestamp)))
+        throw new Error(`${field} must be an ISO UTC timestamp.`);
+    return timestamp;
+}
+export function sha256(value, field) {
+    const digest = requiredString(value, field);
+    if (!SHA256_PATTERN.test(digest))
+        throw new Error(`${field} must be a lowercase hexadecimal SHA-256.`);
+    return digest;
+}
+export function requiredEnum(value, values, field) {
+    if (typeof value !== 'string' || !values.includes(value))
+        throw new Error(`${field} is not declared.`);
+    return value;
+}
+export function optionalEnum(value, values, field) {
+    if (value !== undefined)
+        requiredEnum(value, values, field);
+}
+export function optionalRecord(value, field) {
+    if (value !== undefined)
+        asRecord(value, field);
+}
+export function assertAccount(value, accountId, field) {
+    assertValue(value, accountId, field);
+    if (!/^\d{12}$/.test(accountId))
+        throw new Error(`${field} must be a 12-digit AWS account id.`);
+}
+export function assertExactKeys(value, allowed, field) {
+    const allowedKeys = new Set(allowed);
+    const unknown = Object.keys(value).filter(key => !allowedKeys.has(key));
+    if (unknown.length > 0)
+        throw new Error(`${field} contains undeclared fields: ${unknown.sort().join(', ')}.`);
+}
+export function assertNoForbiddenKeys(value, field) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => assertNoForbiddenKeys(item, `${field}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        if (isForbiddenPublicKey(key))
+            throw new Error(`${field}.${key} is not allowed in a public artifact.`);
+        assertNoForbiddenKeys(child, `${field}.${key}`);
+    }
+}
+/** Rejects non-JSON values, non-plain objects, and forbidden public keys recursively. */
+export function assertPublicJson(value, field) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new Error(`${field} must contain only finite JSON numbers.`);
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => assertPublicJson(item, `${field}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== 'object' || Object.getPrototypeOf(value) !== Object.prototype) {
+        throw new Error(`${field} must contain only plain JSON values.`);
+    }
+    for (const [key, child] of Object.entries(value)) {
+        if (isForbiddenPublicKey(key))
+            throw new Error(`${field}.${key} is not allowed in a public artifact.`);
+        assertPublicJson(child, `${field}.${key}`);
+    }
+}
+function isForbiddenPublicKey(key) {
+    return NORMALIZED_FORBIDDEN_PUBLIC_KEYS.has(key.toLowerCase()) || FORBIDDEN_PUBLIC_KEY_PATTERN.test(key);
+}
+export function assertRequiredKeys(value, required, field) {
+    const missing = required.filter(key => !(key in value));
+    if (missing.length > 0)
+        throw new Error(`${field} is missing required fields: ${missing.join(', ')}.`);
+}
+export function assertValue(actual, expected, field) {
+    if (actual !== expected)
+        throw new Error(`${field} must match its exact binding.`);
+}
+export function assertJsonEqual(actual, expected, field) {
+    if (JSON.stringify(actual) !== JSON.stringify(expected))
+        throw new Error(`${field} must match its exact binding.`);
+}
+export function validateDescriptor(value, field) {
+    const descriptor = asRecord(value, field);
+    assertExactKeys(descriptor, ['name', 'mediaType', 'contentEncoding', 'byteLength', 'sha256'], field);
+    requiredString(descriptor.name, `${field}.name`);
+    assertValue(descriptor.mediaType, 'application/json', `${field}.mediaType`);
+    requiredEnum(descriptor.contentEncoding, ['identity', 'gzip'], `${field}.contentEncoding`);
+    if (!Number.isSafeInteger(descriptor.byteLength) || Number(descriptor.byteLength) < 0)
+        throw new Error(`${field}.byteLength must be a non-negative safe integer.`);
+    sha256(descriptor.sha256, `${field}.sha256`);
+}
+export function validateBilling(value, field = 'target.billing') {
+    const billing = asRecord(value, field);
+    if (billing.source === 'cur') {
+        assertExactKeys(billing, ['source', 'reportName', 'billingPeriod'], field);
+        requiredString(billing.reportName, `${field}.reportName`);
+    }
+    else if (billing.source === 'cur-2.0-data-exports') {
+        assertExactKeys(billing, ['source', 'exportName', 'billingPeriod'], field);
+        requiredString(billing.exportName, `${field}.exportName`);
+    }
+    else {
+        throw new Error(`${field}.source is not declared.`);
+    }
+    const period = asRecord(billing.billingPeriod, `${field}.billingPeriod`);
+    assertExactKeys(period, ['start', 'end'], `${field}.billingPeriod`);
+    calendarDate(period.start, `${field}.billingPeriod.start`);
+    calendarDate(period.end, `${field}.billingPeriod.end`);
+    if (String(period.start) > String(period.end))
+        throw new Error(`${field}.billingPeriod start must not exceed end.`);
+}
+function calendarDate(value, field) {
+    const date = requiredString(value, field);
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(date) || Number.isNaN(Date.parse(`${date}T00:00:00.000Z`)))
+        throw new Error(`${field} must be a valid calendar date.`);
+    if (new Date(`${date}T00:00:00.000Z`).toISOString().slice(0, 10) !== date)
+        throw new Error(`${field} must be a valid calendar date.`);
+    return date;
+}
+export function validateSelector(value, field) {
+    const selector = asRecord(value, field);
+    if (selector.kind === 'stable-key') {
+        assertExactKeys(selector, ['kind', 'stableKey'], field);
+        requiredString(selector.stableKey, `${field}.stableKey`);
+    }
+    else if (selector.kind === 'resource-arn') {
+        assertExactKeys(selector, ['kind', 'resourceArn'], field);
+        requiredString(selector.resourceArn, `${field}.resourceArn`);
+    }
+    else {
+        throw new Error(`${field}.kind is not declared.`);
+    }
+}
+export function validateMetricWindow(value, field) {
+    const window = asRecord(value, field);
+    assertExactKeys(window, ['start', 'end'], field);
+    isoTimestamp(window.start, `${field}.start`);
+    isoTimestamp(window.end, `${field}.end`);
+    if (String(window.start) > String(window.end))
+        throw new Error(`${field}.start must not exceed end.`);
+}
+export function validateTagRuleScope(value) {
+    if (value === undefined)
+        return;
+    const scope = asRecord(value, 'tagRuleScope');
+    assertExactKeys(scope, ['companyId'], 'tagRuleScope');
+    requiredString(scope.companyId, 'tagRuleScope.companyId');
+}

package/dist/esm/aws/pluginPublicArtifacts.js

@@ -0,0 +1,109 @@
+export const AWS_PLUGIN_PUBLIC_ARTIFACT_SCHEMA_VERSION = 1;
+export const AWS_PLUGIN_SOURCE_ARTIFACT_TYPES = [
+    'account-summary',
+    'resource-collection',
+    'ai-cost-summary',
+    'relationships',
+    'lifecycle',
+    'recommendations',
+    'recommendation-actionability',
+    'commitment-analysis',
+    'reliability',
+    'account-governance',
+];
+export const AWS_PLUGIN_SUBSCRIPTION_SECTIONS = [
+    'account-summary',
+    'resources',
+    'ai-cost-summary',
+    'service-retirement',
+    'recommendations',
+    'commitment-analysis',
+    'reliability',
+    'account-governance',
+];
+export const AWS_PLUGIN_RESOURCE_SECTIONS = ['resource', 'relationships', 'service-retirement', 'recommendations'];
+/** Builds the path-free subscription logical name from a target-key SHA-256. */
+export function buildAwsPluginSubscriptionLogicalName(targetKeySha256) {
+    return `plugin-subscription--${normalizeSha256(targetKeySha256, 'targetKeySha256')}.json.gz`;
+}
+/** Builds the path-free resource logical name from stable and target SHA-256 values. */
+export function buildAwsPluginResourceLogicalName(stableKeySha256, targetKeySha256) {
+    return `plugin-resource--${normalizeSha256(stableKeySha256, 'stableKeySha256')}--${normalizeSha256(targetKeySha256, 'targetKeySha256')}.json.gz`;
+}
+/** Browser-safe SHA-256 used to bind stable and target identity to logical names. */
+export function sha256AwsPluginIdentity(value) {
+    const words = [];
+    const bytes = [];
+    for (const character of value) {
+        const codePoint = character.codePointAt(0) ?? 0;
+        if (codePoint < 0x80)
+            bytes.push(codePoint);
+        else if (codePoint < 0x800)
+            bytes.push(0xc0 | (codePoint >>> 6), 0x80 | (codePoint & 0x3f));
+        else if (codePoint < 0x10000)
+            bytes.push(0xe0 | (codePoint >>> 12), 0x80 | ((codePoint >>> 6) & 0x3f), 0x80 | (codePoint & 0x3f));
+        else {
+            bytes.push(0xf0 | (codePoint >>> 18), 0x80 | ((codePoint >>> 12) & 0x3f), 0x80 | ((codePoint >>> 6) & 0x3f), 0x80 | (codePoint & 0x3f));
+        }
+    }
+    const bitLength = bytes.length * 8;
+    for (const byte of bytes)
+        words.push(byte);
+    words.push(0x80);
+    while (words.length % 64 !== 56)
+        words.push(0);
+    for (let index = 7; index >= 0; index--)
+        words.push(Math.floor(bitLength / 2 ** (index * 8)) & 0xff);
+    const state = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
+    const constants = [
+        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+        0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+        0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+        0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+    ];
+    const rotate = (word, bits) => (word >>> bits) | (word << (32 - bits));
+    for (let offset = 0; offset < words.length; offset += 64) {
+        const schedule = new Array(64);
+        for (let index = 0; index < 16; index++) {
+            const at = offset + index * 4;
+            schedule[index] = (words[at] << 24) | (words[at + 1] << 16) | (words[at + 2] << 8) | words[at + 3];
+        }
+        for (let index = 16; index < 64; index++) {
+            const previous = schedule[index - 15];
+            const recent = schedule[index - 2];
+            const small0 = rotate(previous, 7) ^ rotate(previous, 18) ^ (previous >>> 3);
+            const small1 = rotate(recent, 17) ^ rotate(recent, 19) ^ (recent >>> 10);
+            schedule[index] = (schedule[index - 16] + small0 + schedule[index - 7] + small1) | 0;
+        }
+        let [a, b, c, d, e, f, g, h] = state;
+        for (let index = 0; index < 64; index++) {
+            const large1 = rotate(e, 6) ^ rotate(e, 11) ^ rotate(e, 25);
+            const choose = (e & f) ^ (~e & g);
+            const temporary1 = (h + large1 + choose + constants[index] + schedule[index]) | 0;
+            const large0 = rotate(a, 2) ^ rotate(a, 13) ^ rotate(a, 22);
+            const majority = (a & b) ^ (a & c) ^ (b & c);
+            const temporary2 = (large0 + majority) | 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + temporary1) | 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temporary1 + temporary2) | 0;
+        }
+        [a, b, c, d, e, f, g, h].forEach((word, index) => {
+            state[index] = (state[index] + word) | 0;
+        });
+    }
+    return state.map(word => (word >>> 0).toString(16).padStart(8, '0')).join('');
+}
+function normalizeSha256(value, field) {
+    const normalized = value.trim().toLowerCase();
+    if (!/^[a-f0-9]{64}$/.test(normalized)) {
+        throw new Error(`${field} must be a lowercase hexadecimal SHA-256.`);
+    }
+    return normalized;
+}