@spottoai/types-package 1.0.2-beta.354 → 1.0.2-beta.356

package/README.md

@@ -44,6 +44,11 @@ import { User } from '@spottoai/types-package';
 
 // Import AWS-only public artifact contracts
 import type { AwsPortalAccountSummaryArtifact, AwsPortalResourceCollectionArtifact } from '@spottoai/types-package/aws';
+
+// Import AWS relationship or commitments validators without loading the
+// compatibility-wide AWS barrel.
+import { validateAwsPortalRelationshipArtifact } from '@spottoai/types-package/aws/relationships';
+import { validateAwsCommitmentsPlanningViewIdentity } from '@spottoai/types-package/aws/commitments-planning';
 ```
 
 The root entry point also exports the provider-neutral artifact generation,
@@ -62,6 +67,12 @@ relationship, and dependency-free allowlist validator. The validator binds the
 envelope, provider scope, nested applied scopes, and account-bearing ARNs while
 rejecting internal metadata, Azure-only fields, and undeclared public fields.
 
+The stable `/aws/relationships` and `/aws/commitments-planning` entry points
+expose those runtime contracts independently for browser consumers. The root
+and `/aws` barrels remain compatibility entry points and continue to export the
+same symbols. Package `import` conditions use tree-shakable native ESM while
+`require` conditions retain the CommonJS compatibility build.
+
 The root and `/aws` entry points export the secret-free `AwsEstatesManifest`,
 AWS estate/account/billing-source command union, and company trust-setup
 contracts. The API-owned desired-state document is stored as

package/dist/aws/commitments-planning.d.ts

@@ -0,0 +1,3 @@
+export type { AwsCommitmentsPlanningView } from '../azure/commitmentsPlanning';
+export { validateAwsCommitmentsPlanningViewIdentity } from './commitmentsPlanningValidation';
+//# sourceMappingURL=commitments-planning.d.ts.map

package/dist/aws/commitments-planning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitments-planning.d.ts","sourceRoot":"","sources":["../../src/aws/commitments-planning.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,0CAA0C,EAAE,MAAM,iCAAiC,CAAC"}

package/dist/aws/commitments-planning.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAwsCommitmentsPlanningViewIdentity = void 0;
+var commitmentsPlanningValidation_1 = require("./commitmentsPlanningValidation");
+Object.defineProperty(exports, "validateAwsCommitmentsPlanningViewIdentity", { enumerable: true, get: function () { return commitmentsPlanningValidation_1.validateAwsCommitmentsPlanningViewIdentity; } });
+//# sourceMappingURL=commitments-planning.js.map

package/dist/aws/commitments-planning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitments-planning.js","sourceRoot":"","sources":["../../src/aws/commitments-planning.ts"],"names":[],"mappings":";;;AACA,iFAA6F;AAApF,2JAAA,0CAA0C,OAAA"}

package/dist/aws/relationships.d.ts

@@ -0,0 +1,4 @@
+export { validateAwsPortalRelationshipArtifact } from './portalRelationshipPublicArtifactValidation';
+export type { AwsPortalRelationshipArtifact, AwsPortalRelationshipDiscoveryFamily, } from './portalRelationshipPublicArtifacts';
+export type { AwsPortalRelationshipResourceNodeData } from './portalRelationshipResourceNodeTypes';
+//# sourceMappingURL=relationships.d.ts.map

package/dist/aws/relationships.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationships.d.ts","sourceRoot":"","sources":["../../src/aws/relationships.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qCAAqC,EAAE,MAAM,8CAA8C,CAAC;AACrG,YAAY,EACV,6BAA6B,EAC7B,oCAAoC,GACrC,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,qCAAqC,EAAE,MAAM,uCAAuC,CAAC"}

package/dist/aws/relationships.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAwsPortalRelationshipArtifact = void 0;
+var portalRelationshipPublicArtifactValidation_1 = require("./portalRelationshipPublicArtifactValidation");
+Object.defineProperty(exports, "validateAwsPortalRelationshipArtifact", { enumerable: true, get: function () { return portalRelationshipPublicArtifactValidation_1.validateAwsPortalRelationshipArtifact; } });
+//# sourceMappingURL=relationships.js.map

package/dist/aws/relationships.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationships.js","sourceRoot":"","sources":["../../src/aws/relationships.ts"],"names":[],"mappings":";;;AAAA,2GAAqG;AAA5F,mKAAA,qCAAqC,OAAA"}

package/dist/esm/accounts/accounts.js

@@ -0,0 +1,115 @@
+export const AZURE_SYNC_FEATURE_ORDER = [
+    'activityMonitoring',
+    'metrics',
+    'billing',
+    'pricing',
+    'costEstimation',
+    'commitments',
+    'relationshipGraphs',
+    'governance',
+    'availabilityZones',
+    'reliability',
+    'perimeterInsights',
+    'reportEvidencePack',
+];
+export const AZURE_SYNC_FEATURE_METADATA = [
+    {
+        id: 'activityMonitoring',
+        displayName: 'Activity monitoring',
+        description: 'Collects Azure activity logs and activity-derived operational events.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+        warning: 'Disabling activity monitoring prevents activity log collection and related detections.',
+    },
+    {
+        id: 'metrics',
+        displayName: 'Metrics',
+        description: 'Collects subscription resource metrics used for utilization and rightsizing insights.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+    {
+        id: 'billing',
+        displayName: 'Billing',
+        description: 'Collects billing and cost usage data.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+    {
+        id: 'pricing',
+        displayName: 'Pricing',
+        description: 'Collects Azure price data used for cost calculations.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+    {
+        id: 'costEstimation',
+        displayName: 'Cost estimation',
+        description: 'Builds estimated costs when billing-backed usage is unavailable or incomplete.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+    {
+        id: 'commitments',
+        displayName: 'Reservations and commitments',
+        description: 'Collects reserved instances, savings plans, and commitment utilization data.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+    {
+        id: 'relationshipGraphs',
+        displayName: 'Relationship graphs',
+        description: 'Builds relationship graph artifacts from scanned Azure resources.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+    {
+        id: 'governance',
+        displayName: 'Governance',
+        description: 'Builds tenant and subscription governance reports and graph artifacts.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+    {
+        id: 'availabilityZones',
+        displayName: 'Availability zones',
+        description: 'Collects tenant-level availability zone mappings.',
+        supportedScopes: ['cloudAccount'],
+    },
+    {
+        id: 'reliability',
+        displayName: 'Reliability',
+        description: 'Collects reliability signals and recommendations for subscription resources.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+    {
+        id: 'perimeterInsights',
+        displayName: 'Perimeter insights',
+        description: 'Builds public IP and perimeter exposure insights.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+    {
+        id: 'reportEvidencePack',
+        displayName: 'Report evidence pack',
+        description: 'Builds evidence artifacts used by reports and review workflows.',
+        supportedScopes: ['cloudAccount', 'subscription'],
+    },
+];
+const AZURE_SYNC_FEATURE_ORDER_INDEX = new Map(AZURE_SYNC_FEATURE_ORDER.map((featureId, index) => [featureId, index]));
+const AZURE_SYNC_FEATURE_IDS = new Set(AZURE_SYNC_FEATURE_ORDER);
+export const isAzureSyncFeatureId = (value) => AZURE_SYNC_FEATURE_IDS.has(value);
+export const getAzureSyncFeatureMetadata = (featureId) => AZURE_SYNC_FEATURE_METADATA.find(feature => feature.id === featureId) ?? {
+    id: featureId,
+    displayName: featureId,
+    description: '',
+    supportedScopes: ['cloudAccount', 'subscription'],
+};
+export const isAzureSyncFeatureSupportedInScope = (featureId, scope) => getAzureSyncFeatureMetadata(featureId).supportedScopes.includes(scope);
+export const sortAzureSyncFeatureIds = (featureIds) => [...featureIds].sort((left, right) => (AZURE_SYNC_FEATURE_ORDER_INDEX.get(left) ?? Number.MAX_SAFE_INTEGER) - (AZURE_SYNC_FEATURE_ORDER_INDEX.get(right) ?? Number.MAX_SAFE_INTEGER));
+const supportsAzureSyncFeatureScope = (feature, scope) => feature.supportedScopes.includes(scope);
+export const getAzureSyncFeatureOptions = (scope) => AZURE_SYNC_FEATURE_METADATA.filter(feature => supportsAzureSyncFeatureScope(feature, scope));
+export const getAzureSyncFeatureIdsForScope = (scope) => getAzureSyncFeatureOptions(scope).map(feature => feature.id);
+export const SUBSCRIPTION_SYNC_STEP_ORDER = [
+    'metrics',
+    'resourcegroups',
+    'activities',
+    'queries',
+    'reliability',
+    'billing',
+    'costestimation',
+    'pricing',
+    'commitments',
+    'views',
+];

package/dist/esm/accounts/azureSpSetup.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/accounts/azureSpSetupDurable.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/accounts/index.js

@@ -0,0 +1,5 @@
+export * from './accounts.js';
+export * from './azureSpSetup.js';
+export * from './azureSpSetupDurable.js';
+export * from './writePermissions.js';
+export * from './readPermissions.js';

package/dist/esm/accounts/readPermissions.js

@@ -0,0 +1,198 @@
+/**
+ * Subscription-scoped read capability bitmask enum.
+ * Each capability maps to a single bit.
+ */
+export var SubscriptionReadPermission;
+(function (SubscriptionReadPermission) {
+    /** Permission to read Azure Monitor metrics. */
+    SubscriptionReadPermission[SubscriptionReadPermission["MonitoringReader"] = 1] = "MonitoringReader";
+    /** Permission to run Log Analytics / App Insights data queries. */
+    SubscriptionReadPermission[SubscriptionReadPermission["LogAnalyticsDataReader"] = 2] = "LogAnalyticsDataReader";
+    /** Permission to read subscription resource groups. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ResourceGroupsReader"] = 4] = "ResourceGroupsReader";
+    /** Permission to read subscription resource inventory. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ResourceInventoryReader"] = 8] = "ResourceInventoryReader";
+    /** Permission to read Azure Activity Log events. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ActivityLogReader"] = 16] = "ActivityLogReader";
+    /** Permission to run Azure Resource Graph queries. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ResourceGraphReader"] = 32] = "ResourceGraphReader";
+    /** Permission to read Azure Cost Management query results. */
+    SubscriptionReadPermission[SubscriptionReadPermission["CostManagementReader"] = 64] = "CostManagementReader";
+    /** Permission to read Azure Consumption usage details. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ConsumptionUsageReader"] = 128] = "ConsumptionUsageReader";
+    /** Permission to read Azure Advisor recommendations and Advisor score. */
+    SubscriptionReadPermission[SubscriptionReadPermission["AdvisorRecommendationsReader"] = 256] = "AdvisorRecommendationsReader";
+    /** Permission to read Defender for Cloud security posture data. */
+    SubscriptionReadPermission[SubscriptionReadPermission["SecurityReader"] = 512] = "SecurityReader";
+})(SubscriptionReadPermission || (SubscriptionReadPermission = {}));
+/**
+ * Cloud-account-scoped read capability bitmask enum.
+ * Each capability maps to a single bit.
+ */
+export var CloudAccountReadPermission;
+(function (CloudAccountReadPermission) {
+    /** Permission to read management group entities. */
+    CloudAccountReadPermission[CloudAccountReadPermission["ManagementGroupReader"] = 1] = "ManagementGroupReader";
+    /** Permission to read reservation resources and related consumption artifacts. */
+    CloudAccountReadPermission[CloudAccountReadPermission["ReservationsReader"] = 2] = "ReservationsReader";
+    /** Permission to read savings plan resources. */
+    CloudAccountReadPermission[CloudAccountReadPermission["SavingsPlanReader"] = 4] = "SavingsPlanReader";
+    /** Permission to read Microsoft Graph applications/service principals. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphApplicationReadAll"] = 8] = "GraphApplicationReadAll";
+    /** Permission to read Microsoft Graph privileged role assignment schedules. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphRoleAssignmentScheduleReadDirectory"] = 16] = "GraphRoleAssignmentScheduleReadDirectory";
+    /** Permission to read Microsoft Graph privileged role eligibility schedules. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphRoleEligibilityScheduleReadDirectory"] = 32] = "GraphRoleEligibilityScheduleReadDirectory";
+    /** Permission to read Microsoft Graph role-management metadata. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphRoleManagementReadDirectory"] = 64] = "GraphRoleManagementReadDirectory";
+    /** Permission to read Microsoft Graph group memberships. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphGroupMemberReadAll"] = 128] = "GraphGroupMemberReadAll";
+    /** Permission to read Microsoft Graph user metadata. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphUserReadAll"] = 256] = "GraphUserReadAll";
+    /** Permission to read Microsoft Graph audit logs. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphAuditLogReadAll"] = 1024] = "GraphAuditLogReadAll";
+})(CloudAccountReadPermission || (CloudAccountReadPermission = {}));
+export const SUBSCRIPTION_READ_PERMISSIONS_METADATA = [
+    {
+        id: SubscriptionReadPermission.MonitoringReader,
+        displayName: 'Monitoring Reader',
+        description: 'Allows Spotto to read Azure Monitor metrics for subscription resources.',
+        requiredRoles: ['Monitoring Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/azure-monitor/roles-permissions-security',
+    },
+    {
+        id: SubscriptionReadPermission.LogAnalyticsDataReader,
+        displayName: 'Log Analytics Data Reader',
+        description: 'Allows Spotto to run Log Analytics and App Insights data queries.',
+        requiredRoles: ['Log Analytics Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access',
+    },
+    {
+        id: SubscriptionReadPermission.ResourceGroupsReader,
+        displayName: 'Resource Groups Reader',
+        description: 'Allows Spotto to read resource groups for subscription inventory and grouping.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/general#reader',
+    },
+    {
+        id: SubscriptionReadPermission.ResourceInventoryReader,
+        displayName: 'Resource Inventory Reader',
+        description: 'Allows Spotto to read subscription resources for inventory, recommendations, relationship graph, and portal/plugin views.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/general#reader',
+    },
+    {
+        id: SubscriptionReadPermission.ActivityLogReader,
+        displayName: 'Activity Log Reader',
+        description: 'Allows Spotto to read Azure Activity Log events for operational context and refresh decisions.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log',
+    },
+    {
+        id: SubscriptionReadPermission.ResourceGraphReader,
+        displayName: 'Resource Graph Reader',
+        description: 'Allows Spotto to run Azure Resource Graph queries used by inventory, governance, reliability, and security checks.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview',
+    },
+    {
+        id: SubscriptionReadPermission.CostManagementReader,
+        displayName: 'Cost Management Reader',
+        description: 'Allows Spotto to read scoped Azure Cost Management data for costs, budgets, and savings calculations.',
+        requiredRoles: ['Cost Management Reader', 'Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/assign-access-acm-data',
+    },
+    {
+        id: SubscriptionReadPermission.ConsumptionUsageReader,
+        displayName: 'Consumption Usage Reader',
+        description: 'Allows Spotto to read Azure usage detail rows for usage attribution and commitment analysis.',
+        requiredRoles: ['Cost Management Reader', 'Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/rest/api/consumption/usage-details/list',
+    },
+    {
+        id: SubscriptionReadPermission.AdvisorRecommendationsReader,
+        displayName: 'Advisor Reader',
+        description: 'Allows Spotto to read Azure Advisor recommendations and Advisor score for recommendation import and optimization workflows.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/advisor/advisor-overview',
+    },
+    {
+        id: SubscriptionReadPermission.SecurityReader,
+        displayName: 'Security Reader',
+        description: 'Allows Spotto to read Defender for Cloud assessments, secure score, and security posture data.',
+        requiredRoles: ['Security Reader', 'Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/defender-for-cloud/permissions',
+    },
+];
+export const CLOUD_ACCOUNT_READ_PERMISSIONS_METADATA = [
+    {
+        id: CloudAccountReadPermission.ManagementGroupReader,
+        displayName: 'Management Group Reader',
+        description: 'Allows Spotto to read tenant management group entities.',
+        requiredRoles: ['Management Group Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/governance/management-groups/how-to/protect-resource-hierarchy',
+    },
+    {
+        id: CloudAccountReadPermission.ReservationsReader,
+        displayName: 'Reservations Reader',
+        description: 'Allows Spotto to read reservation resources and reservation usage artifacts.',
+        requiredRoles: ['Reservations Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/view-reservations',
+    },
+    {
+        id: CloudAccountReadPermission.SavingsPlanReader,
+        displayName: 'Savings Plan Reader',
+        description: 'Allows Spotto to read savings plan resources.',
+        requiredRoles: ['Savings plan Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/cost-management-billing/savings-plan/view-utilization',
+    },
+    {
+        id: CloudAccountReadPermission.GraphApplicationReadAll,
+        displayName: 'Graph Application Read.All',
+        description: 'Allows Spotto to read Microsoft Graph applications and service principals.',
+        requiredRoles: ['Application.Read.All'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#applicationreadall',
+    },
+    {
+        id: CloudAccountReadPermission.GraphRoleAssignmentScheduleReadDirectory,
+        displayName: 'Graph RoleAssignmentSchedule Read.Directory',
+        description: 'Allows Spotto to read active Microsoft Graph role assignment schedules.',
+        requiredRoles: ['RoleAssignmentSchedule.Read.Directory'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#roleassignmentschedulereaddirectory',
+    },
+    {
+        id: CloudAccountReadPermission.GraphRoleEligibilityScheduleReadDirectory,
+        displayName: 'Graph RoleEligibilitySchedule Read.Directory',
+        description: 'Allows Spotto to read eligible Microsoft Graph role schedules.',
+        requiredRoles: ['RoleEligibilitySchedule.Read.Directory'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#roleeligibilityschedulereaddirectory',
+    },
+    {
+        id: CloudAccountReadPermission.GraphRoleManagementReadDirectory,
+        displayName: 'Graph RoleManagement Read.Directory',
+        description: 'Allows Spotto to read Microsoft Graph role-management metadata.',
+        requiredRoles: ['RoleManagement.Read.Directory'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#rolemanagementreaddirectory',
+    },
+    {
+        id: CloudAccountReadPermission.GraphGroupMemberReadAll,
+        displayName: 'Graph GroupMember Read.All',
+        description: 'Allows Spotto to read Microsoft Graph group memberships.',
+        requiredRoles: ['GroupMember.Read.All'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#groupmemberreadall',
+    },
+    {
+        id: CloudAccountReadPermission.GraphUserReadAll,
+        displayName: 'Graph User Read.All',
+        description: 'Allows Spotto to read Microsoft Graph user metadata.',
+        requiredRoles: ['User.Read.All'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#userreadall',
+    },
+    {
+        id: CloudAccountReadPermission.GraphAuditLogReadAll,
+        displayName: 'Graph AuditLog Read.All',
+        description: 'Allows Spotto to read Microsoft Graph audit logs.',
+        requiredRoles: ['AuditLog.Read.All'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#auditlogreadall',
+    },
+];

package/dist/esm/accounts/validation.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/accounts/writePermissions.js

@@ -0,0 +1,43 @@
+/**
+ * Write Permission Bitmask Enum
+ * Each permission gets a unique bit position for efficient storage
+ */
+export var WritePermission;
+(function (WritePermission) {
+    /** Permission to dismiss Azure Advisor recommendations */
+    WritePermission[WritePermission["DismissRecommendations"] = 1] = "DismissRecommendations";
+    /** Permission to enable storage inventory reports on storage accounts */
+    WritePermission[WritePermission["StorageInventory"] = 2] = "StorageInventory";
+    /** Permission to create scoped Azure Policy exemptions */
+    WritePermission[WritePermission["PolicyExemptions"] = 4] = "PolicyExemptions";
+})(WritePermission || (WritePermission = {}));
+/**
+ * Permission metadata array
+ * Define all available write permissions with their metadata
+ */
+export const WRITE_PERMISSIONS_METADATA = [
+    {
+        id: WritePermission.DismissRecommendations,
+        displayName: 'Dismiss Azure Advisor Recommendations',
+        description: 'Allows Spotto to dismiss recommendations in Azure when dismissed here.',
+        requiredRoles: ['Advisor Recommendations Contributor'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/advisor/permissions',
+        scriptGeneratorUrl: '/scripts/advisor-role',
+    },
+    {
+        id: WritePermission.StorageInventory,
+        displayName: 'Enable Storage Inventory Reports',
+        description: 'Allows Spotto to enable blob inventory on storage accounts you select.',
+        requiredRoles: ['Storage Account Contributor'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory',
+        scriptGeneratorUrl: '/scripts/storage-role',
+    },
+    {
+        id: WritePermission.PolicyExemptions,
+        displayName: 'Create Azure Policy Exemptions',
+        description: 'Allows Spotto to create narrowly scoped exemptions for selected Azure Policy initiative controls.',
+        requiredRoles: ['Custom role with Azure Policy exemption actions at the target and assignment scopes'],
+        documentationUrl: 'https://docs.spotto.ai/docs/portal/write-permissions/policy-exemptions',
+        scriptGeneratorUrl: '/scripts/policy-exemptions-role',
+    },
+];

package/dist/esm/ai/index.js

@@ -0,0 +1,2 @@
+/** Common AI interfaces shared between frontend and backend */
+export {};

package/dist/esm/assessments/artifact.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/catalogue.js

@@ -0,0 +1,12 @@
+export const ARCHITECTURE_ASSESSMENT_REQUIRED_CONTEXT_CATEGORIES = [
+    'company-profile',
+    'architecture',
+    'operations',
+    'reliability',
+    'roadmap',
+];
+export const ARCHITECTURE_ASSESSMENT_OPTIONAL_CONTEXT_CATEGORIES = [
+    'security',
+    'performance',
+    'finops',
+];

package/dist/esm/assessments/common.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/evidence.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/export.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/index.js

@@ -0,0 +1,10 @@
+export * from './status.js';
+export * from './common.js';
+export * from './catalogue.js';
+export * from './run.js';
+export * from './evidence.js';
+export * from './artifact.js';
+export * from './review.js';
+export * from './queue.js';
+export * from './export.js';
+export * from './sow.js';

package/dist/esm/assessments/queue.js

@@ -0,0 +1,2 @@
+export const ASSESSMENT_QUEUE_ENTITY = 'assessment';
+export const ASSESSMENT_GENERATE_ACTION = 'generate-assessment';

package/dist/esm/assessments/review.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/run.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/sow.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/status.js

@@ -0,0 +1,23 @@
+export const ARCHITECTURE_ASSESSMENT_TYPE = 'architecture';
+export const ASSESSMENT_TYPES = [ARCHITECTURE_ASSESSMENT_TYPE];
+export const ASSESSMENT_PROVIDER_NAMES = ['azure'];
+export const ASSESSMENT_RELEASE_STAGES = ['preview', 'ga'];
+export const ASSESSMENT_RUN_STATUSES = ['draft', 'queued', 'running', 'needs_review', 'approved', 'published', 'failed'];
+export const ASSESSMENT_EXPORT_FORMATS = ['docx'];
+export const ASSESSMENT_EXPORT_STATUSES = ['requested', 'completed', 'failed'];
+export const ASSESSMENT_EVIDENCE_SOURCE_TYPES = [
+    'company_context_note',
+    'subscription_report_evidence_pack',
+    'portal_artifact',
+    'raw_artifact',
+    'conformed_artifact',
+    'review_checklist',
+    'derived_summary',
+    'ai_inference',
+    'evidence_gap',
+];
+export const ASSESSMENT_EVIDENCE_CONFIDENCE_LEVELS = ['confirmed', 'customer_supplied', 'derived', 'inferred', 'gap'];
+export const ASSESSMENT_PRIORITY_LEVELS = ['critical', 'high', 'medium', 'low', 'informational'];
+export const ASSESSMENT_EFFORT_BANDS = ['low', 'medium', 'high', 'unknown'];
+export const ASSESSMENT_IMPACT_LEVELS = ['low', 'medium', 'high', 'unknown'];
+export const ASSESSMENT_PILLARS = ['architecture', 'security', 'reliability', 'performance', 'operations', 'finops', 'roadmap'];

package/dist/esm/aws/commitments-planning.js

@@ -0,0 +1 @@
+export { validateAwsCommitmentsPlanningViewIdentity } from './commitmentsPlanningValidation.js';