@spottoai/types-package 1.0.2-beta.354 → 1.0.2-beta.356

package/dist/esm/aws/commitmentsPlanningValidation.js

@@ -0,0 +1,121 @@
+import { ProviderName } from '../common/provider.js';
+import { asRecord, assertAccount, assertExactKeys, assertValue } from './pluginPublicArtifactValidationHelpers.js';
+const FORBIDDEN_AWS_COMMITMENTS_KEYS = new Set([
+    'billingScopeId',
+    'breakCostEstimate',
+    'cloudAccountId',
+    'companyId',
+    'credentialHealth',
+    'credentialId',
+    'managementGroupId',
+    'pricingQuote',
+    'quotePolicy',
+    'resourceGroupId',
+    'storageCapacity',
+    'storageDimensions',
+    'subscription',
+    'subscriptionId',
+    'tenantId',
+    'unlockFinancialLedger',
+]);
+/**
+ * Validates the security-sensitive AWS identity boundary of a commitments view.
+ * A full public-artifact validator should call this before publication or response.
+ */
+export function validateAwsCommitmentsPlanningViewIdentity(value, expectedAccountId) {
+    const view = asRecord(value, 'commitmentsPlanning');
+    const providerScope = asRecord(view.providerScope, 'commitmentsPlanning.providerScope');
+    assertExactKeys(providerScope, ['providerName', 'providerScopeId'], 'commitmentsPlanning.providerScope');
+    assertValue(providerScope.providerName, ProviderName.Aws, 'commitmentsPlanning.providerScope.providerName');
+    const accountId = String(providerScope.providerScopeId ?? '');
+    assertAccount(providerScope.providerScopeId, accountId, 'commitmentsPlanning.providerScope.providerScopeId');
+    if (expectedAccountId !== undefined) {
+        assertAccount(expectedAccountId, accountId, 'expectedAccountId');
+    }
+    validateInventory(view.inventory, accountId);
+    validatePurchaseRecommendations(view.purchaseRecommendations, accountId);
+    validateBoundIdentities(view, accountId, 'commitmentsPlanning');
+}
+function validateInventory(value, accountId) {
+    if (!Array.isArray(value))
+        throw new Error('commitmentsPlanning.inventory must be an array.');
+    value.forEach((item, index) => {
+        const field = `commitmentsPlanning.inventory[${index}]`;
+        const record = asRecord(item, field);
+        assertValue(record.sourceKind, 'aws-native', `${field}.sourceKind`);
+        assertValue(record.provider, ProviderName.Aws, `${field}.provider`);
+        assertValue(record.appliedScopeType, 'linked-account', `${field}.appliedScopeType`);
+        validateAppliedScope(record.appliedScopeProperties, accountId, `${field}.appliedScopeProperties`);
+        validateAwsShape(record.shape, `${field}.shape`);
+    });
+}
+function validatePurchaseRecommendations(value, accountId) {
+    if (value === undefined)
+        return;
+    if (!Array.isArray(value))
+        throw new Error('commitmentsPlanning.purchaseRecommendations must be an array.');
+    value.forEach((item, index) => {
+        const field = `commitmentsPlanning.purchaseRecommendations[${index}]`;
+        const record = asRecord(item, field);
+        assertValue(record.purchaseScope, 'linked-account', `${field}.purchaseScope`);
+        validateAppliedScope(record.appliedScopeProperties, accountId, `${field}.appliedScopeProperties`);
+        validateAwsSource(record.source, `${field}.source`);
+        validateAwsShape(record.currentShape, `${field}.currentShape`);
+        validateAwsShape(record.targetShape, `${field}.targetShape`, true);
+        if (record.eligibility !== undefined) {
+            const eligibility = asRecord(record.eligibility, `${field}.eligibility`);
+            validateAwsShape(eligibility.currentShape, `${field}.eligibility.currentShape`);
+            validateAwsShape(eligibility.targetShape, `${field}.eligibility.targetShape`);
+            if (eligibility.source !== undefined)
+                validateAwsSource(eligibility.source, `${field}.eligibility.source`);
+        }
+    });
+}
+function validateAppliedScope(value, accountId, field) {
+    const scope = asRecord(value, field);
+    assertExactKeys(scope, ['accountId', 'region', 'availabilityZone'], field);
+    assertAccount(scope.accountId, accountId, `${field}.accountId`);
+}
+function validateAwsSource(value, field) {
+    const source = asRecord(value, field);
+    assertValue(source.sourceKind, 'aws-native', `${field}.sourceKind`);
+}
+function validateAwsShape(value, field, required = false) {
+    if (value === undefined && !required)
+        return;
+    const shape = asRecord(value, field);
+    assertValue(shape.provider, 'aws', `${field}.provider`);
+}
+function validateBoundIdentities(value, accountId, field) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => validateBoundIdentities(item, accountId, `${field}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== 'object') {
+        if (typeof value === 'string')
+            validateArnAccount(value, accountId, field);
+        return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        if (FORBIDDEN_AWS_COMMITMENTS_KEYS.has(key)) {
+            throw new Error(`${field}.${key} is not allowed in an AWS commitments artifact.`);
+        }
+        if (key === 'accountId')
+            assertAccount(child, accountId, `${field}.${key}`);
+        if (key === 'providerName')
+            assertValue(child, ProviderName.Aws, `${field}.${key}`);
+        if (key === 'provider')
+            assertValue(child, 'aws', `${field}.${key}`);
+        if (key === 'sourceKind' && child === 'azure-native') {
+            throw new Error(`${field}.${key} cannot contain Azure-native evidence.`);
+        }
+        validateBoundIdentities(child, accountId, `${field}.${key}`);
+    }
+}
+function validateArnAccount(value, accountId, field) {
+    if (!value.startsWith('arn:'))
+        return;
+    const arnAccountId = value.split(':', 6)[4];
+    if (arnAccountId)
+        assertAccount(arnAccountId, accountId, field);
+}

package/dist/esm/aws/estates.js

@@ -0,0 +1,21 @@
+import { AWS_FORBIDDEN_CREDENTIAL_FIELDS } from './requests.js';
+/** Schema version for the API-owned AWS company estate manifest. */
+export const AWS_ESTATES_MANIFEST_SCHEMA_VERSION = 1;
+/** Public provider discriminator used by the AWS estate manifest API. */
+export const AWS_ESTATES_MANIFEST_PROVIDER = 'AWS';
+export const AWS_ESTATE_KINDS = ['standalone', 'organization'];
+export const AWS_ESTATE_ACCOUNT_SOURCES = ['manual'];
+export const AWS_ESTATE_ROLE_DEPLOYMENT_MODES = ['customer-managed'];
+export const AWS_ESTATE_ACCOUNT_PURPOSES = ['resource-discovery', 'organization-discovery', 'billing-definition', 'billing-storage'];
+/**
+ * Credential-shaped fields that manifest API boundaries must reject
+ * recursively before persisting untyped JSON.
+ */
+export const AWS_ESTATES_MANIFEST_FORBIDDEN_CREDENTIAL_FIELDS = [
+    ...AWS_FORBIDDEN_CREDENTIAL_FIELDS,
+    'externalId',
+    'accessToken',
+    'connectionString',
+    'sasToken',
+    'storageCredential',
+];

package/dist/esm/aws/index.js

@@ -0,0 +1,18 @@
+export * from './estates.js';
+export * from './commitmentsPlanningValidation.js';
+export * from './onboarding.js';
+export * from './pluginPublicArtifacts.js';
+export * from './pluginPublicArtifactEvidence.js';
+export * from './pluginPublicArtifactValidation.js';
+export * from './portalPublicArtifacts.js';
+export * from './portalCommitmentsPlanningPublicArtifacts.js';
+export * from './portalCommitmentsPlanningPublicArtifactValidation.js';
+export * from './portalRelationshipPublicArtifacts.js';
+export * from './portalRelationshipResourceNodeTypes.js';
+export * from './portalRelationshipPublicArtifactValidation.js';
+export * from './portalPublicArtifactHistoryTypes.js';
+export * from './portalPublicArtifactNestedEvidence.js';
+export * from './portalPublicArtifactNestedEvidenceValidation.js';
+export * from './portalPublicArtifactValidation.js';
+export * from './publicArtifacts.js';
+export * from './requests.js';

package/dist/esm/aws/onboarding.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/aws/pluginPublicArtifactBodyValidation.js

@@ -0,0 +1,217 @@
+import { AWS_PLUGIN_PUBLIC_ARTIFACT_SCHEMA_VERSION, buildAwsPluginResourceLogicalName, buildAwsPluginSubscriptionLogicalName, sha256AwsPluginIdentity, } from './pluginPublicArtifacts.js';
+import { AWS_PUBLIC_ARTIFACT_SCHEMA_VERSION } from './publicArtifacts.js';
+import { asRecord, assertAccount, assertExactKeys, assertJsonEqual, assertPublicJson, assertValue, isoTimestamp, optionalEnum, requiredEnum, requiredString, sha256, stringArray, validateBilling, validateMetricWindow, validateSelector, validateTagRuleScope, } from './pluginPublicArtifactValidationHelpers.js';
+import { validateResourceSections, validateSubscriptionSections } from './pluginPublicArtifactSectionValidation.js';
+export { validateSourceBinding } from './pluginPublicArtifactSectionValidation.js';
+/** Validates and returns one lossless AWS plugin subscription-detail body. */
+export function validateAwsPluginSubscriptionDetailArtifact(value) {
+    const artifact = asRecord(value, 'artifact');
+    assertExactKeys(artifact, [
+        'schemaVersion',
+        'pluginSchemaVersion',
+        'provider',
+        'accountId',
+        'artifactType',
+        'artifactGeneration',
+        'generatedAt',
+        'logicalName',
+        'target',
+        'sections',
+    ], 'artifact');
+    validateArtifactEnvelope(artifact, 'plugin-subscription');
+    const target = validateTarget(artifact.target, 'subscription-detail');
+    const accountId = requiredString(artifact.accountId, 'artifact.accountId');
+    assertAccount(target.accountId, accountId, 'artifact.target.accountId');
+    assertValue(artifact.logicalName, buildAwsPluginSubscriptionLogicalName(target.targetKeySha256), 'artifact.logicalName');
+    validateSubscriptionSections(artifact.sections, target, requiredString(artifact.generatedAt, 'artifact.generatedAt'));
+    assertPublicJson(artifact, 'artifact');
+    return value;
+}
+/** Validates and returns one lossless AWS plugin resource-detail body. */
+export function validateAwsPluginResourceDetailArtifact(value) {
+    const artifact = asRecord(value, 'artifact');
+    assertExactKeys(artifact, [
+        'schemaVersion',
+        'pluginSchemaVersion',
+        'provider',
+        'accountId',
+        'artifactType',
+        'artifactGeneration',
+        'generatedAt',
+        'logicalName',
+        'target',
+        'selector',
+        'stableKey',
+        'sections',
+    ], 'artifact');
+    validateArtifactEnvelope(artifact, 'plugin-resource');
+    const target = validateTarget(artifact.target, 'resource-detail');
+    const accountId = requiredString(artifact.accountId, 'artifact.accountId');
+    assertAccount(target.accountId, accountId, 'artifact.target.accountId');
+    assertValue(artifact.logicalName, buildAwsPluginResourceLogicalName(target.stableKeySha256, target.targetKeySha256), 'artifact.logicalName');
+    assertJsonEqual(artifact.selector, target.selector, 'artifact.selector');
+    assertValue(artifact.stableKey, target.stableKey, 'artifact.stableKey');
+    validateResourceSections(artifact.sections, target, requiredString(artifact.generatedAt, 'artifact.generatedAt'));
+    assertPublicJson(artifact, 'artifact');
+    return value;
+}
+function validateArtifactEnvelope(artifact, artifactType) {
+    assertValue(artifact.schemaVersion, AWS_PUBLIC_ARTIFACT_SCHEMA_VERSION, 'artifact.schemaVersion');
+    assertValue(artifact.pluginSchemaVersion, AWS_PLUGIN_PUBLIC_ARTIFACT_SCHEMA_VERSION, 'artifact.pluginSchemaVersion');
+    assertValue(artifact.provider, 'aws', 'artifact.provider');
+    requiredString(artifact.accountId, 'artifact.accountId');
+    assertValue(artifact.artifactType, artifactType, 'artifact.artifactType');
+    const generation = validateGeneration(artifact.artifactGeneration, 'artifact.artifactGeneration');
+    assertValue(isoTimestamp(artifact.generatedAt, 'artifact.generatedAt'), generation.generatedAt, 'artifact.generatedAt');
+}
+function validateGeneration(value, field) {
+    const generation = asRecord(value, field);
+    assertExactKeys(generation, ['runId', 'generatedAt'], field);
+    return {
+        runId: requiredString(generation.runId, `${field}.runId`),
+        generatedAt: isoTimestamp(generation.generatedAt, `${field}.generatedAt`),
+    };
+}
+export function validateTarget(value, kind) {
+    const target = asRecord(value, 'target');
+    assertValue(target.kind, kind, 'target.kind');
+    assertValue(target.provider, 'aws', 'target.provider');
+    requiredString(target.accountId, 'target.accountId');
+    requiredString(target.targetKey, 'target.targetKey');
+    sha256(target.targetKeySha256, 'target.targetKeySha256');
+    assertValue(target.targetKeySha256, sha256AwsPluginIdentity(requiredString(target.targetKey, 'target.targetKey')), 'target.targetKeySha256');
+    validateBilling(target.billing);
+    stringArray(target.resourceRegions, 'target.resourceRegions');
+    validateMetricWindow(target.metricTimeWindow, 'target.metricTimeWindow');
+    validateRecommendationScopes(target.recommendationScopes, requiredString(target.accountId, 'target.accountId'));
+    if (kind === 'subscription-detail') {
+        assertExactKeys(target, [
+            'kind',
+            'provider',
+            'accountId',
+            'targetKey',
+            'targetKeySha256',
+            'accountSummaryTargetKey',
+            'resourceCollectionTargetKey',
+            'recommendationsTargetKey',
+            'aiCostSummaryTargetKey',
+            'serviceRetirementTargetKey',
+            'commitmentAnalysisTargetKey',
+            'reliabilityTargetKey',
+            'accountGovernanceTargetKey',
+            'billing',
+            'resourceRegions',
+            'metricTimeWindow',
+            'aiCostSummaryAudience',
+            'serviceRetirementRegions',
+            'recommendationScopes',
+            'commitmentAnalysis',
+            'reliability',
+            'accountGovernance',
+        ], 'target');
+        optionalEnum(target.aiCostSummaryAudience, ['portal', 'plugin'], 'target.aiCostSummaryAudience');
+        requiredString(target.accountSummaryTargetKey, 'target.accountSummaryTargetKey');
+        requiredString(target.resourceCollectionTargetKey, 'target.resourceCollectionTargetKey');
+        requiredString(target.recommendationsTargetKey, 'target.recommendationsTargetKey');
+        requiredString(target.serviceRetirementTargetKey, 'target.serviceRetirementTargetKey');
+        validateOptionalTargetKey(target.aiCostSummaryTargetKey, target.aiCostSummaryAudience !== undefined, 'target.aiCostSummaryTargetKey');
+        validateOptionalTargetKey(target.commitmentAnalysisTargetKey, target.commitmentAnalysis !== undefined, 'target.commitmentAnalysisTargetKey');
+        validateOptionalTargetKey(target.reliabilityTargetKey, target.reliability !== undefined, 'target.reliabilityTargetKey');
+        validateOptionalTargetKey(target.accountGovernanceTargetKey, target.accountGovernance !== undefined, 'target.accountGovernanceTargetKey');
+        stringArray(target.serviceRetirementRegions, 'target.serviceRetirementRegions');
+        validateCommitmentAnalysisTarget(target.commitmentAnalysis);
+        validateReliabilityTarget(target.reliability);
+        validateAccountGovernanceTarget(target.accountGovernance);
+    }
+    else {
+        assertExactKeys(target, [
+            'kind',
+            'provider',
+            'accountId',
+            'targetKey',
+            'targetKeySha256',
+            'resourceCollectionTargetKey',
+            'recommendationsTargetKey',
+            'billing',
+            'resourceRegions',
+            'metricTimeWindow',
+            'tagRuleScope',
+            'selector',
+            'stableKey',
+            'stableKeySha256',
+            'relationshipTargetKey',
+            'serviceRetirementTargetKey',
+            'recommendationScopes',
+        ], 'target');
+        validateTagRuleScope(target.tagRuleScope);
+        requiredString(target.resourceCollectionTargetKey, 'target.resourceCollectionTargetKey');
+        requiredString(target.recommendationsTargetKey, 'target.recommendationsTargetKey');
+        validateSelector(target.selector, 'target.selector');
+        const stableKey = requiredString(target.stableKey, 'target.stableKey');
+        if (asRecord(target.selector, 'target.selector').kind === 'stable-key') {
+            assertValue(asRecord(target.selector, 'target.selector').stableKey, stableKey, 'target.selector.stableKey');
+        }
+        sha256(target.stableKeySha256, 'target.stableKeySha256');
+        assertValue(target.stableKeySha256, sha256AwsPluginIdentity(stableKey), 'target.stableKeySha256');
+        requiredString(target.relationshipTargetKey, 'target.relationshipTargetKey');
+        requiredString(target.serviceRetirementTargetKey, 'target.serviceRetirementTargetKey');
+    }
+    return value;
+}
+function validateOptionalTargetKey(value, required, field) {
+    if (required)
+        requiredString(value, field);
+    else if (value !== undefined)
+        throw new Error(`${field} requires its corresponding optional target.`);
+}
+function validateCommitmentAnalysisTarget(value) {
+    if (value === undefined)
+        return;
+    const target = asRecord(value, 'target.commitmentAnalysis');
+    assertExactKeys(target, ['resourceRegions', 'maxBenefitEntries'], 'target.commitmentAnalysis');
+    stringArray(target.resourceRegions, 'target.commitmentAnalysis.resourceRegions');
+    if (!Number.isSafeInteger(target.maxBenefitEntries) || Number(target.maxBenefitEntries) <= 0) {
+        throw new Error('target.commitmentAnalysis.maxBenefitEntries must be a positive safe integer.');
+    }
+}
+function validateReliabilityTarget(value) {
+    if (value === undefined)
+        return;
+    const target = asRecord(value, 'target.reliability');
+    assertExactKeys(target, ['includeTemplateContent', 'includeScoring', 'maxResultsPerSection', 'sectionScopeKeys'], 'target.reliability');
+    if (target.includeTemplateContent !== undefined)
+        assertValue(target.includeTemplateContent, true, 'target.reliability.includeTemplateContent');
+    if (target.includeScoring !== undefined)
+        assertValue(target.includeScoring, true, 'target.reliability.includeScoring');
+    if (!Number.isSafeInteger(target.maxResultsPerSection) || Number(target.maxResultsPerSection) <= 0) {
+        throw new Error('target.reliability.maxResultsPerSection must be a positive safe integer.');
+    }
+    stringArray(target.sectionScopeKeys, 'target.reliability.sectionScopeKeys');
+}
+function validateAccountGovernanceTarget(value) {
+    if (value === undefined)
+        return;
+    const target = asRecord(value, 'target.accountGovernance');
+    assertExactKeys(target, ['apiRegion'], 'target.accountGovernance');
+    requiredString(target.apiRegion, 'target.accountGovernance.apiRegion');
+}
+function validateRecommendationScopes(value, accountId) {
+    if (!Array.isArray(value))
+        throw new Error('target.recommendationScopes must be an array.');
+    const scopes = value;
+    scopes.forEach((value, index) => {
+        const field = `target.recommendationScopes[${index}]`;
+        const scope = asRecord(value, field);
+        assertExactKeys(scope, ['source', 'scope', 'accountId', 'scopeDiscriminator', 'computeOptimizerFamily', 'resourceRegions', 'targetKey', 'actionabilityTargetKey'], field);
+        requiredEnum(scope.source, ['custom', 'compute-optimizer', 'cost-optimization-hub', 'resilience-hub', 'security-hub', 'trusted-advisor', 'well-architected'], `${field}.source`);
+        assertValue(scope.scope, 'account', `${field}.scope`);
+        assertAccount(scope.accountId, accountId, `${field}.accountId`);
+        if (scope.scopeDiscriminator !== undefined)
+            requiredString(scope.scopeDiscriminator, `${field}.scopeDiscriminator`);
+        if (scope.computeOptimizerFamily !== undefined)
+            requiredString(scope.computeOptimizerFamily, `${field}.computeOptimizerFamily`);
+        stringArray(scope.resourceRegions, `${field}.resourceRegions`);
+        requiredString(scope.targetKey, `${field}.targetKey`);
+        requiredString(scope.actionabilityTargetKey, `${field}.actionabilityTargetKey`);
+    });
+}

package/dist/esm/aws/pluginPublicArtifactEvidence.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/aws/pluginPublicArtifactManifestValidation.js

@@ -0,0 +1,255 @@
+import { AWS_PLUGIN_PUBLIC_ARTIFACT_SCHEMA_VERSION, buildAwsPluginResourceLogicalName, buildAwsPluginSubscriptionLogicalName, } from './pluginPublicArtifacts.js';
+import { validateSourceBinding, validateTarget } from './pluginPublicArtifactBodyValidation.js';
+import { validateSourceBindingForTarget } from './pluginPublicArtifactSectionValidation.js';
+import { asRecord, assertAccount, assertExactKeys, assertJsonEqual, assertValue, isoTimestamp, requiredArray, requiredEnum, requiredString, sha256, validateDescriptor, } from './pluginPublicArtifactValidationHelpers.js';
+/** Validates complete active-set identity and targeted carry-forward semantics. */
+export function validateAwsPluginGenerationManifest(value) {
+    const manifest = asRecord(value, 'manifest');
+    assertExactKeys(manifest, [
+        'schemaVersion',
+        'status',
+        'provider',
+        'accountId',
+        'artifactGeneration',
+        'requestBinding',
+        'operation',
+        'previousGeneration',
+        'members',
+        'counts',
+        'completedAt',
+    ], 'manifest');
+    assertValue(manifest.schemaVersion, AWS_PLUGIN_PUBLIC_ARTIFACT_SCHEMA_VERSION, 'manifest.schemaVersion');
+    assertValue(manifest.status, 'completed', 'manifest.status');
+    assertValue(manifest.provider, 'aws', 'manifest.provider');
+    const accountId = requiredString(manifest.accountId, 'manifest.accountId');
+    assertAccount(accountId, accountId, 'manifest.accountId');
+    const generation = validateGeneration(manifest.artifactGeneration);
+    const request = validateRequestBinding(manifest.requestBinding);
+    assertValue(request.requestedAt, generation.generatedAt, 'manifest.requestBinding.requestedAt');
+    const completedAt = isoTimestamp(manifest.completedAt, 'manifest.completedAt');
+    if (completedAt < generation.generatedAt)
+        throw new Error('manifest.completedAt cannot precede the output generation time.');
+    const operation = validateOperation(manifest.operation, accountId);
+    const previous = validatePreviousGeneration(manifest.previousGeneration, accountId);
+    const members = requiredArray(manifest.members, 'manifest.members').map((member, index) => validateMember(member, accountId, generation.generatedAt, `manifest.members[${index}]`));
+    assertUniqueLogicalNames(members);
+    validateCounts(manifest.counts, members);
+    validateTransition(operation, previous, members);
+    return value;
+}
+function validateGeneration(value) {
+    const generation = asRecord(value, 'manifest.artifactGeneration');
+    assertExactKeys(generation, ['runId', 'generatedAt'], 'manifest.artifactGeneration');
+    return {
+        runId: requiredString(generation.runId, 'manifest.artifactGeneration.runId'),
+        generatedAt: isoTimestamp(generation.generatedAt, 'manifest.artifactGeneration.generatedAt'),
+    };
+}
+function validateRequestBinding(value) {
+    const request = asRecord(value, 'manifest.requestBinding');
+    assertExactKeys(request, ['requestId', 'requestedAt'], 'manifest.requestBinding');
+    return {
+        requestId: requiredString(request.requestId, 'manifest.requestBinding.requestId'),
+        requestedAt: isoTimestamp(request.requestedAt, 'manifest.requestBinding.requestedAt'),
+    };
+}
+function validateOperation(value, accountId) {
+    const operation = asRecord(value, 'manifest.operation');
+    if (operation.kind === 'full') {
+        assertExactKeys(operation, ['kind'], 'manifest.operation');
+        return operation;
+    }
+    const kind = requiredEnum(operation.kind, ['targeted-replacement', 'targeted-retirement'], 'manifest.operation.kind');
+    assertExactKeys(operation, ['kind', 'target'], 'manifest.operation');
+    const targetRecord = asRecord(operation.target, 'manifest.operation.target');
+    const target = targetRecord.kind === 'subscription-detail'
+        ? validateTarget(operation.target, 'subscription-detail')
+        : validateTarget(operation.target, 'resource-detail');
+    if (targetRecord.kind !== 'subscription-detail' && targetRecord.kind !== 'resource-detail')
+        throw new Error('manifest.operation.target.kind is not declared.');
+    assertAccount(target.accountId, accountId, 'manifest.operation.target.accountId');
+    return { kind, target };
+}
+function validateMember(value, accountId, outputGeneratedAt, field) {
+    const member = asRecord(value, field);
+    const common = ['state', 'publication', 'provider', 'accountId', 'logicalName', 'artifactType', 'target'];
+    assertValue(member.provider, 'aws', `${field}.provider`);
+    assertAccount(member.accountId, accountId, `${field}.accountId`);
+    const artifactType = requiredEnum(member.artifactType, ['plugin-subscription', 'plugin-resource'], `${field}.artifactType`);
+    const target = artifactType === 'plugin-subscription' ? validateTarget(member.target, 'subscription-detail') : validateTarget(member.target, 'resource-detail');
+    assertAccount(target.accountId, accountId, `${field}.target.accountId`);
+    const logicalName = validateLogicalName(member.logicalName, target, `${field}.logicalName`);
+    if (member.state === 'active') {
+        assertExactKeys(member, [...common, 'artifact', 'sourceGenerations'], field);
+        requiredEnum(member.publication, ['replaced', 'carried-forward'], `${field}.publication`);
+        validateDescriptor(member.artifact, `${field}.artifact`);
+        const descriptor = asRecord(member.artifact, `${field}.artifact`);
+        assertValue(descriptor.name, logicalName, `${field}.artifact.name`);
+        const sourceIdentities = new Set();
+        const sourceBindings = [];
+        requiredArray(member.sourceGenerations, `${field}.sourceGenerations`).forEach((source, index) => {
+            const sourceRecord = asRecord(source, `${field}.sourceGenerations[${index}]`);
+            const binding = validateSourceBinding(source, accountId, requiredString(sourceRecord.section, `${field}.sourceGenerations[${index}].section`), `${field}.sourceGenerations[${index}]`);
+            if (binding.generatedAt > outputGeneratedAt)
+                throw new Error(`${field}.sourceGenerations[${index}].generatedAt cannot exceed output time.`);
+            validateSourceBindingForTarget(binding, target, `${field}.sourceGenerations[${index}]`);
+            const identity = [binding.section, binding.sourceArtifactType, binding.generationId, binding.targetKey, binding.artifactSha256].join('|');
+            if (sourceIdentities.has(identity))
+                throw new Error(`${field}.sourceGenerations contains duplicate source bindings.`);
+            sourceIdentities.add(identity);
+            sourceBindings.push(binding);
+        });
+        validateCompleteSourceSet(sourceBindings, target, field);
+    }
+    else if (member.state === 'retired') {
+        assertExactKeys(member, [...common, 'priorArtifactSha256', 'retiredAt'], field);
+        assertValue(member.publication, 'retired', `${field}.publication`);
+        sha256(member.priorArtifactSha256, `${field}.priorArtifactSha256`);
+        isoTimestamp(member.retiredAt, `${field}.retiredAt`);
+    }
+    else {
+        throw new Error(`${field}.state is not declared.`);
+    }
+    return value;
+}
+function validateCompleteSourceSet(sources, target, field) {
+    const expected = [];
+    const add = (section, sourceType, targetKey) => {
+        if (targetKey)
+            expected.push(`${section}|${sourceType}|${targetKey}`);
+    };
+    if (target.kind === 'subscription-detail') {
+        add('account-summary', 'account-summary', target.accountSummaryTargetKey);
+        add('resources', 'resource-collection', target.resourceCollectionTargetKey);
+        add('service-retirement', 'lifecycle', target.serviceRetirementTargetKey);
+        add('ai-cost-summary', 'ai-cost-summary', target.aiCostSummaryTargetKey);
+        add('commitment-analysis', 'commitment-analysis', target.commitmentAnalysisTargetKey);
+        add('reliability', 'reliability', target.reliabilityTargetKey);
+        add('account-governance', 'account-governance', target.accountGovernanceTargetKey);
+    }
+    else {
+        add('resource', 'resource-collection', target.resourceCollectionTargetKey);
+        add('relationships', 'relationships', target.relationshipTargetKey);
+        add('service-retirement', 'lifecycle', target.serviceRetirementTargetKey);
+    }
+    target.recommendationScopes.forEach(scope => {
+        add('recommendations', 'recommendations', scope.targetKey);
+        add('recommendations', 'recommendation-actionability', scope.actionabilityTargetKey);
+    });
+    const actual = sources.map(source => `${source.section}|${source.sourceArtifactType}|${source.targetKey}`);
+    assertJsonEqual([...actual].sort(), [...expected].sort(), `${field}.sourceGenerations complete source set`);
+}
+function validatePreviousGeneration(value, accountId) {
+    if (value === undefined)
+        return new Map();
+    const previous = asRecord(value, 'manifest.previousGeneration');
+    assertExactKeys(previous, ['provider', 'accountId', 'runId', 'manifestSha256', 'members'], 'manifest.previousGeneration');
+    assertValue(previous.provider, 'aws', 'manifest.previousGeneration.provider');
+    assertAccount(previous.accountId, accountId, 'manifest.previousGeneration.accountId');
+    requiredString(previous.runId, 'manifest.previousGeneration.runId');
+    sha256(previous.manifestSha256, 'manifest.previousGeneration.manifestSha256');
+    const result = new Map();
+    requiredArray(previous.members, 'manifest.previousGeneration.members').forEach((value, index) => {
+        const field = `manifest.previousGeneration.members[${index}]`;
+        const member = asRecord(value, field);
+        assertExactKeys(member, ['provider', 'accountId', 'logicalName', 'artifactType', 'targetKeySha256', 'stableKeySha256', 'artifactSha256'], field);
+        assertValue(member.provider, 'aws', `${field}.provider`);
+        assertAccount(member.accountId, accountId, `${field}.accountId`);
+        const name = requiredString(member.logicalName, `${field}.logicalName`);
+        if (result.has(name))
+            throw new Error('manifest.previousGeneration.members has duplicate logicalName values.');
+        requiredEnum(member.artifactType, ['plugin-subscription', 'plugin-resource'], `${field}.artifactType`);
+        sha256(member.targetKeySha256, `${field}.targetKeySha256`);
+        if (member.stableKeySha256 !== undefined)
+            sha256(member.stableKeySha256, `${field}.stableKeySha256`);
+        sha256(member.artifactSha256, `${field}.artifactSha256`);
+        result.set(name, member);
+    });
+    return result;
+}
+function validateTransition(operation, previous, members) {
+    if (operation.kind === 'full')
+        return;
+    if (previous.size === 0)
+        throw new Error('Targeted publication requires previousGeneration.members.');
+    const target = operation.target;
+    const targetName = logicalNameForTarget(target);
+    const current = new Map(members.map(member => [member.logicalName, member]));
+    for (const [name, prior] of previous) {
+        const member = current.get(name);
+        if (!member)
+            throw new Error(`Targeted publication omitted prior member ${name}.`);
+        if (name === targetName) {
+            assertTargetPublication(operation.kind, member);
+            assertPriorIdentity(member, prior, name);
+            continue;
+        }
+        if (member.state !== 'active' || member.publication !== 'carried-forward')
+            throw new Error(`Untargeted member ${name} must be carried forward.`);
+        assertPriorIdentity(member, prior, name);
+    }
+    const targetMember = current.get(targetName);
+    if (!targetMember)
+        throw new Error('Targeted publication omitted its target member.');
+    if (!previous.has(targetName)) {
+        if (operation.kind === 'targeted-retirement')
+            throw new Error('Cannot retire a target absent from the previous active set.');
+        assertTargetPublication(operation.kind, targetMember);
+    }
+    for (const member of members) {
+        if (!previous.has(member.logicalName) && member.logicalName !== targetName)
+            throw new Error(`Targeted publication contains undeclared member ${member.logicalName}.`);
+    }
+}
+function assertPriorIdentity(member, prior, name) {
+    assertValue(member.artifactType, prior.artifactType, `${name}.artifactType`);
+    assertValue(member.target.targetKeySha256, prior.targetKeySha256, `${name}.target.targetKeySha256`);
+    if (member.target.kind === 'resource-detail') {
+        assertValue(member.target.stableKeySha256, prior.stableKeySha256, `${name}.target.stableKeySha256`);
+    }
+    else if (prior.stableKeySha256 !== undefined) {
+        throw new Error(`${name}.stableKeySha256 is ambiguous for a subscription artifact.`);
+    }
+    if (member.state === 'active') {
+        if (member.publication === 'carried-forward') {
+            assertValue(member.artifact.sha256, prior.artifactSha256, `${name}.artifact.sha256`);
+        }
+    }
+    else {
+        assertValue(member.priorArtifactSha256, prior.artifactSha256, `${name}.priorArtifactSha256`);
+    }
+}
+function assertTargetPublication(kind, member) {
+    const expected = kind === 'targeted-retirement' ? 'retired' : 'replaced';
+    if (member.publication !== expected)
+        throw new Error(`Target member publication must be ${expected}.`);
+}
+function validateCounts(value, members) {
+    const counts = asRecord(value, 'manifest.counts');
+    assertExactKeys(counts, ['active', 'replaced', 'carriedForward', 'retired'], 'manifest.counts');
+    const expected = {
+        active: members.filter(member => member.state === 'active').length,
+        replaced: members.filter(member => member.publication === 'replaced').length,
+        carriedForward: members.filter(member => member.publication === 'carried-forward').length,
+        retired: members.filter(member => member.state === 'retired').length,
+    };
+    for (const [key, count] of Object.entries(expected))
+        assertValue(counts[key], count, `manifest.counts.${key}`);
+}
+function validateLogicalName(value, target, field) {
+    const expected = logicalNameForTarget(target);
+    assertValue(value, expected, field);
+    if (/[\\/]/.test(expected) || expected.includes('..'))
+        throw new Error(`${field} must be path-free.`);
+    return expected;
+}
+function logicalNameForTarget(target) {
+    return target.kind === 'subscription-detail'
+        ? buildAwsPluginSubscriptionLogicalName(target.targetKeySha256)
+        : buildAwsPluginResourceLogicalName(target.stableKeySha256, target.targetKeySha256);
+}
+function assertUniqueLogicalNames(members) {
+    const names = members.map(member => member.logicalName);
+    if (new Set(names).size !== names.length)
+        throw new Error('manifest.members contains duplicate logicalName values.');
+}