@spottoai/types-package 1.0.2-beta.354 → 1.0.2-beta.357

package/dist/esm/common/artifactControlData.js

@@ -0,0 +1,95 @@
+const FORBIDDEN_SENSITIVE_FIELDS = new Set([
+    'accountkey',
+    'accesskey',
+    'accesstoken',
+    'apikey',
+    'authorization',
+    'clientsecret',
+    'connectionstring',
+    'credential',
+    'credentials',
+    'password',
+    'refreshtoken',
+    'sastoken',
+    'secret',
+    'sharedaccesssignature',
+    'token',
+]);
+const PHYSICAL_REFERENCE_FIELDS = new Set([
+    'artifactpath',
+    'blobpath',
+    'bloburi',
+    'bloburl',
+    'containerpath',
+    'containeruri',
+    'containerurl',
+    'filepath',
+    'filesystempath',
+    'inputmanifestpath',
+    'manifestpath',
+    'outputmanifestpath',
+    'path',
+    'physicalpath',
+    'physicaluri',
+    'physicalurl',
+    'sourcepath',
+    'sourceuri',
+    'sourceurl',
+    'storagepath',
+    'storageuri',
+    'storageurl',
+    'uri',
+    'url',
+]);
+const PERCENT_ENCODED_BYTE_PATTERN = /%[0-9A-Fa-f]{2}/;
+const URI_SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const hasControlCharacters = (value) => Array.from(value).some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+const normalizeFieldName = (key) => key.replace(/[-_\s]/g, '').toLowerCase();
+const hasDotTraversal = (value) => value.split(/[\\/]/).some(segment => segment === '.' || segment === '..');
+const isForbiddenReferenceValue = (value, allowUriScheme = false) => hasControlCharacters(value) ||
+    PERCENT_ENCODED_BYTE_PATTERN.test(value) ||
+    (!allowUriScheme && URI_SCHEME_PATTERN.test(value)) ||
+    value.startsWith('/') ||
+    value.startsWith('\\\\') ||
+    /^[A-Za-z]:[\\/]/.test(value) ||
+    hasDotTraversal(value);
+const isSafeAzureResourceId = (key, value) => {
+    if (key !== 'resourceId' || typeof value !== 'string' || hasControlCharacters(value) || value.includes('\\'))
+        return false;
+    const segments = value.split('/');
+    return (segments.length >= 3 &&
+        segments[0] === '' &&
+        segments[1].toLowerCase() === 'subscriptions' &&
+        segments
+            .slice(2)
+            .every(segment => segment.trim() === segment && segment.length > 0 && !/[?#%]/.test(segment) && segment !== '.' && segment !== '..'));
+};
+/** Marks a structurally validated schema field whose logical reference name is allowed. */
+export const allowedArtifactReferenceField = (object, key) => isRecord(object) ? [{ object, key }] : [];
+/** Marks a structurally validated identity field whose value is allowed by its owning schema. */
+export const allowedArtifactIdentityField = (object, key) => isRecord(object) ? [{ object, key, allowUriScheme: true }] : [];
+/** Rejects exact normalized sensitive fields and physical-reference control data recursively. */
+export const containsForbiddenArtifactControlData = (value, allowedReferenceFields = []) => {
+    if (typeof value === 'string')
+        return isForbiddenReferenceValue(value);
+    if (Array.isArray(value))
+        return value.some(child => containsForbiddenArtifactControlData(child, allowedReferenceFields));
+    if (!isRecord(value))
+        return false;
+    return Object.entries(value).some(([key, child]) => {
+        if (hasControlCharacters(key))
+            return true;
+        const normalizedKey = normalizeFieldName(key);
+        if (FORBIDDEN_SENSITIVE_FIELDS.has(normalizedKey))
+            return true;
+        const allowedField = allowedReferenceFields.find(field => field.object === value && field.key === key);
+        if (allowedField?.allowUriScheme && typeof child === 'string')
+            return isForbiddenReferenceValue(child, true);
+        if (PHYSICAL_REFERENCE_FIELDS.has(normalizedKey) && !allowedField)
+            return true;
+        if (isSafeAzureResourceId(key, child))
+            return false;
+        return containsForbiddenArtifactControlData(child, allowedReferenceFields);
+    });
+};

package/dist/esm/common/artifactEvidence.js

@@ -0,0 +1,173 @@
+import { hasValidOptionalArtifactRevisionComponents, isStrictLogicalArtifactReference } from './artifactEvidenceValidation.js';
+const SUPPORT_VERDICTS = new Set(['supported', 'unsupported', 'unknown']);
+const APPLICABILITY_VERDICTS = new Set(['applicable', 'not-applicable', 'unknown']);
+const ATTEMPT_OUTCOMES = new Set([
+    'not-attempted',
+    'queued',
+    'running',
+    'succeeded',
+    'failed',
+    'cancelled',
+    'timed-out',
+    'dead-lettered',
+    'superseded',
+]);
+const COVERAGE_VERDICTS = new Set(['complete', 'partial', 'none', 'unknown']);
+const EMPTY_EVIDENCE_VERDICTS = new Set(['populated', 'complete-empty', 'not-observed', 'unknown']);
+const FRESHNESS_VERDICTS = new Set(['current', 'stale', 'expired', 'unknown']);
+const EVIDENCE_VERDICTS = new Set(['complete', 'partial', 'insufficient', 'conflicting']);
+const PROCESSING_LIFECYCLES = new Set(['queued', 'running', 'succeeded', 'failed', 'cancelled', 'timed-out', 'dead-lettered', 'superseded']);
+const PUBLICATION_VERDICTS = new Set(['completed', 'partial', 'suppressed', 'superseded', 'quarantined']);
+const PROVIDERS = new Set(['azure', 'aws']);
+const DATE_BASES = new Set(['utc', 'billing-calendar', 'company-local']);
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isNonEmptyString = (value) => typeof value === 'string' && value.trim().length > 0;
+const isNonNegativeInteger = (value) => Number.isInteger(value) && value >= 0;
+const isPositiveInteger = (value) => Number.isInteger(value) && value > 0;
+const isStringIn = (value, values) => typeof value === 'string' && values.has(value);
+const isCanonicalIsoTimestamp = (value) => {
+    if (!isNonEmptyString(value))
+        return false;
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
+};
+const isArtifactDecisionIssue = (value) => isRecord(value) &&
+    isNonEmptyString(value.code) &&
+    typeof value.blocking === 'boolean' &&
+    (value.dependency === undefined || isNonEmptyString(value.dependency));
+const isObservedRange = (value) => {
+    if (!isRecord(value) ||
+        !isCanonicalIsoTimestamp(value.fromInclusive) ||
+        !isCanonicalIsoTimestamp(value.throughExclusive) ||
+        Date.parse(value.throughExclusive) <= Date.parse(value.fromInclusive) ||
+        !isStringIn(value.dateBasis, DATE_BASES)) {
+        return false;
+    }
+    return value.timeZone === undefined || isNonEmptyString(value.timeZone);
+};
+const isArtifactDependencyDescriptor = (value) => {
+    if (!isRecord(value) ||
+        !isNonEmptyString(value.name) ||
+        typeof value.required !== 'boolean' ||
+        !isStringIn(value.support, SUPPORT_VERDICTS) ||
+        !isStringIn(value.applicability, APPLICABILITY_VERDICTS) ||
+        !isStringIn(value.attempt, ATTEMPT_OUTCOMES) ||
+        !isStringIn(value.coverage, COVERAGE_VERDICTS) ||
+        !isStringIn(value.emptyEvidence, EMPTY_EVIDENCE_VERDICTS) ||
+        !isStringIn(value.freshness, FRESHNESS_VERDICTS) ||
+        !isStringIn(value.evidence, EVIDENCE_VERDICTS) ||
+        !isStringIn(value.publication, PUBLICATION_VERDICTS)) {
+        return false;
+    }
+    if (value.generationId !== undefined && !isNonEmptyString(value.generationId))
+        return false;
+    if (value.digest !== undefined && (typeof value.digest !== 'string' || !SHA256_PATTERN.test(value.digest)))
+        return false;
+    if (!hasValidOptionalArtifactRevisionComponents(value))
+        return false;
+    if (value.observedRange !== undefined && !isObservedRange(value.observedRange))
+        return false;
+    if (value.completeThrough !== undefined && !isCanonicalIsoTimestamp(value.completeThrough))
+        return false;
+    if (value.reasonCode !== undefined && !isNonEmptyString(value.reasonCode))
+        return false;
+    if (value.acceptedRowCount !== undefined && !isNonNegativeInteger(value.acceptedRowCount))
+        return false;
+    if (value.emptyEvidence === 'complete-empty') {
+        if (value.attempt !== 'succeeded' ||
+            value.coverage !== 'complete' ||
+            value.acceptedRowCount !== 0 ||
+            !isStrictLogicalArtifactReference(value.emptyProofRef)) {
+            return false;
+        }
+    }
+    else if (value.emptyProofRef !== undefined) {
+        return false;
+    }
+    if (value.publication === 'completed') {
+        return (value.support === 'supported' &&
+            value.applicability === 'applicable' &&
+            value.attempt === 'succeeded' &&
+            value.coverage === 'complete' &&
+            (value.emptyEvidence === 'populated' || value.emptyEvidence === 'complete-empty') &&
+            value.evidence === 'complete');
+    }
+    return true;
+};
+const isArtifactClaimDependencyDecision = (value) => {
+    if (!isRecord(value) ||
+        !isNonEmptyString(value.claimId) ||
+        !Array.isArray(value.sectionPaths) ||
+        !value.sectionPaths.every(isNonEmptyString) ||
+        !Array.isArray(value.requiredDependencies) ||
+        !value.requiredDependencies.every(isNonEmptyString) ||
+        !isStringIn(value.evidence, EVIDENCE_VERDICTS) ||
+        !isStringIn(value.publication, PUBLICATION_VERDICTS) ||
+        !Array.isArray(value.issues) ||
+        !value.issues.every(isArtifactDecisionIssue)) {
+        return false;
+    }
+    return value.publication !== 'completed' || (value.evidence === 'complete' && !value.issues.some(issue => issue.blocking));
+};
+const hasUniqueValues = (values) => new Set(values).size === values.length;
+/** Dependency-free runtime rejection boundary for provider-neutral publication decisions. */
+export const isArtifactPublicationDecision = (value) => {
+    if (!isRecord(value) ||
+        !isStringIn(value.processing, PROCESSING_LIFECYCLES) ||
+        !isStringIn(value.evidence, EVIDENCE_VERDICTS) ||
+        !isStringIn(value.publication, PUBLICATION_VERDICTS) ||
+        !Array.isArray(value.dependencies) ||
+        !value.dependencies.every(isArtifactDependencyDescriptor) ||
+        !Array.isArray(value.claims) ||
+        !value.claims.every(isArtifactClaimDependencyDecision) ||
+        !Array.isArray(value.issues) ||
+        !value.issues.every(isArtifactDecisionIssue)) {
+        return false;
+    }
+    const dependencyNames = value.dependencies.map(dependency => dependency.name);
+    const claimIds = value.claims.map(claim => claim.claimId);
+    if (!hasUniqueValues(dependencyNames) || !hasUniqueValues(claimIds))
+        return false;
+    if (!value.claims.every(claim => hasUniqueValues(claim.requiredDependencies)))
+        return false;
+    if (value.publication !== 'completed')
+        return true;
+    const completedDependencies = new Set(value.dependencies.filter(dependency => dependency.publication === 'completed').map(dependency => dependency.name));
+    return (value.processing === 'succeeded' &&
+        (value.evidence === 'complete' || value.evidence === 'partial') &&
+        value.dependencies.every(dependency => !dependency.required || dependency.publication === 'completed') &&
+        value.claims.every(claim => claim.publication === 'completed' && claim.requiredDependencies.every(dependency => completedDependencies.has(dependency))) &&
+        !value.issues.some(issue => issue.blocking));
+};
+/** Checks the provider-neutral ownership shape used by observe- and enforce-mode artifacts. */
+export const isArtifactOwnershipBinding = (value) => isRecord(value) &&
+    isStringIn(value.provider, PROVIDERS) &&
+    isNonEmptyString(value.tenantId) &&
+    isNonEmptyString(value.companyId) &&
+    isNonEmptyString(value.cloudAccountId) &&
+    isNonEmptyString(value.accountId) &&
+    (value.ownershipEpochRevision === undefined || isPositiveInteger(value.ownershipEpochRevision));
+/** Checks that an ownership binding is valid for enforce-mode publication. */
+export const isEnforceableArtifactOwnershipBinding = (value) => isArtifactOwnershipBinding(value) && value.ownershipEpochRevision !== undefined;
+/**
+ * Compares ownership first, then source and policy revisions component-wise.
+ * Callers must validate both vectors before comparison; this function deliberately compares the supplied values without adding a second validation policy.
+ */
+export const compareArtifactRevisionVector = (left, right) => {
+    if (left.ownershipEpochRevision === undefined || right.ownershipEpochRevision === undefined)
+        return 'unenforceable';
+    if (left.ownershipEpochRevision > right.ownershipEpochRevision)
+        return 'newer-ownership';
+    if (left.ownershipEpochRevision < right.ownershipEpochRevision)
+        return 'older-ownership';
+    const sourceComparison = Math.sign(left.sourceRevision - right.sourceRevision);
+    const policyComparison = Math.sign(left.policyRevision - right.policyRevision);
+    if (sourceComparison === 0 && policyComparison === 0)
+        return 'equal';
+    if (sourceComparison >= 0 && policyComparison >= 0)
+        return 'newer';
+    if (sourceComparison <= 0 && policyComparison <= 0)
+        return 'older';
+    return 'incomparable';
+};

package/dist/esm/common/artifactEvidenceValidation.js

@@ -0,0 +1,24 @@
+const hasControlCharacters = (value) => Array.from(value).some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+/** Validates a generation-relative logical artifact reference without accepting physical-path encodings. */
+export const isStrictLogicalArtifactReference = (value) => {
+    if (typeof value !== 'string' || value.trim() !== value || value.length === 0 || hasControlCharacters(value))
+        return false;
+    if (value.startsWith('/') || value.includes('\\') || value.includes('%') || value.includes('?') || value.includes('#'))
+        return false;
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(value) || /^[A-Za-z]:[\\/]/.test(value))
+        return false;
+    const segments = value.split('/');
+    return segments.length >= 2 && segments.every(segment => segment.length > 0 && segment !== '.' && segment !== '..');
+};
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isPositiveSafeInteger = (value) => Number.isSafeInteger(value) && Number(value) > 0;
+/** Validates the positive source/policy revision vector shared by evidence producers and consumers. */
+export const isArtifactRevisionVector = (value) => isRecord(value) &&
+    isPositiveSafeInteger(value.sourceRevision) &&
+    isPositiveSafeInteger(value.policyRevision) &&
+    (value.ownershipEpochRevision === undefined || isPositiveSafeInteger(value.ownershipEpochRevision));
+/** Validates optional dependency revision components using the shared revision-vector rules. */
+export const hasValidOptionalArtifactRevisionComponents = (value) => isArtifactRevisionVector({
+    sourceRevision: value.sourceRevision === undefined ? 1 : value.sourceRevision,
+    policyRevision: value.policyRevision === undefined ? 1 : value.policyRevision,
+});

package/dist/esm/common/artifactGeneration.js

@@ -0,0 +1 @@
+export const ARTIFACT_GENERATION_SCHEMA_VERSION = 1;

package/dist/esm/common/capabilityPassport.js

@@ -0,0 +1,206 @@
+import { isArtifactOwnershipBinding, } from './artifactEvidence.js';
+export const CAPABILITY_PASSPORT_SCHEMA_VERSION = 1;
+export const CAPABILITY_REASON_CODES = [
+    'not-requested',
+    'permission-denied',
+    'not-found',
+    'throttled',
+    'timeout',
+    'pagination-incomplete',
+    'source-partial',
+    'source-empty',
+    'source-unsupported',
+    'retained-last-known-good',
+    'currency-unresolved',
+    'unknown',
+];
+const REASON_CODES = new Set(CAPABILITY_REASON_CODES);
+const AGREEMENT_TYPES = new Set(['EA', 'MCA', 'CSP', 'PAYG-MOSP', 'sponsored-trial', 'unknown']);
+const AGREEMENT_SOURCES = new Set(['observed', 'configured', 'unknown']);
+const AVAILABILITY_VALUES = new Set(['available', 'partial', 'missing', 'unavailable', 'unknown']);
+const EMPTY_EVIDENCE_VALUES = new Set(['populated', 'complete-empty', 'not-observed', 'unknown']);
+const PROVIDER_OUTCOMES = new Set(['accepted', 'authoritatively-unsupported', 'unknown']);
+const ATTEMPT_OUTCOMES = new Set(['succeeded', 'failed', 'partial']);
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isNonEmptyString = (value) => typeof value === 'string' && value.trim().length > 0;
+const isNonNegativeInteger = (value) => Number.isInteger(value) && value >= 0;
+const isPositiveInteger = (value) => Number.isInteger(value) && value > 0;
+const isCanonicalIsoTimestamp = (value) => {
+    if (!isNonEmptyString(value))
+        return false;
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
+};
+const isLogicalArtifactRef = (value) => {
+    if (!isNonEmptyString(value) || value.startsWith('/') || value.includes('://') || value.includes('?') || value.includes('#'))
+        return false;
+    if (value.includes('\\'))
+        return false;
+    const segments = value.split('/');
+    return segments.length >= 2 && segments.every(segment => segment.length > 0 && segment !== '.' && segment !== '..');
+};
+const isSubscriptionBoundResourceId = (value, subscriptionId) => {
+    if (!isNonEmptyString(value))
+        return false;
+    const segments = value.split('/');
+    return (segments.length >= 4 &&
+        segments[0] === '' &&
+        segments[1]?.toLowerCase() === 'subscriptions' &&
+        segments[2]?.toLowerCase() === subscriptionId.toLowerCase());
+};
+const isReasonCode = (value) => typeof value === 'string' && REASON_CODES.has(value);
+const isImmutableSourceGeneration = (value) => {
+    if (!isRecord(value))
+        return false;
+    if (!isLogicalArtifactRef(value.artifactRef) ||
+        !isNonEmptyString(value.generationId) ||
+        typeof value.sha256 !== 'string' ||
+        !SHA256_PATTERN.test(value.sha256) ||
+        !isPositiveInteger(value.schemaVersion) ||
+        !isCanonicalIsoTimestamp(value.producedAt)) {
+        return false;
+    }
+    return value.completeThrough === undefined || isCanonicalIsoTimestamp(value.completeThrough);
+};
+const isScopeBinding = (value, ownership) => {
+    if (!isRecord(value) || value.provider !== ownership.provider || value.tenantId !== ownership.tenantId)
+        return false;
+    if (value.kind === 'tenant')
+        return true;
+    if (value.kind === 'billing-account')
+        return isNonEmptyString(value.billingAccountId);
+    if (value.kind === 'customer')
+        return isNonEmptyString(value.customerId);
+    if (value.kind === 'subscription')
+        return value.subscriptionId === ownership.subscriptionId;
+    return (value.kind === 'resource' &&
+        value.subscriptionId === ownership.subscriptionId &&
+        isSubscriptionBoundResourceId(value.normalizedResourceId, ownership.subscriptionId));
+};
+const isAttempt = (value) => {
+    if (!isRecord(value))
+        return false;
+    if (value.status === 'not-attempted')
+        return isReasonCode(value.reasonCode);
+    if (value.status !== 'attempted' || !isCanonicalIsoTimestamp(value.startedAt) || !isCanonicalIsoTimestamp(value.completedAt))
+        return false;
+    if (Date.parse(value.completedAt) < Date.parse(value.startedAt) || typeof value.outcome !== 'string' || !ATTEMPT_OUTCOMES.has(value.outcome)) {
+        return false;
+    }
+    return Array.isArray(value.reasonCodes) && value.reasonCodes.every(isReasonCode);
+};
+const isFreshness = (value) => {
+    if (!isRecord(value))
+        return false;
+    if (value.status === 'unknown')
+        return true;
+    if ((value.status !== 'current' && value.status !== 'stale') || !isCanonicalIsoTimestamp(value.observedAt))
+        return false;
+    if (value.completeThrough !== undefined && !isCanonicalIsoTimestamp(value.completeThrough))
+        return false;
+    return value.status !== 'stale' || isNonEmptyString(value.maximumAge);
+};
+const isObservation = (value, ownership) => {
+    if (!isRecord(value))
+        return false;
+    if (!isNonEmptyString(value.observationId) || !isNonEmptyString(value.capability) || !isScopeBinding(value.scope, ownership))
+        return false;
+    if (!isAttempt(value.attempt) || typeof value.providerSurfaceOutcome !== 'string' || !PROVIDER_OUTCOMES.has(value.providerSurfaceOutcome)) {
+        return false;
+    }
+    if (typeof value.availability !== 'string' || !AVAILABILITY_VALUES.has(value.availability))
+        return false;
+    if (typeof value.emptyEvidence !== 'string' || !EMPTY_EVIDENCE_VALUES.has(value.emptyEvidence) || !isFreshness(value.freshness))
+        return false;
+    if (value.sourceGeneration !== undefined && !isImmutableSourceGeneration(value.sourceGeneration))
+        return false;
+    if (value.coverageRef !== undefined && !isLogicalArtifactRef(value.coverageRef))
+        return false;
+    if (value.emptyEvidence === 'complete-empty') {
+        if (value.availability !== 'available' || value.attempt.status !== 'attempted' || value.attempt.outcome !== 'succeeded')
+            return false;
+    }
+    if (value.limits !== undefined) {
+        if (!isRecord(value.limits))
+            return false;
+        if (value.limits.expectedPages !== undefined && !isNonNegativeInteger(value.limits.expectedPages))
+            return false;
+        if (value.limits.receivedPages !== undefined && !isNonNegativeInteger(value.limits.receivedPages))
+            return false;
+        if (value.limits.throttled !== undefined && typeof value.limits.throttled !== 'boolean')
+            return false;
+        if (value.limits.retainedLastKnownGood !== undefined && typeof value.limits.retainedLastKnownGood !== 'boolean')
+            return false;
+    }
+    return true;
+};
+const isOwnership = (value) => isArtifactOwnershipBinding(value) && 'subscriptionId' in value && isNonEmptyString(value.subscriptionId);
+const isObservationSet = (value, ownership) => {
+    if (!isRecord(value) || !isNonNegativeInteger(value.totalCount))
+        return false;
+    if (value.mode === 'inline') {
+        if (!Array.isArray(value.items) || value.items.length !== value.totalCount || !value.items.every(item => isObservation(item, ownership))) {
+            return false;
+        }
+        const observationIds = value.items.map(item => item.observationId);
+        return new Set(observationIds).size === observationIds.length;
+    }
+    if (value.mode !== 'sharded' ||
+        !isNonNegativeInteger(value.shardCount) ||
+        !isLogicalArtifactRef(value.indexRef) ||
+        !Array.isArray(value.shards) ||
+        value.shards.length !== value.shardCount) {
+        return false;
+    }
+    let total = 0;
+    const refs = new Set();
+    for (const shard of value.shards) {
+        if (!isRecord(shard) ||
+            !isLogicalArtifactRef(shard.artifactRef) ||
+            typeof shard.sha256 !== 'string' ||
+            !SHA256_PATTERN.test(shard.sha256) ||
+            !isPositiveInteger(shard.itemCount) ||
+            refs.has(shard.artifactRef)) {
+            return false;
+        }
+        refs.add(shard.artifactRef);
+        total += shard.itemCount;
+    }
+    return total === value.totalCount;
+};
+/** Dependency-free runtime rejection boundary for Capability Passport schema v1. */
+export const isCapabilityPassport = (value) => {
+    if (!isRecord(value) || value.schemaVersion !== CAPABILITY_PASSPORT_SCHEMA_VERSION)
+        return false;
+    if (!isNonEmptyString(value.passportId) || !isNonEmptyString(value.runId) || !isCanonicalIsoTimestamp(value.generatedAt))
+        return false;
+    if (!isOwnership(value.ownership))
+        return false;
+    if (!isRecord(value.agreementObservation))
+        return false;
+    if (typeof value.agreementObservation.type !== 'string' ||
+        !AGREEMENT_TYPES.has(value.agreementObservation.type) ||
+        typeof value.agreementObservation.source !== 'string' ||
+        !AGREEMENT_SOURCES.has(value.agreementObservation.source) ||
+        (value.agreementObservation.sourceGeneration !== undefined && !isImmutableSourceGeneration(value.agreementObservation.sourceGeneration))) {
+        return false;
+    }
+    if (!isObservationSet(value.observations, value.ownership))
+        return false;
+    if (!isRecord(value.producerVersions) || Object.keys(value.producerVersions).length === 0)
+        return false;
+    if (!Object.entries(value.producerVersions).every(([name, version]) => isNonEmptyString(name) && isNonEmptyString(version)))
+        return false;
+    if (!Array.isArray(value.issues) ||
+        !value.issues.every(issue => isRecord(issue) && isReasonCode(issue.reasonCode) && (issue.observationId === undefined || isNonEmptyString(issue.observationId)))) {
+        return false;
+    }
+    if (value.observations.mode === 'inline') {
+        const observationIds = new Set(value.observations.items.map(item => item.observationId));
+        if (!value.issues.every(issue => issue.observationId === undefined || (isNonEmptyString(issue.observationId) && observationIds.has(issue.observationId)))) {
+            return false;
+        }
+    }
+    return true;
+};

package/dist/esm/common/index.js

@@ -0,0 +1,7 @@
+export * from './artifactGeneration.js';
+export * from './capabilityPassport.js';
+export * from './pagination.js';
+export * from './provider.js';
+export * from './providerSyncProgress.js';
+export * from './relationships.js';
+export * from './syncProgress.js';

package/dist/esm/common/pagination.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/common/provider.js

@@ -0,0 +1,11 @@
+export var ProviderName;
+(function (ProviderName) {
+    ProviderName["Azure"] = "azure";
+    ProviderName["Aws"] = "aws";
+})(ProviderName || (ProviderName = {}));
+/** Provider-owned resource boundary kind used by indexed scope records. */
+export var ProviderScopeType;
+(function (ProviderScopeType) {
+    ProviderScopeType["Subscription"] = "subscription";
+    ProviderScopeType["Account"] = "account";
+})(ProviderScopeType || (ProviderScopeType = {}));

package/dist/esm/common/providerSyncProgress.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/common/relationships.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/common/syncProgress.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/company/billingAccount.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/company/company.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/company/companyHierarchy.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/company/companyNotes.js

@@ -0,0 +1,38 @@
+export const COMPANY_NOTE_SCHEMA_VERSION = 1;
+export const COMPANY_NOTES_FEATURE_KEY = 'company_notes';
+export const COMPANY_NOTES_VIEW_PERMISSION_KEY = 'company_notes.view';
+export const COMPANY_NOTES_MANAGE_PERMISSION_KEY = 'company_notes.manage';
+export const COMPANY_NOTES_PERMISSION_KEYS = [COMPANY_NOTES_VIEW_PERMISSION_KEY, COMPANY_NOTES_MANAGE_PERMISSION_KEY];
+export const COMPANY_NOTE_ORDINARY_CATEGORIES = ['general', 'meeting'];
+export const COMPANY_NOTE_CONTEXT_CATEGORIES = [
+    'company-profile',
+    'security',
+    'architecture',
+    'operations',
+    'finops',
+    'performance',
+    'reliability',
+    'roadmap',
+];
+export const COMPANY_NOTE_CONTEXT_CATEGORY_ORDER = COMPANY_NOTE_CONTEXT_CATEGORIES;
+export const COMPANY_NOTE_CATEGORIES = [...COMPANY_NOTE_ORDINARY_CATEGORIES, ...COMPANY_NOTE_CONTEXT_CATEGORIES];
+export const COMPANY_NOTE_MEETING_TEMPLATE_KEY = 'meeting-v1';
+export const COMPANY_NOTE_CONTEXT_TEMPLATE_KEYS = [
+    'company-profile-v1',
+    'security-v1',
+    'architecture-v1',
+    'operations-v1',
+    'finops-v1',
+    'performance-v1',
+    'reliability-v1',
+    'roadmap-v1',
+];
+export const COMPANY_NOTE_TEMPLATE_KEYS = [COMPANY_NOTE_MEETING_TEMPLATE_KEY, ...COMPANY_NOTE_CONTEXT_TEMPLATE_KEYS];
+export const COMPANY_NOTES_AI_MODES = [
+    'general-note',
+    'template-draft',
+    'section-draft',
+    'coach-selection',
+    'company-research',
+];
+export const COMPANY_NOTES_AI_SOURCE_MODES = ['spotto-only', 'public-research'];

package/dist/esm/company/customProperties.js

@@ -0,0 +1 @@
+export * from '../customProperties/index.js';

package/dist/esm/company/index.js

@@ -0,0 +1,6 @@
+export * from './company.js';
+export * from './companyHierarchy.js';
+export * from './notification.js';
+export * from './survey.js';
+export * from './billingAccount.js';
+export * from './companyNotes.js';

package/dist/esm/company/notification.js

@@ -0,0 +1,43 @@
+/** Bitmask constants for resources */
+export const RECOMMENDATION_FLAGS = {
+    /** 001 */
+    PRIORITIZED: 1,
+    /** 010 */
+    DISMISSED: 2,
+    /** 100 */
+    NEW: 4,
+    /** 1000 */
+    IMPLEMENTED: 8,
+};
+/** Bitmask constants for users */
+export const USER_FLAGS = {
+    /** 001 */
+    INVITE_ACCEPTED: 1,
+};
+/** Bitmask constants for cloud accounts */
+export const CLOUD_ACCOUNT_FLAGS = {
+    /** 001 */
+    SYNC_COMPLETED: 1,
+};
+export const COST_ANOMALY_FLAGS = {
+    /** 001 */
+    DETECTED: 1,
+};
+export const SHARING_FLAGS = {
+    SHARE_CREATED: 1,
+};
+/** Helper functions for bitmask operations */
+export const hasFlag = (value, flag) => (value & flag) !== 0;
+export const addFlag = (value, flag) => value | flag;
+export const removeFlag = (value, flag) => value & ~flag;
+/** Array helper functions */
+export const hasArrayFlag = (array, flag) => array.includes(flag);
+export const addArrayFlag = (array, flag) => (array.includes(flag) ? array : [...array, flag]);
+export const removeArrayFlag = (array, flag) => array.filter(f => f !== flag);
+/** Get individual flags from resources array */
+export const getRecommendationsFlags = (array) => ({
+    new: hasArrayFlag(array, RECOMMENDATION_FLAGS.NEW),
+    dismissed: hasArrayFlag(array, RECOMMENDATION_FLAGS.DISMISSED),
+    prioritized: hasArrayFlag(array, RECOMMENDATION_FLAGS.PRIORITIZED),
+    implemented: hasArrayFlag(array, RECOMMENDATION_FLAGS.IMPLEMENTED),
+});

package/dist/esm/company/survey.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/customProperties/customProperties.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/customProperties/index.js

@@ -0,0 +1 @@
+export * from './customProperties.js';

package/dist/esm/entries/aws.js

@@ -0,0 +1,3 @@
+export * from '../aws/index.js';
+import * as namespace from '../aws/index.js';
+export default namespace;