@spottoai/types-package 1.0.2-beta.356 → 1.0.2-beta.358

package/dist/esm/azure/billingPlots.js

@@ -1,4 +1,187 @@
 /**
  * Billing cost analysis types for Azure cost visualization.
  */
-export {};
+import { isArtifactOwnershipBinding, } from '../common/artifactEvidence.js';
+import { containsForbiddenArtifactControlData } from '../common/artifactControlData.js';
+import { isArtifactRevisionVector } from '../common/artifactEvidenceValidation.js';
+import { isBillingCompletedArtifactPublicationDecision, isBillingPartialArtifactPublicationDecision, } from './billingArtifactEvidence.js';
+const BILLING_DOCUMENT_STATES = new Set(['current', 'stale', 'partial', 'fallback', 'complete-empty']);
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isNonEmptyString = (value) => typeof value === 'string' && value.trim() === value && value.length > 0;
+const isFiniteNumber = (value) => typeof value === 'number' && Number.isFinite(value);
+const isOptionalFiniteNumber = (value) => value === undefined || isFiniteNumber(value);
+const isNullableFiniteNumber = (value) => value === null || isFiniteNumber(value);
+const isNonNegativeInteger = (value) => Number.isSafeInteger(value) && Number(value) >= 0;
+const isPositiveInteger = (value) => Number.isSafeInteger(value) && Number(value) > 0;
+const isStringArray = (value) => Array.isArray(value) && value.every(isNonEmptyString);
+const hasControlCharacters = (value) => Array.from(value).some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+const isPathSegment = (value) => isNonEmptyString(value) && !/[\\/?#%]/.test(value) && !hasControlCharacters(value) && value !== '.' && value !== '..';
+const publicationDecisionReferencesDigest = (value, digest) => isRecord(value) && Array.isArray(value.dependencies) && value.dependencies.some(dependency => isRecord(dependency) && dependency.digest === digest);
+const isTrend = (value) => isRecord(value) && isNonEmptyString(value.method) && isFiniteNumber(value.slope) && isFiniteNumber(value.intercept);
+const isDailyPoint = (value) => isRecord(value) &&
+    isNonEmptyString(value.date) &&
+    isFiniteNumber(value.timestamp) &&
+    isFiniteNumber(value.cost) &&
+    typeof value.isAnomaly === 'boolean' &&
+    isNonNegativeInteger(value.anomalyVotes) &&
+    isOptionalFiniteNumber(value.trendCost) &&
+    (value.anomalyMethods === undefined || isStringArray(value.anomalyMethods));
+const isForecastPoint = (value) => isRecord(value) &&
+    isNonEmptyString(value.date) &&
+    isFiniteNumber(value.timestamp) &&
+    isFiniteNumber(value.cost) &&
+    isOptionalFiniteNumber(value.trendCost);
+const isMonthlyPoint = (value) => isRecord(value) &&
+    /^\d{4}-\d{2}$/.test(String(value.month)) &&
+    isFiniteNumber(value.startDate) &&
+    isFiniteNumber(value.endDate) &&
+    isFiniteNumber(value.cost) &&
+    isFiniteNumber(value.averageDailyCost) &&
+    isNonNegativeInteger(value.anomalyCount) &&
+    isOptionalFiniteNumber(value.trendCost) &&
+    (value.anomalyDates === undefined || (Array.isArray(value.anomalyDates) && value.anomalyDates.every(isFiniteNumber)));
+const hasCommonChartViewFields = (value) => isFiniteNumber(value.startDate) &&
+    isFiniteNumber(value.endDate) &&
+    isFiniteNumber(value.averageDailyCost) &&
+    isFiniteNumber(value.totalCost) &&
+    (value.trend === undefined || isTrend(value.trend));
+const isChartView = (value) => {
+    if (!isRecord(value) || (value.trend !== undefined && !isTrend(value.trend)))
+        return false;
+    if (value.forecastMethod !== undefined) {
+        return (value.aggregation === 'daily' &&
+            isNonEmptyString(value.forecastMethod) &&
+            [value.startDate, value.endDate, value.actualTotalCost, value.forecastRemaining, value.forecastMonthTotal].every(isFiniteNumber) &&
+            Array.isArray(value.actualPoints) &&
+            value.actualPoints.every(isDailyPoint) &&
+            Array.isArray(value.forecastPoints) &&
+            value.forecastPoints.every(isForecastPoint) &&
+            Array.isArray(value.fittedPoints) &&
+            value.fittedPoints.every(isForecastPoint));
+    }
+    if (!hasCommonChartViewFields(value) || !Array.isArray(value.points))
+        return false;
+    if (value.aggregation === 'daily')
+        return value.points.every(isDailyPoint);
+    if (value.aggregation === 'monthly')
+        return value.points.every(isMonthlyPoint);
+    return false;
+};
+const isChartData = (value) => {
+    if (!isRecord(value) || !isPositiveInteger(value.schemaVersion) || !isNonEmptyString(value.source))
+        return false;
+    if (!isRecord(value.dataWindow) ||
+        !isFiniteNumber(value.dataWindow.startDate) ||
+        !isFiniteNumber(value.dataWindow.endDate) ||
+        !isNonNegativeInteger(value.dataWindow.pointCount)) {
+        return false;
+    }
+    if (!isRecord(value.views) || !Object.values(value.views).every(view => view === undefined || isChartView(view)))
+        return false;
+    if (!isRecord(value.detectors) || !isFiniteNumber(value.detectors.threshold) || !Array.isArray(value.detectors.methods))
+        return false;
+    return value.detectors.methods.every(method => isRecord(method) &&
+        isNonEmptyString(method.name) &&
+        (method.status === undefined || isNonEmptyString(method.status)) &&
+        (method.error === undefined || method.error === null || typeof method.error === 'string') &&
+        Array.isArray(method.triggeredDates) &&
+        method.triggeredDates.every(isFiniteNumber));
+};
+const isDriverResource = (value) => isRecord(value) &&
+    isNonEmptyString(value.name) &&
+    (value.resourceScope === undefined || isNonEmptyString(value.resourceScope)) &&
+    (value.resourceId === undefined || isNonEmptyString(value.resourceId)) &&
+    (value.isSubscriptionLevel === undefined || typeof value.isSubscriptionLevel === 'boolean') &&
+    isFiniteNumber(value.cost) &&
+    isNullableFiniteNumber(value.baseline) &&
+    isFiniteNumber(value.delta) &&
+    isNullableFiniteNumber(value.percentChange) &&
+    typeof value.isNew === 'boolean' &&
+    isNonEmptyString(value.summary);
+const isAnomaly = (value) => {
+    if (!isRecord(value) || !isFiniteNumber(value.date) || !isNonEmptyString(value.summary) || !isNonEmptyString(value.confidence))
+        return false;
+    if (!isStringArray(value.notes) || !isRecord(value.impact) || !Array.isArray(value.drivers))
+        return false;
+    const impact = value.impact;
+    const impactRequired = ['cost', 'delta', 'monthToDateCost'];
+    const impactNullable = [
+        'baseline7Day',
+        'baseline30Day',
+        'percentChange',
+        'previousDayCost',
+        'previousDayDelta',
+        'monthToDateBaseline',
+        'monthToDateDelta',
+        'monthToDatePercentChange',
+    ];
+    if (!impactRequired.every(field => isFiniteNumber(impact[field])) || !impactNullable.every(field => isNullableFiniteNumber(impact[field]))) {
+        return false;
+    }
+    return value.drivers.every(driver => isRecord(driver) &&
+        isNonEmptyString(driver.type) &&
+        isNonEmptyString(driver.name) &&
+        isNonEmptyString(driver.summary) &&
+        isFiniteNumber(driver.cost) &&
+        isFiniteNumber(driver.delta) &&
+        isNullableFiniteNumber(driver.baseline) &&
+        isNullableFiniteNumber(driver.percentChange) &&
+        isFiniteNumber(driver.shareOfImpactPercent) &&
+        typeof driver.isNew === 'boolean' &&
+        Array.isArray(driver.resources) &&
+        driver.resources.every(isDriverResource));
+};
+const hasValidMetadataEvidenceState = (state, evidence, billingGenerationId, inputManifestDigest, chartData, anomalies) => {
+    if (state === 'partial')
+        return isBillingPartialArtifactPublicationDecision(evidence, billingGenerationId, inputManifestDigest);
+    if (!isBillingCompletedArtifactPublicationDecision(evidence, billingGenerationId, inputManifestDigest))
+        return false;
+    if (state !== 'complete-empty')
+        return true;
+    const billingHistory = evidence.dependencies.find(dependency => dependency.name === 'billing-history');
+    const dataWindow = chartData.dataWindow;
+    const views = chartData.views;
+    return (billingHistory?.emptyEvidence === 'complete-empty' &&
+        billingHistory.acceptedRowCount === 0 &&
+        isNonEmptyString(billingHistory.emptyProofRef) &&
+        isRecord(dataWindow) &&
+        dataWindow.pointCount === 0 &&
+        isRecord(views) &&
+        Object.values(views).every(view => view === undefined) &&
+        anomalies.length === 0);
+};
+/** Dependency-free validator for customer-readable V2 billing metadata. */
+export const isBillingCostAnalysisMetadataV2 = (value) => {
+    if (!isRecord(value) || containsForbiddenArtifactControlData(value) || value.schemaVersion !== 2)
+        return false;
+    if (Object.prototype.hasOwnProperty.call(value, 'outputManifestDigest'))
+        return false;
+    if (!isPathSegment(value.subscriptionId) || !isPathSegment(value.billingGenerationId))
+        return false;
+    if (!isArtifactOwnershipBinding(value.ownership) || value.ownership.provider !== 'azure' || value.ownership.accountId !== value.subscriptionId)
+        return false;
+    if (!isArtifactRevisionVector(value.revision) || value.ownership.ownershipEpochRevision !== value.revision.ownershipEpochRevision) {
+        return false;
+    }
+    if (typeof value.artifactState !== 'string' || !BILLING_DOCUMENT_STATES.has(value.artifactState))
+        return false;
+    if (typeof value.inputManifestDigest !== 'string' || !SHA256_PATTERN.test(value.inputManifestDigest))
+        return false;
+    if (typeof value.outputBindingDigest !== 'string' || !SHA256_PATTERN.test(value.outputBindingDigest))
+        return false;
+    if (value.outputBindingDigest === value.inputManifestDigest ||
+        publicationDecisionReferencesDigest(value.artifactEvidence, value.outputBindingDigest)) {
+        return false;
+    }
+    if (!isChartData(value.chartData) || !Array.isArray(value.anomalies) || !value.anomalies.every(isAnomaly))
+        return false;
+    if (!hasValidMetadataEvidenceState(value.artifactState, value.artifactEvidence, value.billingGenerationId, value.inputManifestDigest, value.chartData, value.anomalies)) {
+        return false;
+    }
+    if (!isNonEmptyString(value.currencyCode) || !isNonEmptyString(value.currencySymbol))
+        return false;
+    if (value.forecastMethod !== undefined && !isNonEmptyString(value.forecastMethod))
+        return false;
+    return [value.forecastMonthTotal, value.forecastRemaining, value.forecastPeriodEnd].every(isOptionalFiniteNumber);
+};

package/dist/esm/azure/views.js

@@ -1,3 +1,6 @@
+import { allowedArtifactReferenceField, containsForbiddenArtifactControlData, } from '../common/artifactControlData.js';
+import { isArtifactOwnershipBinding, isArtifactPublicationDecision, isEnforceableArtifactOwnershipBinding, } from '../common/artifactEvidence.js';
+import { isArtifactRevisionVector, isStrictLogicalArtifactReference } from '../common/artifactEvidenceValidation.js';
 const isNonEmptyString = (value) => typeof value === 'string' && value.trim().length > 0;
 const isCanonicalIsoTimestamp = (value) => {
     if (!isNonEmptyString(value))
@@ -30,3 +33,149 @@ export const isCompletedAzureViewSetV1 = (value) => {
         return false;
     return isNonEmptyString(value.economics.generationId) && isNonEmptyString(value.economics.fingerprint);
 };
+const VIEW_CONTENT_ENCODINGS = new Set(['identity', 'gzip']);
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const hasControlCharacters = (value) => Array.from(value).some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+const isStrictNonEmptyString = (value) => typeof value === 'string' && value.trim() === value && value.length > 0 && !hasControlCharacters(value);
+const isPositiveSafeInteger = (value) => Number.isSafeInteger(value) && Number(value) > 0;
+const isNonNegativeSafeInteger = (value) => Number.isSafeInteger(value) && Number(value) >= 0;
+const isSha256 = (value) => typeof value === 'string' && SHA256_PATTERN.test(value);
+const allowedViewArtifactPaths = (artifacts) => Array.isArray(artifacts) ? artifacts.flatMap(artifact => allowedArtifactReferenceField(artifact, 'path')) : [];
+const isSafePathSegment = (value) => isStrictNonEmptyString(value) && !/[\\/?#%]/.test(value) && value !== '.' && value !== '..';
+const isStrictCanonicalIsoTimestamp = (value) => {
+    if (!isStrictNonEmptyString(value))
+        return false;
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
+};
+const isEnforceableAzureOwnershipBinding = (value) => isEnforceableArtifactOwnershipBinding(value) && value.provider === 'azure';
+const hasMatchingViewOwnership = (subscriptionId, ownership, revision, enforceable) => {
+    if (!isSafePathSegment(subscriptionId) || !isArtifactRevisionVector(revision))
+        return false;
+    if (!isArtifactOwnershipBinding(ownership))
+        return false;
+    if (enforceable && !isEnforceableArtifactOwnershipBinding(ownership))
+        return false;
+    if (ownership.provider !== 'azure' || ownership.accountId !== subscriptionId)
+        return false;
+    return ownership.ownershipEpochRevision === revision.ownershipEpochRevision;
+};
+const isViewArtifactDescriptor = (value, runId) => isRecord(value) &&
+    isStrictLogicalArtifactReference(value.path) &&
+    value.path.startsWith(`runs/${runId}/`) &&
+    value.path.length > `runs/${runId}/`.length &&
+    isStrictNonEmptyString(value.name) &&
+    value.mediaType === 'application/json' &&
+    typeof value.contentEncoding === 'string' &&
+    VIEW_CONTENT_ENCODINGS.has(value.contentEncoding) &&
+    isNonNegativeSafeInteger(value.byteLength) &&
+    isSha256(value.sha256);
+const hasRequiredViewDependencies = (decision) => {
+    const dependencies = new Map(decision.dependencies.map(dependency => [dependency.name, dependency]));
+    const billing = dependencies.get('billing');
+    const economics = dependencies.get('economics');
+    if (!billing || !economics)
+        return false;
+    for (const dependency of [billing, economics]) {
+        if (dependency.publication === 'completed' && (!isStrictNonEmptyString(dependency.generationId) || !isSha256(dependency.digest))) {
+            return false;
+        }
+    }
+    const completedDependencies = new Set(decision.dependencies.filter(dependency => dependency.publication === 'completed').map(dependency => dependency.name));
+    return decision.claims.every(claim => claim.publication !== 'completed' || claim.requiredDependencies.every(dependency => completedDependencies.has(dependency)));
+};
+/** Validates an evidence-aware completed portal or plugin generation manifest. */
+export const isCompletedViewManifestV3 = (value) => {
+    if (!isRecord(value) || containsForbiddenArtifactControlData(value, allowedViewArtifactPaths(value.artifacts)))
+        return false;
+    if (value.schemaVersion !== 3 || value.status !== 'completed')
+        return false;
+    if (!isSafePathSegment(value.runId) || !hasMatchingViewOwnership(value.subscriptionId, value.ownership, value.revision, false))
+        return false;
+    if (!isRecord(value.artifactGeneration) ||
+        value.artifactGeneration.runId !== value.runId ||
+        !isStrictCanonicalIsoTimestamp(value.artifactGeneration.generatedAt)) {
+        return false;
+    }
+    if (!Array.isArray(value.artifacts) || value.artifacts.length === 0)
+        return false;
+    if (!value.artifacts.every(artifact => isViewArtifactDescriptor(artifact, value.runId)))
+        return false;
+    if (new Set(value.artifacts.map(artifact => artifact.path)).size !== value.artifacts.length ||
+        new Set(value.artifacts.map(artifact => artifact.name)).size !== value.artifacts.length) {
+        return false;
+    }
+    if (!isPositiveSafeInteger(value.requestedArtifactCount) ||
+        value.requestedArtifactCount !== value.artifacts.length ||
+        !isNonNegativeSafeInteger(value.requestedResourceCount) ||
+        value.failedArtifactCount !== 0 ||
+        value.failedResourceCount !== 0 ||
+        !isSha256(value.compositeDependencyDigest) ||
+        !isStrictCanonicalIsoTimestamp(value.completedAt)) {
+        return false;
+    }
+    return isArtifactPublicationDecision(value.publicationDecision) && hasRequiredViewDependencies(value.publicationDecision);
+};
+const hasSameOwnership = (left, right) => left.provider === right.provider &&
+    left.tenantId === right.tenantId &&
+    left.companyId === right.companyId &&
+    left.cloudAccountId === right.cloudAccountId &&
+    left.accountId === right.accountId &&
+    left.ownershipEpochRevision === right.ownershipEpochRevision;
+const hasSameRevision = (left, right) => left.ownershipEpochRevision === right.ownershipEpochRevision &&
+    left.sourceRevision === right.sourceRevision &&
+    left.policyRevision === right.policyRevision;
+const isViewSetV2SurfaceReference = (value, surface, subscriptionId, ownership, revision, compositeDependencyDigest) => {
+    if (!isRecord(value) || !isSafePathSegment(value.runId))
+        return false;
+    const expectedManifestName = surface === 'portal' ? 'completed-view-manifest.json' : 'completed-plugin-generation.json';
+    if (value.manifestPath !== `runs/${value.runId}/${expectedManifestName}` || !isStrictLogicalArtifactReference(value.manifestPath))
+        return false;
+    if (!isEnforceableAzureOwnershipBinding(value.ownership) || !isArtifactRevisionVector(value.revision))
+        return false;
+    if (!hasMatchingViewOwnership(subscriptionId, value.ownership, value.revision, true))
+        return false;
+    if (!hasSameOwnership(ownership, value.ownership) || !hasSameRevision(revision, value.revision))
+        return false;
+    return (isSha256(value.manifestDigest) &&
+        value.compositeDependencyDigest === compositeDependencyDigest &&
+        isStrictCanonicalIsoTimestamp(value.completedAt));
+};
+const hasMatchingSurfaceDependency = (decision, name, surface) => {
+    const dependency = decision.dependencies.find(candidate => candidate.name === name);
+    return (dependency !== undefined &&
+        dependency.required &&
+        dependency.publication === 'completed' &&
+        dependency.generationId === surface.runId &&
+        dependency.digest === surface.manifestDigest);
+};
+/** Validates the promoted pointer for an evidence-enforced portal/plugin view pair. */
+export const isCompletedAzureViewSetV2 = (value) => {
+    const allowedReferences = isRecord(value)
+        ? [...allowedArtifactReferenceField(value.portal, 'manifestPath'), ...allowedArtifactReferenceField(value.plugin, 'manifestPath')]
+        : [];
+    if (!isRecord(value) || containsForbiddenArtifactControlData(value, allowedReferences))
+        return false;
+    if (value.schemaVersion !== 2 || value.status !== 'completed')
+        return false;
+    if (!isSafePathSegment(value.subscriptionId) ||
+        !isStrictNonEmptyString(value.publicationId) ||
+        !isEnforceableAzureOwnershipBinding(value.ownership) ||
+        !isArtifactRevisionVector(value.revision) ||
+        !hasMatchingViewOwnership(value.subscriptionId, value.ownership, value.revision, true)) {
+        return false;
+    }
+    if (!isSha256(value.compositeDependencyDigest) || !isStrictCanonicalIsoTimestamp(value.completedAt))
+        return false;
+    if (!isViewSetV2SurfaceReference(value.portal, 'portal', value.subscriptionId, value.ownership, value.revision, value.compositeDependencyDigest) ||
+        !isViewSetV2SurfaceReference(value.plugin, 'plugin', value.subscriptionId, value.ownership, value.revision, value.compositeDependencyDigest)) {
+        return false;
+    }
+    const laterSurfaceCompletedAt = Date.parse(value.portal.completedAt) >= Date.parse(value.plugin.completedAt) ? value.portal.completedAt : value.plugin.completedAt;
+    if (value.completedAt !== laterSurfaceCompletedAt)
+        return false;
+    return (isArtifactPublicationDecision(value.publicationDecision) &&
+        value.publicationDecision.publication === 'completed' &&
+        hasMatchingSurfaceDependency(value.publicationDecision, 'portal', value.portal) &&
+        hasMatchingSurfaceDependency(value.publicationDecision, 'plugin', value.plugin));
+};

package/dist/esm/common/artifactControlData.js

@@ -0,0 +1,95 @@
+const FORBIDDEN_SENSITIVE_FIELDS = new Set([
+    'accountkey',
+    'accesskey',
+    'accesstoken',
+    'apikey',
+    'authorization',
+    'clientsecret',
+    'connectionstring',
+    'credential',
+    'credentials',
+    'password',
+    'refreshtoken',
+    'sastoken',
+    'secret',
+    'sharedaccesssignature',
+    'token',
+]);
+const PHYSICAL_REFERENCE_FIELDS = new Set([
+    'artifactpath',
+    'blobpath',
+    'bloburi',
+    'bloburl',
+    'containerpath',
+    'containeruri',
+    'containerurl',
+    'filepath',
+    'filesystempath',
+    'inputmanifestpath',
+    'manifestpath',
+    'outputmanifestpath',
+    'path',
+    'physicalpath',
+    'physicaluri',
+    'physicalurl',
+    'sourcepath',
+    'sourceuri',
+    'sourceurl',
+    'storagepath',
+    'storageuri',
+    'storageurl',
+    'uri',
+    'url',
+]);
+const PERCENT_ENCODED_BYTE_PATTERN = /%[0-9A-Fa-f]{2}/;
+const URI_SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const hasControlCharacters = (value) => Array.from(value).some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+const normalizeFieldName = (key) => key.replace(/[-_\s]/g, '').toLowerCase();
+const hasDotTraversal = (value) => value.split(/[\\/]/).some(segment => segment === '.' || segment === '..');
+const isForbiddenReferenceValue = (value, allowUriScheme = false) => hasControlCharacters(value) ||
+    PERCENT_ENCODED_BYTE_PATTERN.test(value) ||
+    (!allowUriScheme && URI_SCHEME_PATTERN.test(value)) ||
+    value.startsWith('/') ||
+    value.startsWith('\\\\') ||
+    /^[A-Za-z]:[\\/]/.test(value) ||
+    hasDotTraversal(value);
+const isSafeAzureResourceId = (key, value) => {
+    if (key !== 'resourceId' || typeof value !== 'string' || hasControlCharacters(value) || value.includes('\\'))
+        return false;
+    const segments = value.split('/');
+    return (segments.length >= 3 &&
+        segments[0] === '' &&
+        segments[1].toLowerCase() === 'subscriptions' &&
+        segments
+            .slice(2)
+            .every(segment => segment.trim() === segment && segment.length > 0 && !/[?#%]/.test(segment) && segment !== '.' && segment !== '..'));
+};
+/** Marks a structurally validated schema field whose logical reference name is allowed. */
+export const allowedArtifactReferenceField = (object, key) => isRecord(object) ? [{ object, key }] : [];
+/** Marks a structurally validated identity field whose value is allowed by its owning schema. */
+export const allowedArtifactIdentityField = (object, key) => isRecord(object) ? [{ object, key, allowUriScheme: true }] : [];
+/** Rejects exact normalized sensitive fields and physical-reference control data recursively. */
+export const containsForbiddenArtifactControlData = (value, allowedReferenceFields = []) => {
+    if (typeof value === 'string')
+        return isForbiddenReferenceValue(value);
+    if (Array.isArray(value))
+        return value.some(child => containsForbiddenArtifactControlData(child, allowedReferenceFields));
+    if (!isRecord(value))
+        return false;
+    return Object.entries(value).some(([key, child]) => {
+        if (hasControlCharacters(key))
+            return true;
+        const normalizedKey = normalizeFieldName(key);
+        if (FORBIDDEN_SENSITIVE_FIELDS.has(normalizedKey))
+            return true;
+        const allowedField = allowedReferenceFields.find(field => field.object === value && field.key === key);
+        if (allowedField?.allowUriScheme && typeof child === 'string')
+            return isForbiddenReferenceValue(child, true);
+        if (PHYSICAL_REFERENCE_FIELDS.has(normalizedKey) && !allowedField)
+            return true;
+        if (isSafeAzureResourceId(key, child))
+            return false;
+        return containsForbiddenArtifactControlData(child, allowedReferenceFields);
+    });
+};

package/dist/esm/common/artifactEvidence.js

@@ -0,0 +1,173 @@
+import { hasValidOptionalArtifactRevisionComponents, isStrictLogicalArtifactReference } from './artifactEvidenceValidation.js';
+const SUPPORT_VERDICTS = new Set(['supported', 'unsupported', 'unknown']);
+const APPLICABILITY_VERDICTS = new Set(['applicable', 'not-applicable', 'unknown']);
+const ATTEMPT_OUTCOMES = new Set([
+    'not-attempted',
+    'queued',
+    'running',
+    'succeeded',
+    'failed',
+    'cancelled',
+    'timed-out',
+    'dead-lettered',
+    'superseded',
+]);
+const COVERAGE_VERDICTS = new Set(['complete', 'partial', 'none', 'unknown']);
+const EMPTY_EVIDENCE_VERDICTS = new Set(['populated', 'complete-empty', 'not-observed', 'unknown']);
+const FRESHNESS_VERDICTS = new Set(['current', 'stale', 'expired', 'unknown']);
+const EVIDENCE_VERDICTS = new Set(['complete', 'partial', 'insufficient', 'conflicting']);
+const PROCESSING_LIFECYCLES = new Set(['queued', 'running', 'succeeded', 'failed', 'cancelled', 'timed-out', 'dead-lettered', 'superseded']);
+const PUBLICATION_VERDICTS = new Set(['completed', 'partial', 'suppressed', 'superseded', 'quarantined']);
+const PROVIDERS = new Set(['azure', 'aws']);
+const DATE_BASES = new Set(['utc', 'billing-calendar', 'company-local']);
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isNonEmptyString = (value) => typeof value === 'string' && value.trim().length > 0;
+const isNonNegativeInteger = (value) => Number.isInteger(value) && value >= 0;
+const isPositiveInteger = (value) => Number.isInteger(value) && value > 0;
+const isStringIn = (value, values) => typeof value === 'string' && values.has(value);
+const isCanonicalIsoTimestamp = (value) => {
+    if (!isNonEmptyString(value))
+        return false;
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value;
+};
+const isArtifactDecisionIssue = (value) => isRecord(value) &&
+    isNonEmptyString(value.code) &&
+    typeof value.blocking === 'boolean' &&
+    (value.dependency === undefined || isNonEmptyString(value.dependency));
+const isObservedRange = (value) => {
+    if (!isRecord(value) ||
+        !isCanonicalIsoTimestamp(value.fromInclusive) ||
+        !isCanonicalIsoTimestamp(value.throughExclusive) ||
+        Date.parse(value.throughExclusive) <= Date.parse(value.fromInclusive) ||
+        !isStringIn(value.dateBasis, DATE_BASES)) {
+        return false;
+    }
+    return value.timeZone === undefined || isNonEmptyString(value.timeZone);
+};
+const isArtifactDependencyDescriptor = (value) => {
+    if (!isRecord(value) ||
+        !isNonEmptyString(value.name) ||
+        typeof value.required !== 'boolean' ||
+        !isStringIn(value.support, SUPPORT_VERDICTS) ||
+        !isStringIn(value.applicability, APPLICABILITY_VERDICTS) ||
+        !isStringIn(value.attempt, ATTEMPT_OUTCOMES) ||
+        !isStringIn(value.coverage, COVERAGE_VERDICTS) ||
+        !isStringIn(value.emptyEvidence, EMPTY_EVIDENCE_VERDICTS) ||
+        !isStringIn(value.freshness, FRESHNESS_VERDICTS) ||
+        !isStringIn(value.evidence, EVIDENCE_VERDICTS) ||
+        !isStringIn(value.publication, PUBLICATION_VERDICTS)) {
+        return false;
+    }
+    if (value.generationId !== undefined && !isNonEmptyString(value.generationId))
+        return false;
+    if (value.digest !== undefined && (typeof value.digest !== 'string' || !SHA256_PATTERN.test(value.digest)))
+        return false;
+    if (!hasValidOptionalArtifactRevisionComponents(value))
+        return false;
+    if (value.observedRange !== undefined && !isObservedRange(value.observedRange))
+        return false;
+    if (value.completeThrough !== undefined && !isCanonicalIsoTimestamp(value.completeThrough))
+        return false;
+    if (value.reasonCode !== undefined && !isNonEmptyString(value.reasonCode))
+        return false;
+    if (value.acceptedRowCount !== undefined && !isNonNegativeInteger(value.acceptedRowCount))
+        return false;
+    if (value.emptyEvidence === 'complete-empty') {
+        if (value.attempt !== 'succeeded' ||
+            value.coverage !== 'complete' ||
+            value.acceptedRowCount !== 0 ||
+            !isStrictLogicalArtifactReference(value.emptyProofRef)) {
+            return false;
+        }
+    }
+    else if (value.emptyProofRef !== undefined) {
+        return false;
+    }
+    if (value.publication === 'completed') {
+        return (value.support === 'supported' &&
+            value.applicability === 'applicable' &&
+            value.attempt === 'succeeded' &&
+            value.coverage === 'complete' &&
+            (value.emptyEvidence === 'populated' || value.emptyEvidence === 'complete-empty') &&
+            value.evidence === 'complete');
+    }
+    return true;
+};
+const isArtifactClaimDependencyDecision = (value) => {
+    if (!isRecord(value) ||
+        !isNonEmptyString(value.claimId) ||
+        !Array.isArray(value.sectionPaths) ||
+        !value.sectionPaths.every(isNonEmptyString) ||
+        !Array.isArray(value.requiredDependencies) ||
+        !value.requiredDependencies.every(isNonEmptyString) ||
+        !isStringIn(value.evidence, EVIDENCE_VERDICTS) ||
+        !isStringIn(value.publication, PUBLICATION_VERDICTS) ||
+        !Array.isArray(value.issues) ||
+        !value.issues.every(isArtifactDecisionIssue)) {
+        return false;
+    }
+    return value.publication !== 'completed' || (value.evidence === 'complete' && !value.issues.some(issue => issue.blocking));
+};
+const hasUniqueValues = (values) => new Set(values).size === values.length;
+/** Dependency-free runtime rejection boundary for provider-neutral publication decisions. */
+export const isArtifactPublicationDecision = (value) => {
+    if (!isRecord(value) ||
+        !isStringIn(value.processing, PROCESSING_LIFECYCLES) ||
+        !isStringIn(value.evidence, EVIDENCE_VERDICTS) ||
+        !isStringIn(value.publication, PUBLICATION_VERDICTS) ||
+        !Array.isArray(value.dependencies) ||
+        !value.dependencies.every(isArtifactDependencyDescriptor) ||
+        !Array.isArray(value.claims) ||
+        !value.claims.every(isArtifactClaimDependencyDecision) ||
+        !Array.isArray(value.issues) ||
+        !value.issues.every(isArtifactDecisionIssue)) {
+        return false;
+    }
+    const dependencyNames = value.dependencies.map(dependency => dependency.name);
+    const claimIds = value.claims.map(claim => claim.claimId);
+    if (!hasUniqueValues(dependencyNames) || !hasUniqueValues(claimIds))
+        return false;
+    if (!value.claims.every(claim => hasUniqueValues(claim.requiredDependencies)))
+        return false;
+    if (value.publication !== 'completed')
+        return true;
+    const completedDependencies = new Set(value.dependencies.filter(dependency => dependency.publication === 'completed').map(dependency => dependency.name));
+    return (value.processing === 'succeeded' &&
+        (value.evidence === 'complete' || value.evidence === 'partial') &&
+        value.dependencies.every(dependency => !dependency.required || dependency.publication === 'completed') &&
+        value.claims.every(claim => claim.publication === 'completed' && claim.requiredDependencies.every(dependency => completedDependencies.has(dependency))) &&
+        !value.issues.some(issue => issue.blocking));
+};
+/** Checks the provider-neutral ownership shape used by observe- and enforce-mode artifacts. */
+export const isArtifactOwnershipBinding = (value) => isRecord(value) &&
+    isStringIn(value.provider, PROVIDERS) &&
+    isNonEmptyString(value.tenantId) &&
+    isNonEmptyString(value.companyId) &&
+    isNonEmptyString(value.cloudAccountId) &&
+    isNonEmptyString(value.accountId) &&
+    (value.ownershipEpochRevision === undefined || isPositiveInteger(value.ownershipEpochRevision));
+/** Checks that an ownership binding is valid for enforce-mode publication. */
+export const isEnforceableArtifactOwnershipBinding = (value) => isArtifactOwnershipBinding(value) && value.ownershipEpochRevision !== undefined;
+/**
+ * Compares ownership first, then source and policy revisions component-wise.
+ * Callers must validate both vectors before comparison; this function deliberately compares the supplied values without adding a second validation policy.
+ */
+export const compareArtifactRevisionVector = (left, right) => {
+    if (left.ownershipEpochRevision === undefined || right.ownershipEpochRevision === undefined)
+        return 'unenforceable';
+    if (left.ownershipEpochRevision > right.ownershipEpochRevision)
+        return 'newer-ownership';
+    if (left.ownershipEpochRevision < right.ownershipEpochRevision)
+        return 'older-ownership';
+    const sourceComparison = Math.sign(left.sourceRevision - right.sourceRevision);
+    const policyComparison = Math.sign(left.policyRevision - right.policyRevision);
+    if (sourceComparison === 0 && policyComparison === 0)
+        return 'equal';
+    if (sourceComparison >= 0 && policyComparison >= 0)
+        return 'newer';
+    if (sourceComparison <= 0 && policyComparison <= 0)
+        return 'older';
+    return 'incomparable';
+};

package/dist/esm/common/artifactEvidenceValidation.js

@@ -0,0 +1,24 @@
+const hasControlCharacters = (value) => Array.from(value).some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+/** Validates a generation-relative logical artifact reference without accepting physical-path encodings. */
+export const isStrictLogicalArtifactReference = (value) => {
+    if (typeof value !== 'string' || value.trim() !== value || value.length === 0 || hasControlCharacters(value))
+        return false;
+    if (value.startsWith('/') || value.includes('\\') || value.includes('%') || value.includes('?') || value.includes('#'))
+        return false;
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(value) || /^[A-Za-z]:[\\/]/.test(value))
+        return false;
+    const segments = value.split('/');
+    return segments.length >= 2 && segments.every(segment => segment.length > 0 && segment !== '.' && segment !== '..');
+};
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isPositiveSafeInteger = (value) => Number.isSafeInteger(value) && Number(value) > 0;
+/** Validates the positive source/policy revision vector shared by evidence producers and consumers. */
+export const isArtifactRevisionVector = (value) => isRecord(value) &&
+    isPositiveSafeInteger(value.sourceRevision) &&
+    isPositiveSafeInteger(value.policyRevision) &&
+    (value.ownershipEpochRevision === undefined || isPositiveSafeInteger(value.ownershipEpochRevision));
+/** Validates optional dependency revision components using the shared revision-vector rules. */
+export const hasValidOptionalArtifactRevisionComponents = (value) => isArtifactRevisionVector({
+    sourceRevision: value.sourceRevision === undefined ? 1 : value.sourceRevision,
+    policyRevision: value.policyRevision === undefined ? 1 : value.policyRevision,
+});