@spottoai/types-package 1.0.2-beta.36 → 1.0.2-beta.360

package/dist/esm/accounts/writePermissions.js

@@ -0,0 +1,43 @@
+/**
+ * Write Permission Bitmask Enum
+ * Each permission gets a unique bit position for efficient storage
+ */
+export var WritePermission;
+(function (WritePermission) {
+    /** Permission to dismiss Azure Advisor recommendations */
+    WritePermission[WritePermission["DismissRecommendations"] = 1] = "DismissRecommendations";
+    /** Permission to enable storage inventory reports on storage accounts */
+    WritePermission[WritePermission["StorageInventory"] = 2] = "StorageInventory";
+    /** Permission to create scoped Azure Policy exemptions */
+    WritePermission[WritePermission["PolicyExemptions"] = 4] = "PolicyExemptions";
+})(WritePermission || (WritePermission = {}));
+/**
+ * Permission metadata array
+ * Define all available write permissions with their metadata
+ */
+export const WRITE_PERMISSIONS_METADATA = [
+    {
+        id: WritePermission.DismissRecommendations,
+        displayName: 'Dismiss Azure Advisor Recommendations',
+        description: 'Allows Spotto to dismiss recommendations in Azure when dismissed here.',
+        requiredRoles: ['Advisor Recommendations Contributor'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/advisor/permissions',
+        scriptGeneratorUrl: '/scripts/advisor-role',
+    },
+    {
+        id: WritePermission.StorageInventory,
+        displayName: 'Enable Storage Inventory Reports',
+        description: 'Allows Spotto to enable blob inventory on storage accounts you select.',
+        requiredRoles: ['Storage Account Contributor'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory',
+        scriptGeneratorUrl: '/scripts/storage-role',
+    },
+    {
+        id: WritePermission.PolicyExemptions,
+        displayName: 'Create Azure Policy Exemptions',
+        description: 'Allows Spotto to create narrowly scoped exemptions for selected Azure Policy initiative controls.',
+        requiredRoles: ['Custom role with Azure Policy exemption actions at the target and assignment scopes'],
+        documentationUrl: 'https://docs.spotto.ai/docs/portal/write-permissions/policy-exemptions',
+        scriptGeneratorUrl: '/scripts/policy-exemptions-role',
+    },
+];

package/dist/esm/ai/index.js

@@ -0,0 +1,2 @@
+/** Common AI interfaces shared between frontend and backend */
+export {};

package/dist/esm/assessments/artifact.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/catalogue.js

@@ -0,0 +1,12 @@
+export const ARCHITECTURE_ASSESSMENT_REQUIRED_CONTEXT_CATEGORIES = [
+    'company-profile',
+    'architecture',
+    'operations',
+    'reliability',
+    'roadmap',
+];
+export const ARCHITECTURE_ASSESSMENT_OPTIONAL_CONTEXT_CATEGORIES = [
+    'security',
+    'performance',
+    'finops',
+];

package/dist/esm/assessments/common.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/evidence.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/export.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/index.js

@@ -0,0 +1,10 @@
+export * from './status.js';
+export * from './common.js';
+export * from './catalogue.js';
+export * from './run.js';
+export * from './evidence.js';
+export * from './artifact.js';
+export * from './review.js';
+export * from './queue.js';
+export * from './export.js';
+export * from './sow.js';

package/dist/esm/assessments/queue.js

@@ -0,0 +1,2 @@
+export const ASSESSMENT_QUEUE_ENTITY = 'assessment';
+export const ASSESSMENT_GENERATE_ACTION = 'generate-assessment';

package/dist/esm/assessments/review.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/run.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/sow.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/status.js

@@ -0,0 +1,23 @@
+export const ARCHITECTURE_ASSESSMENT_TYPE = 'architecture';
+export const ASSESSMENT_TYPES = [ARCHITECTURE_ASSESSMENT_TYPE];
+export const ASSESSMENT_PROVIDER_NAMES = ['azure'];
+export const ASSESSMENT_RELEASE_STAGES = ['preview', 'ga'];
+export const ASSESSMENT_RUN_STATUSES = ['draft', 'queued', 'running', 'needs_review', 'approved', 'published', 'failed'];
+export const ASSESSMENT_EXPORT_FORMATS = ['docx'];
+export const ASSESSMENT_EXPORT_STATUSES = ['requested', 'completed', 'failed'];
+export const ASSESSMENT_EVIDENCE_SOURCE_TYPES = [
+    'company_context_note',
+    'subscription_report_evidence_pack',
+    'portal_artifact',
+    'raw_artifact',
+    'conformed_artifact',
+    'review_checklist',
+    'derived_summary',
+    'ai_inference',
+    'evidence_gap',
+];
+export const ASSESSMENT_EVIDENCE_CONFIDENCE_LEVELS = ['confirmed', 'customer_supplied', 'derived', 'inferred', 'gap'];
+export const ASSESSMENT_PRIORITY_LEVELS = ['critical', 'high', 'medium', 'low', 'informational'];
+export const ASSESSMENT_EFFORT_BANDS = ['low', 'medium', 'high', 'unknown'];
+export const ASSESSMENT_IMPACT_LEVELS = ['low', 'medium', 'high', 'unknown'];
+export const ASSESSMENT_PILLARS = ['architecture', 'security', 'reliability', 'performance', 'operations', 'finops', 'roadmap'];

package/dist/esm/aws/commitments-planning.js

@@ -0,0 +1 @@
+export { validateAwsCommitmentsPlanningViewIdentity } from './commitmentsPlanningValidation.js';

package/dist/esm/aws/commitmentsPlanningValidation.js

@@ -0,0 +1,121 @@
+import { ProviderName } from '../common/provider.js';
+import { asRecord, assertAccount, assertExactKeys, assertValue } from './pluginPublicArtifactValidationHelpers.js';
+const FORBIDDEN_AWS_COMMITMENTS_KEYS = new Set([
+    'billingScopeId',
+    'breakCostEstimate',
+    'cloudAccountId',
+    'companyId',
+    'credentialHealth',
+    'credentialId',
+    'managementGroupId',
+    'pricingQuote',
+    'quotePolicy',
+    'resourceGroupId',
+    'storageCapacity',
+    'storageDimensions',
+    'subscription',
+    'subscriptionId',
+    'tenantId',
+    'unlockFinancialLedger',
+]);
+/**
+ * Validates the security-sensitive AWS identity boundary of a commitments view.
+ * A full public-artifact validator should call this before publication or response.
+ */
+export function validateAwsCommitmentsPlanningViewIdentity(value, expectedAccountId) {
+    const view = asRecord(value, 'commitmentsPlanning');
+    const providerScope = asRecord(view.providerScope, 'commitmentsPlanning.providerScope');
+    assertExactKeys(providerScope, ['providerName', 'providerScopeId'], 'commitmentsPlanning.providerScope');
+    assertValue(providerScope.providerName, ProviderName.Aws, 'commitmentsPlanning.providerScope.providerName');
+    const accountId = String(providerScope.providerScopeId ?? '');
+    assertAccount(providerScope.providerScopeId, accountId, 'commitmentsPlanning.providerScope.providerScopeId');
+    if (expectedAccountId !== undefined) {
+        assertAccount(expectedAccountId, accountId, 'expectedAccountId');
+    }
+    validateInventory(view.inventory, accountId);
+    validatePurchaseRecommendations(view.purchaseRecommendations, accountId);
+    validateBoundIdentities(view, accountId, 'commitmentsPlanning');
+}
+function validateInventory(value, accountId) {
+    if (!Array.isArray(value))
+        throw new Error('commitmentsPlanning.inventory must be an array.');
+    value.forEach((item, index) => {
+        const field = `commitmentsPlanning.inventory[${index}]`;
+        const record = asRecord(item, field);
+        assertValue(record.sourceKind, 'aws-native', `${field}.sourceKind`);
+        assertValue(record.provider, ProviderName.Aws, `${field}.provider`);
+        assertValue(record.appliedScopeType, 'linked-account', `${field}.appliedScopeType`);
+        validateAppliedScope(record.appliedScopeProperties, accountId, `${field}.appliedScopeProperties`);
+        validateAwsShape(record.shape, `${field}.shape`);
+    });
+}
+function validatePurchaseRecommendations(value, accountId) {
+    if (value === undefined)
+        return;
+    if (!Array.isArray(value))
+        throw new Error('commitmentsPlanning.purchaseRecommendations must be an array.');
+    value.forEach((item, index) => {
+        const field = `commitmentsPlanning.purchaseRecommendations[${index}]`;
+        const record = asRecord(item, field);
+        assertValue(record.purchaseScope, 'linked-account', `${field}.purchaseScope`);
+        validateAppliedScope(record.appliedScopeProperties, accountId, `${field}.appliedScopeProperties`);
+        validateAwsSource(record.source, `${field}.source`);
+        validateAwsShape(record.currentShape, `${field}.currentShape`);
+        validateAwsShape(record.targetShape, `${field}.targetShape`, true);
+        if (record.eligibility !== undefined) {
+            const eligibility = asRecord(record.eligibility, `${field}.eligibility`);
+            validateAwsShape(eligibility.currentShape, `${field}.eligibility.currentShape`);
+            validateAwsShape(eligibility.targetShape, `${field}.eligibility.targetShape`);
+            if (eligibility.source !== undefined)
+                validateAwsSource(eligibility.source, `${field}.eligibility.source`);
+        }
+    });
+}
+function validateAppliedScope(value, accountId, field) {
+    const scope = asRecord(value, field);
+    assertExactKeys(scope, ['accountId', 'region', 'availabilityZone'], field);
+    assertAccount(scope.accountId, accountId, `${field}.accountId`);
+}
+function validateAwsSource(value, field) {
+    const source = asRecord(value, field);
+    assertValue(source.sourceKind, 'aws-native', `${field}.sourceKind`);
+}
+function validateAwsShape(value, field, required = false) {
+    if (value === undefined && !required)
+        return;
+    const shape = asRecord(value, field);
+    assertValue(shape.provider, 'aws', `${field}.provider`);
+}
+function validateBoundIdentities(value, accountId, field) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => validateBoundIdentities(item, accountId, `${field}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== 'object') {
+        if (typeof value === 'string')
+            validateArnAccount(value, accountId, field);
+        return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        if (FORBIDDEN_AWS_COMMITMENTS_KEYS.has(key)) {
+            throw new Error(`${field}.${key} is not allowed in an AWS commitments artifact.`);
+        }
+        if (key === 'accountId')
+            assertAccount(child, accountId, `${field}.${key}`);
+        if (key === 'providerName')
+            assertValue(child, ProviderName.Aws, `${field}.${key}`);
+        if (key === 'provider')
+            assertValue(child, 'aws', `${field}.${key}`);
+        if (key === 'sourceKind' && child === 'azure-native') {
+            throw new Error(`${field}.${key} cannot contain Azure-native evidence.`);
+        }
+        validateBoundIdentities(child, accountId, `${field}.${key}`);
+    }
+}
+function validateArnAccount(value, accountId, field) {
+    if (!value.startsWith('arn:'))
+        return;
+    const arnAccountId = value.split(':', 6)[4];
+    if (arnAccountId)
+        assertAccount(arnAccountId, accountId, field);
+}

package/dist/esm/aws/estates.js

@@ -0,0 +1,21 @@
+import { AWS_FORBIDDEN_CREDENTIAL_FIELDS } from './requests.js';
+/** Schema version for the API-owned AWS company estate manifest. */
+export const AWS_ESTATES_MANIFEST_SCHEMA_VERSION = 1;
+/** Public provider discriminator used by the AWS estate manifest API. */
+export const AWS_ESTATES_MANIFEST_PROVIDER = 'AWS';
+export const AWS_ESTATE_KINDS = ['standalone', 'organization'];
+export const AWS_ESTATE_ACCOUNT_SOURCES = ['manual'];
+export const AWS_ESTATE_ROLE_DEPLOYMENT_MODES = ['customer-managed'];
+export const AWS_ESTATE_ACCOUNT_PURPOSES = ['resource-discovery', 'organization-discovery', 'billing-definition', 'billing-storage'];
+/**
+ * Credential-shaped fields that manifest API boundaries must reject
+ * recursively before persisting untyped JSON.
+ */
+export const AWS_ESTATES_MANIFEST_FORBIDDEN_CREDENTIAL_FIELDS = [
+    ...AWS_FORBIDDEN_CREDENTIAL_FIELDS,
+    'externalId',
+    'accessToken',
+    'connectionString',
+    'sasToken',
+    'storageCredential',
+];

package/dist/esm/aws/index.js

@@ -0,0 +1,18 @@
+export * from './estates.js';
+export * from './commitmentsPlanningValidation.js';
+export * from './onboarding.js';
+export * from './pluginPublicArtifacts.js';
+export * from './pluginPublicArtifactEvidence.js';
+export * from './pluginPublicArtifactValidation.js';
+export * from './portalPublicArtifacts.js';
+export * from './portalCommitmentsPlanningPublicArtifacts.js';
+export * from './portalCommitmentsPlanningPublicArtifactValidation.js';
+export * from './portalRelationshipPublicArtifacts.js';
+export * from './portalRelationshipResourceNodeTypes.js';
+export * from './portalRelationshipPublicArtifactValidation.js';
+export * from './portalPublicArtifactHistoryTypes.js';
+export * from './portalPublicArtifactNestedEvidence.js';
+export * from './portalPublicArtifactNestedEvidenceValidation.js';
+export * from './portalPublicArtifactValidation.js';
+export * from './publicArtifacts.js';
+export * from './requests.js';

package/dist/esm/aws/onboarding.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/aws/pluginPublicArtifactBodyValidation.js

@@ -0,0 +1,217 @@
+import { AWS_PLUGIN_PUBLIC_ARTIFACT_SCHEMA_VERSION, buildAwsPluginResourceLogicalName, buildAwsPluginSubscriptionLogicalName, sha256AwsPluginIdentity, } from './pluginPublicArtifacts.js';
+import { AWS_PUBLIC_ARTIFACT_SCHEMA_VERSION } from './publicArtifacts.js';
+import { asRecord, assertAccount, assertExactKeys, assertJsonEqual, assertPublicJson, assertValue, isoTimestamp, optionalEnum, requiredEnum, requiredString, sha256, stringArray, validateBilling, validateMetricWindow, validateSelector, validateTagRuleScope, } from './pluginPublicArtifactValidationHelpers.js';
+import { validateResourceSections, validateSubscriptionSections } from './pluginPublicArtifactSectionValidation.js';
+export { validateSourceBinding } from './pluginPublicArtifactSectionValidation.js';
+/** Validates and returns one lossless AWS plugin subscription-detail body. */
+export function validateAwsPluginSubscriptionDetailArtifact(value) {
+    const artifact = asRecord(value, 'artifact');
+    assertExactKeys(artifact, [
+        'schemaVersion',
+        'pluginSchemaVersion',
+        'provider',
+        'accountId',
+        'artifactType',
+        'artifactGeneration',
+        'generatedAt',
+        'logicalName',
+        'target',
+        'sections',
+    ], 'artifact');
+    validateArtifactEnvelope(artifact, 'plugin-subscription');
+    const target = validateTarget(artifact.target, 'subscription-detail');
+    const accountId = requiredString(artifact.accountId, 'artifact.accountId');
+    assertAccount(target.accountId, accountId, 'artifact.target.accountId');
+    assertValue(artifact.logicalName, buildAwsPluginSubscriptionLogicalName(target.targetKeySha256), 'artifact.logicalName');
+    validateSubscriptionSections(artifact.sections, target, requiredString(artifact.generatedAt, 'artifact.generatedAt'));
+    assertPublicJson(artifact, 'artifact');
+    return value;
+}
+/** Validates and returns one lossless AWS plugin resource-detail body. */
+export function validateAwsPluginResourceDetailArtifact(value) {
+    const artifact = asRecord(value, 'artifact');
+    assertExactKeys(artifact, [
+        'schemaVersion',
+        'pluginSchemaVersion',
+        'provider',
+        'accountId',
+        'artifactType',
+        'artifactGeneration',
+        'generatedAt',
+        'logicalName',
+        'target',
+        'selector',
+        'stableKey',
+        'sections',
+    ], 'artifact');
+    validateArtifactEnvelope(artifact, 'plugin-resource');
+    const target = validateTarget(artifact.target, 'resource-detail');
+    const accountId = requiredString(artifact.accountId, 'artifact.accountId');
+    assertAccount(target.accountId, accountId, 'artifact.target.accountId');
+    assertValue(artifact.logicalName, buildAwsPluginResourceLogicalName(target.stableKeySha256, target.targetKeySha256), 'artifact.logicalName');
+    assertJsonEqual(artifact.selector, target.selector, 'artifact.selector');
+    assertValue(artifact.stableKey, target.stableKey, 'artifact.stableKey');
+    validateResourceSections(artifact.sections, target, requiredString(artifact.generatedAt, 'artifact.generatedAt'));
+    assertPublicJson(artifact, 'artifact');
+    return value;
+}
+function validateArtifactEnvelope(artifact, artifactType) {
+    assertValue(artifact.schemaVersion, AWS_PUBLIC_ARTIFACT_SCHEMA_VERSION, 'artifact.schemaVersion');
+    assertValue(artifact.pluginSchemaVersion, AWS_PLUGIN_PUBLIC_ARTIFACT_SCHEMA_VERSION, 'artifact.pluginSchemaVersion');
+    assertValue(artifact.provider, 'aws', 'artifact.provider');
+    requiredString(artifact.accountId, 'artifact.accountId');
+    assertValue(artifact.artifactType, artifactType, 'artifact.artifactType');
+    const generation = validateGeneration(artifact.artifactGeneration, 'artifact.artifactGeneration');
+    assertValue(isoTimestamp(artifact.generatedAt, 'artifact.generatedAt'), generation.generatedAt, 'artifact.generatedAt');
+}
+function validateGeneration(value, field) {
+    const generation = asRecord(value, field);
+    assertExactKeys(generation, ['runId', 'generatedAt'], field);
+    return {
+        runId: requiredString(generation.runId, `${field}.runId`),
+        generatedAt: isoTimestamp(generation.generatedAt, `${field}.generatedAt`),
+    };
+}
+export function validateTarget(value, kind) {
+    const target = asRecord(value, 'target');
+    assertValue(target.kind, kind, 'target.kind');
+    assertValue(target.provider, 'aws', 'target.provider');
+    requiredString(target.accountId, 'target.accountId');
+    requiredString(target.targetKey, 'target.targetKey');
+    sha256(target.targetKeySha256, 'target.targetKeySha256');
+    assertValue(target.targetKeySha256, sha256AwsPluginIdentity(requiredString(target.targetKey, 'target.targetKey')), 'target.targetKeySha256');
+    validateBilling(target.billing);
+    stringArray(target.resourceRegions, 'target.resourceRegions');
+    validateMetricWindow(target.metricTimeWindow, 'target.metricTimeWindow');
+    validateRecommendationScopes(target.recommendationScopes, requiredString(target.accountId, 'target.accountId'));
+    if (kind === 'subscription-detail') {
+        assertExactKeys(target, [
+            'kind',
+            'provider',
+            'accountId',
+            'targetKey',
+            'targetKeySha256',
+            'accountSummaryTargetKey',
+            'resourceCollectionTargetKey',
+            'recommendationsTargetKey',
+            'aiCostSummaryTargetKey',
+            'serviceRetirementTargetKey',
+            'commitmentAnalysisTargetKey',
+            'reliabilityTargetKey',
+            'accountGovernanceTargetKey',
+            'billing',
+            'resourceRegions',
+            'metricTimeWindow',
+            'aiCostSummaryAudience',
+            'serviceRetirementRegions',
+            'recommendationScopes',
+            'commitmentAnalysis',
+            'reliability',
+            'accountGovernance',
+        ], 'target');
+        optionalEnum(target.aiCostSummaryAudience, ['portal', 'plugin'], 'target.aiCostSummaryAudience');
+        requiredString(target.accountSummaryTargetKey, 'target.accountSummaryTargetKey');
+        requiredString(target.resourceCollectionTargetKey, 'target.resourceCollectionTargetKey');
+        requiredString(target.recommendationsTargetKey, 'target.recommendationsTargetKey');
+        requiredString(target.serviceRetirementTargetKey, 'target.serviceRetirementTargetKey');
+        validateOptionalTargetKey(target.aiCostSummaryTargetKey, target.aiCostSummaryAudience !== undefined, 'target.aiCostSummaryTargetKey');
+        validateOptionalTargetKey(target.commitmentAnalysisTargetKey, target.commitmentAnalysis !== undefined, 'target.commitmentAnalysisTargetKey');
+        validateOptionalTargetKey(target.reliabilityTargetKey, target.reliability !== undefined, 'target.reliabilityTargetKey');
+        validateOptionalTargetKey(target.accountGovernanceTargetKey, target.accountGovernance !== undefined, 'target.accountGovernanceTargetKey');
+        stringArray(target.serviceRetirementRegions, 'target.serviceRetirementRegions');
+        validateCommitmentAnalysisTarget(target.commitmentAnalysis);
+        validateReliabilityTarget(target.reliability);
+        validateAccountGovernanceTarget(target.accountGovernance);
+    }
+    else {
+        assertExactKeys(target, [
+            'kind',
+            'provider',
+            'accountId',
+            'targetKey',
+            'targetKeySha256',
+            'resourceCollectionTargetKey',
+            'recommendationsTargetKey',
+            'billing',
+            'resourceRegions',
+            'metricTimeWindow',
+            'tagRuleScope',
+            'selector',
+            'stableKey',
+            'stableKeySha256',
+            'relationshipTargetKey',
+            'serviceRetirementTargetKey',
+            'recommendationScopes',
+        ], 'target');
+        validateTagRuleScope(target.tagRuleScope);
+        requiredString(target.resourceCollectionTargetKey, 'target.resourceCollectionTargetKey');
+        requiredString(target.recommendationsTargetKey, 'target.recommendationsTargetKey');
+        validateSelector(target.selector, 'target.selector');
+        const stableKey = requiredString(target.stableKey, 'target.stableKey');
+        if (asRecord(target.selector, 'target.selector').kind === 'stable-key') {
+            assertValue(asRecord(target.selector, 'target.selector').stableKey, stableKey, 'target.selector.stableKey');
+        }
+        sha256(target.stableKeySha256, 'target.stableKeySha256');
+        assertValue(target.stableKeySha256, sha256AwsPluginIdentity(stableKey), 'target.stableKeySha256');
+        requiredString(target.relationshipTargetKey, 'target.relationshipTargetKey');
+        requiredString(target.serviceRetirementTargetKey, 'target.serviceRetirementTargetKey');
+    }
+    return value;
+}
+function validateOptionalTargetKey(value, required, field) {
+    if (required)
+        requiredString(value, field);
+    else if (value !== undefined)
+        throw new Error(`${field} requires its corresponding optional target.`);
+}
+function validateCommitmentAnalysisTarget(value) {
+    if (value === undefined)
+        return;
+    const target = asRecord(value, 'target.commitmentAnalysis');
+    assertExactKeys(target, ['resourceRegions', 'maxBenefitEntries'], 'target.commitmentAnalysis');
+    stringArray(target.resourceRegions, 'target.commitmentAnalysis.resourceRegions');
+    if (!Number.isSafeInteger(target.maxBenefitEntries) || Number(target.maxBenefitEntries) <= 0) {
+        throw new Error('target.commitmentAnalysis.maxBenefitEntries must be a positive safe integer.');
+    }
+}
+function validateReliabilityTarget(value) {
+    if (value === undefined)
+        return;
+    const target = asRecord(value, 'target.reliability');
+    assertExactKeys(target, ['includeTemplateContent', 'includeScoring', 'maxResultsPerSection', 'sectionScopeKeys'], 'target.reliability');
+    if (target.includeTemplateContent !== undefined)
+        assertValue(target.includeTemplateContent, true, 'target.reliability.includeTemplateContent');
+    if (target.includeScoring !== undefined)
+        assertValue(target.includeScoring, true, 'target.reliability.includeScoring');
+    if (!Number.isSafeInteger(target.maxResultsPerSection) || Number(target.maxResultsPerSection) <= 0) {
+        throw new Error('target.reliability.maxResultsPerSection must be a positive safe integer.');
+    }
+    stringArray(target.sectionScopeKeys, 'target.reliability.sectionScopeKeys');
+}
+function validateAccountGovernanceTarget(value) {
+    if (value === undefined)
+        return;
+    const target = asRecord(value, 'target.accountGovernance');
+    assertExactKeys(target, ['apiRegion'], 'target.accountGovernance');
+    requiredString(target.apiRegion, 'target.accountGovernance.apiRegion');
+}
+function validateRecommendationScopes(value, accountId) {
+    if (!Array.isArray(value))
+        throw new Error('target.recommendationScopes must be an array.');
+    const scopes = value;
+    scopes.forEach((value, index) => {
+        const field = `target.recommendationScopes[${index}]`;
+        const scope = asRecord(value, field);
+        assertExactKeys(scope, ['source', 'scope', 'accountId', 'scopeDiscriminator', 'computeOptimizerFamily', 'resourceRegions', 'targetKey', 'actionabilityTargetKey'], field);
+        requiredEnum(scope.source, ['custom', 'compute-optimizer', 'cost-optimization-hub', 'resilience-hub', 'security-hub', 'trusted-advisor', 'well-architected'], `${field}.source`);
+        assertValue(scope.scope, 'account', `${field}.scope`);
+        assertAccount(scope.accountId, accountId, `${field}.accountId`);
+        if (scope.scopeDiscriminator !== undefined)
+            requiredString(scope.scopeDiscriminator, `${field}.scopeDiscriminator`);
+        if (scope.computeOptimizerFamily !== undefined)
+            requiredString(scope.computeOptimizerFamily, `${field}.computeOptimizerFamily`);
+        stringArray(scope.resourceRegions, `${field}.resourceRegions`);
+        requiredString(scope.targetKey, `${field}.targetKey`);
+        requiredString(scope.actionabilityTargetKey, `${field}.actionabilityTargetKey`);
+    });
+}

package/dist/esm/aws/pluginPublicArtifactEvidence.js

@@ -0,0 +1 @@
+export {};