@spottoai/types-package 1.0.2-beta.360 → 1.0.2-beta.364

package/dist/esm/common/artifactControlData.js

@@ -15,6 +15,7 @@ const FORBIDDEN_SENSITIVE_FIELDS = new Set([
     'sharedaccesssignature',
     'token',
 ]);
+const FORBIDDEN_PROTOTYPE_FIELDS = new Set(['proto', 'prototype', 'constructor']);
 const PHYSICAL_REFERENCE_FIELDS = new Set([
     'artifactpath',
     'blobpath',
@@ -43,13 +44,16 @@ const PHYSICAL_REFERENCE_FIELDS = new Set([
 ]);
 const PERCENT_ENCODED_BYTE_PATTERN = /%[0-9A-Fa-f]{2}/;
 const URI_SCHEME_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+const SHA256_PATTERN = /^[0-9A-Fa-f]{64}$/;
+export const ARTIFACT_CONTROL_DATA_MAX_VISITED_NODES = 100000;
 const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 const hasControlCharacters = (value) => Array.from(value).some(character => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
 const normalizeFieldName = (key) => key.replace(/[-_\s]/g, '').toLowerCase();
 const hasDotTraversal = (value) => value.split(/[\\/]/).some(segment => segment === '.' || segment === '..');
-const isForbiddenReferenceValue = (value, allowUriScheme = false) => hasControlCharacters(value) ||
+const isForbiddenReferenceValue = (value, allowUriScheme = false, allowDigestLike = false, rejectDigestLikeValues = false) => hasControlCharacters(value) ||
     PERCENT_ENCODED_BYTE_PATTERN.test(value) ||
     (!allowUriScheme && URI_SCHEME_PATTERN.test(value)) ||
+    (rejectDigestLikeValues && !allowDigestLike && SHA256_PATTERN.test(value)) ||
     value.startsWith('/') ||
     value.startsWith('\\\\') ||
     /^[A-Za-z]:[\\/]/.test(value) ||
@@ -69,27 +73,128 @@ const isSafeAzureResourceId = (key, value) => {
 export const allowedArtifactReferenceField = (object, key) => isRecord(object) ? [{ object, key }] : [];
 /** Marks a structurally validated identity field whose value is allowed by its owning schema. */
 export const allowedArtifactIdentityField = (object, key) => isRecord(object) ? [{ object, key, allowUriScheme: true }] : [];
-/** Rejects exact normalized sensitive fields and physical-reference control data recursively. */
-export const containsForbiddenArtifactControlData = (value, allowedReferenceFields = []) => {
-    if (typeof value === 'string')
-        return isForbiddenReferenceValue(value);
-    if (Array.isArray(value))
-        return value.some(child => containsForbiddenArtifactControlData(child, allowedReferenceFields));
-    if (!isRecord(value))
-        return false;
-    return Object.entries(value).some(([key, child]) => {
-        if (hasControlCharacters(key))
-            return true;
-        const normalizedKey = normalizeFieldName(key);
-        if (FORBIDDEN_SENSITIVE_FIELDS.has(normalizedKey))
+/** Marks an exact schema edge whose descendants may use object-indexed field allowances. */
+export const allowedArtifactTraversalField = (object, key) => isRecord(object) ? [{ object, key, allowChildArtifactFields: true }] : [];
+const indexAllowedArtifactFields = (allowedReferenceFields) => {
+    const index = new WeakMap();
+    for (const field of allowedReferenceFields) {
+        let objectFields = index.get(field.object);
+        if (!objectFields) {
+            objectFields = new Map();
+            index.set(field.object, objectFields);
+        }
+        const existing = objectFields.get(field.key);
+        objectFields.set(field.key, {
+            object: field.object,
+            key: field.key,
+            allowUriScheme: existing?.allowUriScheme || field.allowUriScheme,
+            allowUriSchemeInStringArray: existing?.allowUriSchemeInStringArray || field.allowUriSchemeInStringArray,
+            allowDigestLike: existing?.allowDigestLike || field.allowDigestLike,
+            allowControlField: existing?.allowControlField || field.allowControlField,
+            allowChildArtifactFields: existing?.allowChildArtifactFields || field.allowChildArtifactFields,
+        });
+    }
+    return index;
+};
+const containsForbiddenArtifactControlDataWithIndex = (value, allowedReferenceFields, options) => {
+    const pending = [{ kind: 'visit', value, allowIndexedFields: true }];
+    const activeContainers = new WeakSet();
+    const completedScanPolicies = new WeakMap();
+    let visitedNodeCount = 0;
+    const hasCompletedStricterScan = (container, scanPolicy) => completedScanPolicies.get(container)?.some(completedPolicy => (completedPolicy & scanPolicy) === completedPolicy) ?? false;
+    const completeScan = (container, scanPolicy) => {
+        const completedPolicies = completedScanPolicies.get(container) ?? [];
+        if (completedPolicies.some(completedPolicy => (completedPolicy & scanPolicy) === completedPolicy))
+            return;
+        completedScanPolicies.set(container, [...completedPolicies.filter(completedPolicy => (scanPolicy & completedPolicy) !== scanPolicy), scanPolicy]);
+    };
+    while (pending.length > 0) {
+        const candidate = pending.pop();
+        if (candidate.kind === 'leave') {
+            activeContainers.delete(candidate.container);
+            completeScan(candidate.container, candidate.scanPolicy);
+            continue;
+        }
+        if (typeof candidate.value === 'string') {
+            if (isForbiddenReferenceValue(candidate.value, false, false, options.rejectDigestLikeValues))
+                return true;
+            continue;
+        }
+        if (Array.isArray(candidate.value)) {
+            visitedNodeCount += 1;
+            if (visitedNodeCount > ARTIFACT_CONTROL_DATA_MAX_VISITED_NODES)
+                return true;
+            if (activeContainers.has(candidate.value))
+                return true;
+            const scanPolicy = (candidate.allowIndexedFields ? 1 : 0) |
+                (candidate.allowedStringArrayField ? 2 : 0) |
+                (candidate.allowedStringArrayField?.allowDigestLike ? 4 : 0);
+            if (hasCompletedStricterScan(candidate.value, scanPolicy))
+                continue;
+            activeContainers.add(candidate.value);
+            pending.push({ kind: 'leave', container: candidate.value, scanPolicy });
+            for (let index = candidate.value.length - 1; index >= 0; index -= 1) {
+                const child = candidate.value[index];
+                if (candidate.allowedStringArrayField && typeof child === 'string') {
+                    if (isForbiddenReferenceValue(child, true, candidate.allowedStringArrayField.allowDigestLike, options.rejectDigestLikeValues)) {
+                        return true;
+                    }
+                }
+                else {
+                    pending.push({ kind: 'visit', value: child, allowIndexedFields: candidate.allowIndexedFields });
+                }
+            }
+            continue;
+        }
+        if (!isRecord(candidate.value))
+            continue;
+        visitedNodeCount += 1;
+        if (visitedNodeCount > ARTIFACT_CONTROL_DATA_MAX_VISITED_NODES)
             return true;
-        const allowedField = allowedReferenceFields.find(field => field.object === value && field.key === key);
-        if (allowedField?.allowUriScheme && typeof child === 'string')
-            return isForbiddenReferenceValue(child, true);
-        if (PHYSICAL_REFERENCE_FIELDS.has(normalizedKey) && !allowedField)
+        if (activeContainers.has(candidate.value))
             return true;
-        if (isSafeAzureResourceId(key, child))
-            return false;
-        return containsForbiddenArtifactControlData(child, allowedReferenceFields);
-    });
+        const scanPolicy = candidate.allowIndexedFields ? 1 : 0;
+        if (hasCompletedStricterScan(candidate.value, scanPolicy))
+            continue;
+        activeContainers.add(candidate.value);
+        pending.push({ kind: 'leave', container: candidate.value, scanPolicy });
+        for (const [key, child] of Object.entries(candidate.value)) {
+            if (hasControlCharacters(key))
+                return true;
+            const normalizedKey = normalizeFieldName(key);
+            if (FORBIDDEN_PROTOTYPE_FIELDS.has(normalizedKey))
+                return true;
+            if (FORBIDDEN_SENSITIVE_FIELDS.has(normalizedKey))
+                return true;
+            const allowedField = candidate.allowIndexedFields ? allowedReferenceFields.get(candidate.value)?.get(key) : undefined;
+            if (options.forbiddenControlFields?.has(normalizedKey) && !allowedField?.allowControlField)
+                return true;
+            if (options.requireSafeAzureResourceIds && normalizedKey === 'resourceid') {
+                if (!isSafeAzureResourceId(key, child))
+                    return true;
+                continue;
+            }
+            if (allowedField && typeof child === 'string' && (allowedField.allowUriScheme || allowedField.allowDigestLike)) {
+                if (isForbiddenReferenceValue(child, allowedField.allowUriScheme, allowedField.allowDigestLike, options.rejectDigestLikeValues))
+                    return true;
+                continue;
+            }
+            if (allowedField?.allowUriSchemeInStringArray && Array.isArray(child)) {
+                pending.push({ kind: 'visit', value: child, allowedStringArrayField: allowedField });
+                continue;
+            }
+            if (PHYSICAL_REFERENCE_FIELDS.has(normalizedKey) && !allowedField)
+                return true;
+            if (isSafeAzureResourceId(key, child))
+                continue;
+            pending.push({
+                kind: 'visit',
+                value: child,
+                allowIndexedFields: !options.requireAllowedFieldTraversalContext || Boolean(candidate.allowIndexedFields && allowedField?.allowChildArtifactFields),
+            });
+        }
+    }
+    return false;
 };
+/** Rejects normalized sensitive fields and physical-reference control data with bounded traversal. */
+export const containsForbiddenArtifactControlData = (value, allowedReferenceFields = [], options = {}) => containsForbiddenArtifactControlDataWithIndex(value, indexAllowedArtifactFields(allowedReferenceFields), options);

package/dist/esm/index.js

@@ -5,6 +5,7 @@ export * from './azure/activityLogs.js';
 export * from './azure/budgets.js';
 export * from './azure/billingGeneration.js';
 export * from './azure/billingArtifactGeneration.js';
+export * from './azure/billingArtifactLimits.js';
 export * from './azure/billingArtifactCanonicalization.js';
 export * from './azure/billingPlots.js';
 export * from './azure/benefits.js';

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export * from './azure/activityLogs';
 export * from './azure/budgets';
 export * from './azure/billingGeneration';
 export * from './azure/billingArtifactGeneration';
+export * from './azure/billingArtifactLimits';
 export * from './azure/billingArtifactCanonicalization';
 export * from './azure/billingPlots';
 export * from './azure/benefits';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mCAAmC,CAAC;AAClD,cAAc,yCAAyC,CAAC;AACxD,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,MAAM,CAAC;AACrB,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,QAAQ,CAAC;AACvB,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mCAAmC,CAAC;AAClD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yCAAyC,CAAC;AACxD,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,OAAO,CAAC;AACtB,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,2BAA2B,CAAC;AAC1C,cAAc,WAAW,CAAC;AAC1B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,MAAM,CAAC;AACrB,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,QAAQ,CAAC;AACvB,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -21,6 +21,7 @@ __exportStar(require("./azure/activityLogs"), exports);
 __exportStar(require("./azure/budgets"), exports);
 __exportStar(require("./azure/billingGeneration"), exports);
 __exportStar(require("./azure/billingArtifactGeneration"), exports);
+__exportStar(require("./azure/billingArtifactLimits"), exports);
 __exportStar(require("./azure/billingArtifactCanonicalization"), exports);
 __exportStar(require("./azure/billingPlots"), exports);
 __exportStar(require("./azure/benefits"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iEAAiE;AACjE,iDAA+B;AAC/B,0DAAwC;AACxC,uDAAqC;AACrC,kDAAgC;AAChC,4DAA0C;AAC1C,oEAAkD;AAClD,0EAAwD;AACxD,uDAAqC;AACrC,mDAAiC;AACjC,8DAA4C;AAC5C,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,mDAAiC;AACjC,0DAAwC;AACxC,yDAAuC;AACvC,iDAA+B;AAC/B,wDAAsC;AACtC,0DAAwC;AACxC,+DAA6C;AAC7C,8DAA4C;AAC5C,iEAA+C;AAC/C,8DAA4C;AAC5C,+DAA6C;AAC7C,oDAAkC;AAClC,kDAAgC;AAChC,6DAA2C;AAC3C,0DAAwC;AACxC,uDAAqC;AACrC,yDAAuC;AACvC,wDAAsC;AACtC,gDAA8B;AAC9B,mDAAiC;AACjC,4DAA0C;AAC1C,iEAA+C;AAC/C,0EAAwD;AACxD,+DAA6C;AAC7C,4DAA0C;AAC1C,qDAAmC;AACnC,4DAA0C;AAC1C,yDAAuC;AACvC,wCAAsB;AACtB,6CAA2B;AAC3B,gDAA8B;AAC9B,0CAAwB;AACxB,2CAAyB;AACzB,4DAA0C;AAC1C,4CAA0B;AAC1B,qDAAmC;AACnC,8CAA4B;AAC5B,uCAAqB;AACrB,2CAAyB;AACzB,iDAA+B;AAC/B,6CAA2B;AAC3B,6DAA2C;AAC3C,yCAAuB;AACvB,8CAA4B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iEAAiE;AACjE,iDAA+B;AAC/B,0DAAwC;AACxC,uDAAqC;AACrC,kDAAgC;AAChC,4DAA0C;AAC1C,oEAAkD;AAClD,gEAA8C;AAC9C,0EAAwD;AACxD,uDAAqC;AACrC,mDAAiC;AACjC,8DAA4C;AAC5C,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,mDAAiC;AACjC,0DAAwC;AACxC,yDAAuC;AACvC,iDAA+B;AAC/B,wDAAsC;AACtC,0DAAwC;AACxC,+DAA6C;AAC7C,8DAA4C;AAC5C,iEAA+C;AAC/C,8DAA4C;AAC5C,+DAA6C;AAC7C,oDAAkC;AAClC,kDAAgC;AAChC,6DAA2C;AAC3C,0DAAwC;AACxC,uDAAqC;AACrC,yDAAuC;AACvC,wDAAsC;AACtC,gDAA8B;AAC9B,mDAAiC;AACjC,4DAA0C;AAC1C,iEAA+C;AAC/C,0EAAwD;AACxD,+DAA6C;AAC7C,4DAA0C;AAC1C,qDAAmC;AACnC,4DAA0C;AAC1C,yDAAuC;AACvC,wCAAsB;AACtB,6CAA2B;AAC3B,gDAA8B;AAC9B,0CAAwB;AACxB,2CAAyB;AACzB,4DAA0C;AAC1C,4CAA0B;AAC1B,qDAAmC;AACnC,8CAA4B;AAC5B,uCAAqB;AACrB,2CAAyB;AACzB,iDAA+B;AAC/B,6CAA2B;AAC3B,6DAA2C;AAC3C,yCAAuB;AACvB,8CAA4B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spottoai/types-package",
-  "version": "1.0.2-beta.360",
+  "version": "1.0.2-beta.364",
   "description": "Shared TypeScript interfaces for SpottoAI",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -65,6 +65,8 @@
     "dev": "tsc --watch",
     "clean": "rimraf dist",
     "check:artifact-evidence-contracts": "node scripts/check-artifact-evidence-contracts.mjs",
+    "check:billing-artifact-object-boundaries": "node scripts/check-billing-artifact-object-boundaries.mjs",
+    "check:billing-cost-analysis-read-responses": "node scripts/check-billing-cost-analysis-read-responses.mjs",
     "check:packed-exports": "node scripts/check-packed-aws-exports.mjs",
     "check:aws-examples": "node scripts/check-aws-example-identifiers.mjs",
     "check:plugin-public-artifacts": "node scripts/check-plugin-public-artifacts.mjs",
@@ -74,7 +76,7 @@
     "check:capability-passport-contracts": "node scripts/check-capability-passport-contracts.mjs",
     "check:commitments-planning": "node scripts/check-commitments-planning.mjs",
     "prepublishOnly": "npm run clean && npm run build && npm test",
-    "test": "npm run build && npm run check:artifact-evidence-contracts && npm run check:aws-examples && npm run check:plugin-public-artifacts && npm run check:portal-public-artifacts && npm run check:relationship-public-artifacts && npm run check:azure-view-set-contracts && npm run check:capability-passport-contracts && npm run check:commitments-planning && npm run check:packed-exports",
+    "test": "npm run build && npm run check:artifact-evidence-contracts && npm run check:billing-artifact-object-boundaries && npm run check:billing-cost-analysis-read-responses && npm run check:aws-examples && npm run check:plugin-public-artifacts && npm run check:portal-public-artifacts && npm run check:relationship-public-artifacts && npm run check:azure-view-set-contracts && npm run check:capability-passport-contracts && npm run check:commitments-planning && npm run check:packed-exports",
     "lint": "eslint src --ext .ts",
     "lint:fix": "eslint src --ext .ts --fix",
     "format": "prettier --write \"src/**/*.{ts,js,json}\"",