@spottoai/types-package 1.0.2-beta.43 → 1.0.2-beta.430

package/dist/accounts/accounts.d.ts

@@ -1,10 +1,433 @@
 import { SurveyResponse } from '../company';
-export interface CloudAccount {
+import type { EffortEstimateProfileName } from '../azure/recommendations';
+import type { SecureScoreEvidence } from '../azure/secureScore';
+import type { AwsEstateAccountPurpose } from '../aws/estates';
+import type { AwsForbiddenCredentialFields } from '../aws/requests';
+import type { EnvironmentType, ProviderScopeDisplayMetadata } from '../common/provider';
+import type { SyncProgressIssue, SyncProgressStatus, SyncProgressStepStatus, SyncProgressSubStepStatus } from '../common/syncProgress';
+import type { AzureSpSetupErrorCode, AzureSpSetupPhase, AzureSpSetupProvisioningStatus, AzureSpSetupReaderReadiness, AzureSpSetupReaderReadinessSource, AzureSpSetupResult } from './azureSpSetup';
+import type { AzureBillingExportConfigurationInput, AzureBillingExportConfigurationStatus, AzureBillingExportDatasetType, AzureBillingExportScopeType } from './azureManualOnboarding';
+export type { SyncProgressIssue, SyncProgressIssueMetadataValue, SyncProgressIssueScope, SyncProgressIssueType } from '../common/syncProgress';
+/** Azure compatibility alias for the provider-neutral environment classification. */
+export type SubscriptionType = EnvironmentType;
+export type ScheduledScanSlot = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11;
+export type CloudAccountAuthMode = 'servicePrincipal' | 'delegatedUser' | 'gdap' | 'crossAccountRole';
+export type CloudAccountTenantSyncSource = 'manual' | 'scheduled' | 'onboarding';
+export type CloudAccountTenantSyncStatus = 'Idle' | 'Requested' | 'Processing' | 'Completed' | 'Error';
+export type CloudAccountFirstSyncNotificationStatus = 'Pending' | 'Sending' | 'Sent' | 'Error';
+/** Scope vocabulary used by the legacy unversioned cloud-engine locator. */
+export type BillingExportLocatorScopeType = 'tenant' | 'billingAccount';
+export type AzureGdapRelationshipStatus = 'unknown' | 'created' | 'approvalPending' | 'active' | 'terminated' | 'expired';
+export type AzureGdapAccessAssignmentStatus = 'unknown' | 'pending' | 'active' | 'deleting' | 'deleted' | 'error';
+export type AzureGdapValidationStatus = 'notValidated' | 'ready' | 'degraded' | 'blocked' | 'expired' | 'reauthRequired';
+export type AzureGdapCapabilityKey = 'partnerAuthorization' | 'relationship' | 'accessAssignment' | 'appConsent' | 'armAppConsent' | 'subscriptionDiscovery' | 'resourceInventory' | 'resourceGraph' | 'costRead' | 'partnerBillingCostRead' | 'billingExportSetup' | 'monitoringRead' | 'graphInventory' | 'scheduledScan';
+export type AzureGdapCapabilityStatusValue = 'ready' | 'degraded' | 'blocked' | 'unsupported' | 'notChecked';
+/** Stable remediation categories for GDAP capability failures. Provider response text must never be placed here. */
+export type AzureGdapCapabilityReasonCode = 'graph_consent_required' | 'graph_token_interaction_required' | 'graph_token_request_failed' | 'graph_request_unauthorized' | 'graph_request_forbidden' | 'arm_consent_required' | 'arm_token_interaction_required' | 'arm_token_request_failed' | 'arm_request_unauthorized' | 'arm_request_forbidden' | 'no_readable_subscriptions' | 'microsoft_throttled' | 'microsoft_unavailable' | 'microsoft_timeout' | 'microsoft_invalid_response' | 'microsoft_client_configuration_invalid';
+export interface AzureGdapCapabilityStatus {
+    key: AzureGdapCapabilityKey;
+    status: AzureGdapCapabilityStatusValue;
+    reason?: string;
+    reasonCode?: AzureGdapCapabilityReasonCode;
+    checkedAt?: string;
+    requiredRoles?: string[];
+    requiredAzureRoles?: string[];
+}
+/** Internal CSP partner billing scope used for customer-scope Cost Management queries. */
+export interface AzureCspPartnerBillingScope {
+    billingAccountId: string;
+    customerId: string;
+    scopePath: string;
+    validatedAt: string;
+}
+export interface AzureGdapRoleAssignment {
+    roleId?: string;
+    roleTemplateId?: string;
+    displayName: string;
+}
+/** Non-secret lifecycle details for the customer-specific GDAP relationship used by a child cloud account. */
+export interface AzureGdapRelationshipLifecycle {
+    relationshipId: string;
+    customerTenantId: string;
+    status: AzureGdapRelationshipStatus;
+    displayName?: string;
+    accessAssignmentId?: string;
+    accessAssignmentStatus?: AzureGdapAccessAssignmentStatus;
+    securityGroupId?: string;
+    securityGroupDisplayName?: string;
+    roles?: AzureGdapRoleAssignment[];
+    expiresAt?: string;
+    autoExtendEnabled?: boolean;
+}
+/** Readable Azure subscription offered for explicit selection during child-company GDAP setup. */
+export interface AzureGdapSubscriptionOption {
+    subscriptionId: string;
+    displayName: string;
+    tenantId: string;
+    state?: string;
+}
+export interface AzureGdapCloudAccountMetadata {
+    gdapAuthorizationCompanyId?: string;
+    gdapAuthorizationProfileId?: string;
+    gdapPartnerTenantId: string;
+    gdapCustomerTenantId: string;
+    gdapRelationshipId: string;
+    gdapRelationshipDisplayName?: string;
+    gdapRelationshipStatus?: AzureGdapRelationshipStatus;
+    gdapAccessAssignmentId?: string;
+    gdapAccessAssignmentStatus?: AzureGdapAccessAssignmentStatus;
+    gdapSecurityGroupId?: string;
+    gdapSecurityGroupDisplayName?: string;
+    gdapRoles?: AzureGdapRoleAssignment[];
+    gdapExpiresAt?: string;
+    gdapAutoExtendEnabled?: boolean;
+    gdapPartnerAuthorizationStatus?: AzureGdapValidationStatus;
+    gdapAppConsentStatus?: AzureGdapValidationStatus;
+    gdapLastValidatedAt?: string;
+    gdapLastValidationStatus?: AzureGdapValidationStatus;
+    gdapLastValidationErrorCode?: string;
+    gdapLastValidationMessage?: string;
+    gdapScheduledEligible?: boolean;
+    gdapScheduledEligibilityReason?: string;
+    gdapCapabilities?: AzureGdapCapabilityStatus[];
+    /** Internal partner billing scope. Do not expose billing account/customer identifiers in public API DTOs. */
+    cspPartnerBillingScope?: AzureCspPartnerBillingScope;
+}
+export interface AzureCloudAccountAuthContext {
+    authMode?: CloudAccountAuthMode;
+    cloudAccountId: string;
+    gdapAuthorizationCompanyId?: string;
+    gdapAuthorizationProfileId?: string;
+    customerTenantId?: string;
+    authorityTenantId?: string;
+    partnerTenantId?: string;
+    principalClientId?: string;
+    credentialReference?: string;
+}
+export interface AzureGdapAuthorizationProfileSummary {
+    id: string;
+    companyId: string;
+    displayName: string;
+    partnerTenantId: string;
+    authorizationStatus: AzureGdapValidationStatus;
+    hasCredential: boolean;
+    authorizedAt?: string;
+    expiresAt?: string;
+    lastValidatedAt?: string;
+    lastValidationStatus?: AzureGdapValidationStatus;
+    lastValidationErrorCode?: string;
+    lastValidationMessage?: string;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface AzureGdapAuthorizationProfileListResponse {
+    profiles: AzureGdapAuthorizationProfileSummary[];
+}
+export interface AzureGdapEligibleAuthorizationProfilesResponse {
+    rootCompanyId: string;
+    profiles: AzureGdapAuthorizationProfileSummary[];
+}
+export interface AzureGdapCreateAuthorizationProfileRequest {
+    displayName?: string;
+    partnerTenantId?: string;
+}
+export interface AzureGdapStartPartnerAuthorizationRequest {
+    redirectAfter?: string;
+}
+export interface AzureGdapPartnerAuthorizationStartResponse {
+    profileId: string;
+    authorizationUrl: string;
+    expiresAt: string;
+}
+export interface AzureGdapDraftValidationRequest {
+    gdapAuthorizationCompanyId?: string;
+    gdapAuthorizationProfileId?: string;
+    gdapPartnerTenantId?: string;
+    gdapCustomerTenantId?: string;
+    tenantId?: string;
+    gdapRelationshipId?: string;
+    gdapAccessAssignmentId?: string;
+    gdapSecurityGroupId?: string;
+}
+interface AzureGdapDraftValidationResponseBase {
+    status: AzureGdapValidationStatus;
+    profile?: AzureGdapAuthorizationProfileSummary;
+    capabilities: AzureGdapCapabilityStatus[];
+    customerTenantId?: string;
+    appConsentStatus?: AzureGdapValidationStatus;
+    relationship?: AzureGdapRelationshipLifecycle;
+    message?: string;
+}
+export interface AzureGdapReadyDraftValidationResponse extends AzureGdapDraftValidationResponseBase {
+    valid: true;
+    status: 'ready';
+    customerTenantId: string;
+    appConsentStatus: 'ready';
+    relationship: AzureGdapRelationshipLifecycle;
+    subscriptions: AzureGdapSubscriptionOption[];
+    /** Opaque, short-lived proof that the API must validate when creating the child cloud account. */
+    validationReceipt: string;
+    validationExpiresAt: string;
+}
+export interface AzureGdapUnreadyDraftValidationResponse extends AzureGdapDraftValidationResponseBase {
+    valid: false;
+    status: Exclude<AzureGdapValidationStatus, 'ready'>;
+    subscriptions?: AzureGdapSubscriptionOption[];
+}
+export type AzureGdapDraftValidationResponse = AzureGdapReadyDraftValidationResponse | AzureGdapUnreadyDraftValidationResponse;
+export interface AzureGdapCloudAccountStatusResponse {
+    cloudAccountId: string;
+    companyId: string;
+    status: AzureGdapValidationStatus;
+    customerTenantId?: string;
+    partnerAuthorizationStatus?: AzureGdapValidationStatus;
+    appConsentStatus?: AzureGdapValidationStatus;
+    lastValidatedAt?: string | Date;
+    lastValidationStatus?: AzureGdapValidationStatus;
+    lastValidationErrorCode?: string;
+    lastValidationMessage?: string;
+    scheduledEligible?: boolean;
+    scheduledEligibilityReason?: string;
+    capabilities?: AzureGdapCapabilityStatus[];
+    relationship?: AzureGdapRelationshipLifecycle;
+    subscriptions?: AzureGdapSubscriptionOption[];
+}
+export interface AzureGdapCloudAccountCreateRequest {
     companyId: string;
+    name: string;
+    provider: 'Azure';
+    authMode: 'gdap';
+    tenantId: string;
+    gdapCustomerTenantId: string;
+    gdapPartnerTenantId: string;
+    gdapRelationshipId: string;
+    gdapAccessAssignmentId?: string;
+    gdapSecurityGroupId?: string;
+    gdapAuthorizationCompanyId: string;
+    gdapAuthorizationProfileId: string;
+    subscriptionIds: string[];
+    /** Opaque proof returned by a successful customer-scoped GDAP draft validation. */
+    validationReceipt: string;
+}
+export interface BillingExportLocatorEntry {
+    scopeType: BillingExportLocatorScopeType;
+    scopePath: string;
+    exportName: string;
+    storageAccountName: string;
+    container: string;
+    rootFolderPath: string;
+}
+export interface CloudAccountBillingExportLocator {
+    actual?: BillingExportLocatorEntry;
+    amortized?: BillingExportLocatorEntry;
+}
+/** Resolved storage locator for one source in the versioned cloud-account collection. */
+export interface BillingExportLocatorSource {
+    datasetType: AzureBillingExportDatasetType;
+    scopeType: AzureBillingExportScopeType;
+    scopePath: string;
+    exportName: string;
+    storageAccountName: string;
+    container: string;
+    rootFolderPath: string;
+}
+export declare const CLOUD_ACCOUNT_BILLING_EXPORT_LOCATOR_SCHEMA_VERSION: 1;
+/** Preferred persisted locator shape for one or more Azure billing export sources. */
+export interface CloudAccountBillingExportLocatorV1 {
+    schemaVersion: typeof CLOUD_ACCOUNT_BILLING_EXPORT_LOCATOR_SCHEMA_VERSION;
+    sources: [BillingExportLocatorSource, ...BillingExportLocatorSource[]];
+}
+/** Accepts legacy persisted records while cloud-engine and API migrate to the source collection. */
+export type CloudAccountBillingExportLocatorConfiguration = CloudAccountBillingExportLocator | CloudAccountBillingExportLocatorV1;
+export declare const AZURE_SYNC_FEATURE_ORDER: readonly ["activityMonitoring", "metrics", "billing", "pricing", "costEstimation", "commitments", "relationshipGraphs", "governance", "availabilityZones", "reliability", "perimeterInsights", "reportEvidencePack"];
+export type AzureSyncFeatureId = (typeof AZURE_SYNC_FEATURE_ORDER)[number];
+export type AzureSyncFeatureConfigurationScope = 'cloudAccount' | 'subscription';
+export interface AzureSyncFeatureMetadata {
+    id: AzureSyncFeatureId;
+    displayName: string;
+    description: string;
+    supportedScopes: readonly AzureSyncFeatureConfigurationScope[];
+    warning?: string;
+}
+export declare const AZURE_SYNC_FEATURE_METADATA: readonly [{
+    readonly id: "activityMonitoring";
+    readonly displayName: "Activity monitoring";
+    readonly description: "Collects Azure activity logs and activity-derived operational events.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+    readonly warning: "Disabling activity monitoring prevents activity log collection and related detections.";
+}, {
+    readonly id: "metrics";
+    readonly displayName: "Metrics";
+    readonly description: "Collects subscription resource metrics used for utilization and rightsizing insights.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}, {
+    readonly id: "billing";
+    readonly displayName: "Billing";
+    readonly description: "Collects billing and cost usage data.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}, {
+    readonly id: "pricing";
+    readonly displayName: "Pricing";
+    readonly description: "Collects Azure price data used for cost calculations.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}, {
+    readonly id: "costEstimation";
+    readonly displayName: "Cost estimation";
+    readonly description: "Builds estimated costs when billing-backed usage is unavailable or incomplete.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}, {
+    readonly id: "commitments";
+    readonly displayName: "Reservations and commitments";
+    readonly description: "Collects reserved instances, savings plans, and commitment utilization data.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}, {
+    readonly id: "relationshipGraphs";
+    readonly displayName: "Relationship graphs";
+    readonly description: "Builds relationship graph artifacts from scanned Azure resources.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}, {
+    readonly id: "governance";
+    readonly displayName: "Governance";
+    readonly description: "Builds tenant and subscription governance reports and graph artifacts.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}, {
+    readonly id: "availabilityZones";
+    readonly displayName: "Availability zones";
+    readonly description: "Collects tenant-level availability zone mappings.";
+    readonly supportedScopes: readonly ["cloudAccount"];
+}, {
+    readonly id: "reliability";
+    readonly displayName: "Reliability";
+    readonly description: "Collects reliability signals and recommendations for subscription resources.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}, {
+    readonly id: "perimeterInsights";
+    readonly displayName: "Perimeter insights";
+    readonly description: "Builds public IP and perimeter exposure insights.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}, {
+    readonly id: "reportEvidencePack";
+    readonly displayName: "Report evidence pack";
+    readonly description: "Builds evidence artifacts used by reports and review workflows.";
+    readonly supportedScopes: readonly ["cloudAccount", "subscription"];
+}];
+type AzureSyncFeatureMetadataEntry = (typeof AZURE_SYNC_FEATURE_METADATA)[number];
+type AzureSyncFeatureIdsForScope<Scope extends AzureSyncFeatureConfigurationScope> = AzureSyncFeatureMetadataEntry extends infer Feature ? Feature extends {
+    id: AzureSyncFeatureId;
+    supportedScopes: readonly AzureSyncFeatureConfigurationScope[];
+} ? Scope extends Feature['supportedScopes'][number] ? Feature['id'] : never : never : never;
+export type AzureCloudAccountSyncFeatureId = AzureSyncFeatureIdsForScope<'cloudAccount'>;
+export type AzureSubscriptionSyncFeatureId = AzureSyncFeatureIdsForScope<'subscription'>;
+export declare const isAzureSyncFeatureId: (value: string) => value is AzureSyncFeatureId;
+export declare const getAzureSyncFeatureMetadata: (featureId: AzureSyncFeatureId) => AzureSyncFeatureMetadata;
+export declare const isAzureSyncFeatureSupportedInScope: (featureId: AzureSyncFeatureId, scope: AzureSyncFeatureConfigurationScope) => boolean;
+export declare const sortAzureSyncFeatureIds: (featureIds: readonly AzureSyncFeatureId[]) => AzureSyncFeatureId[];
+export declare const getAzureSyncFeatureOptions: (scope: AzureSyncFeatureConfigurationScope) => AzureSyncFeatureMetadata[];
+export declare const getAzureSyncFeatureIdsForScope: (scope: AzureSyncFeatureConfigurationScope) => AzureSyncFeatureId[];
+export interface CloudAccountSyncFeatureOptOutsUpdateRequest {
+    syncFeatureOptOuts: AzureCloudAccountSyncFeatureId[];
+}
+export interface SubscriptionSyncFeatureOptOutsUpdateRequest {
+    syncFeatureOptOuts: AzureSubscriptionSyncFeatureId[];
+}
+export declare const SUBSCRIPTION_SYNC_STEP_ORDER: readonly ["metrics", "resourcegroups", "activities", "queries", "reliability", "billing", "costestimation", "pricing", "commitments", "views"];
+export type SubscriptionSyncStepId = (typeof SUBSCRIPTION_SYNC_STEP_ORDER)[number];
+export type AzureDelegatedOnboardingStatus = 'subscriptionSelectionRequired' | 'active' | 'setupExpired';
+export type AzureDelegatedAuthErrorCode = 'invalid_grant' | 'interaction_required' | 'consent_required' | 'claims_challenge' | 'forbidden' | 'unknown';
+export type AzureDelegatedOAuthStatePhase = 'discoverTenants' | 'tenantSelectionRequired' | 'tenantConsent' | 'completed' | 'failed';
+export type CloudAccountScanSchedulingMode = 'every12Hours' | 'daily' | 'weekly' | 'onDemandOnly';
+export type AzureGuestAccessScanSchedulingMode = 'onDemandOnly';
+export type AzureGuestAccessStatus = 'created' | 'deviceCodePending' | 'tenantDiscoveryRequired' | 'tenantSelectionRequired' | 'tenantAuthorizationRequired' | 'subscriptionSelectionRequired' | 'queued' | 'scanning' | 'completed' | 'partial' | 'failed' | 'reauthRequired' | 'cancelled' | 'expired';
+export type AzureGuestAccessStatusReason = 'device_code_expired' | 'tenant_discovery_failed' | 'tenant_selection_required' | 'tenant_authorization_required' | 'microsoft_account_mismatch' | 'no_readable_subscriptions' | 'subscription_read_forbidden' | 'token_relay_missing' | 'setup_expired' | 'stale_message' | 'refresh_token_expired' | 'token_refresh_failed' | 'refresh_requires_interaction' | 'resource_inventory_failed' | 'resource_graph_failed' | 'billing_2m_failed' | 'scan_failed' | 'cancelled_by_user' | 'unknown';
+export interface AzureGuestAccessCloudAccountFields {
+    /** Public-safe guest access lifecycle status. Token relay payloads are never stored in this field. */
+    guestAccessStatus?: AzureGuestAccessStatus;
+    /** Public-safe reason for the current guest access lifecycle state. */
+    guestAccessStatusReason?: AzureGuestAccessStatusReason;
+    /** Current guest access run correlation ID. This is not a token relay storage locator. */
+    guestAccessRunId?: string;
+    /** Previous guest access run correlation ID. This is not a token relay storage locator. */
+    guestAccessLastRunId?: string;
+    /** Timestamp for when the current guest access run was queued. */
+    guestAccessQueuedAt?: Date | string;
+    /** Timestamp for when the current guest access scan started. */
+    guestAccessScanStartedAt?: Date | string;
+    /** Timestamp for when the current guest access scan completed. */
+    guestAccessScanCompletedAt?: Date | string;
+    /** Timestamp for the last completed guest access scan with usable results. */
+    guestAccessLastSuccessfulScanAt?: Date | string;
+}
+export interface AzureSpSetupCloudAccountFields {
+    azureSpSetupProvisioningStatus?: AzureSpSetupProvisioningStatus;
+    azureSpSetupActiveSetupId?: string;
+    azureSpSetupActiveExecutionId?: string;
+    azureSpSetupReadinessVersion?: string;
+    azureSpSetupActiveRepairSetupId?: string;
+    azureSpSetupActiveRepairExecutionId?: string;
+    azureSpSetupActiveRepairPhase?: AzureSpSetupPhase;
+    azureSpSetupLastRepairResult?: AzureSpSetupResult;
+    azureSpSetupLastRepairAttemptedAt?: string;
+    azureSpSetupPermissionManifestVersion?: string;
+    azureSpSetupLastResult?: AzureSpSetupResult;
+    azureSpSetupLastAttemptedAt?: string;
+    azureSpSetupSummaryJson?: string;
+    /** Internal count of billing-export locator sources persisted after bounding. */
+    azureSpSetupBillingExportLocatorSourceCount?: number;
+    /** Internal count of otherwise valid locator sources omitted by the durable bound. */
+    azureSpSetupBillingExportLocatorOmittedSourceCount?: number;
+    /** UTC time at which assisted onboarding last projected billing-export locators. */
+    azureSpSetupBillingExportLocatorUpdatedAt?: string;
+    /** Exact effective Reader evidence at the tenant-root management group for future-subscription inheritance. */
+    azureSpSetupTenantRootReaderReadiness?: AzureSpSetupReaderReadiness;
+    /** Exact management-group ARM scope that produced tenant-root Reader evidence. */
+    azureSpSetupTenantRootReaderScope?: string;
+    azureSpSetupTenantRootReaderSetupId?: string;
+    azureSpSetupTenantRootReaderExecutionId?: string;
+    azureSpSetupTenantRootReaderVerifiedAt?: string;
+}
+export interface AzureSpSetupSubscriptionReadinessFields {
+    azureSpSetupReaderReadiness?: AzureSpSetupReaderReadiness;
+    azureSpSetupReaderReadinessSource?: AzureSpSetupReaderReadinessSource;
+    /** Exact scope from which the subscription Reader evidence was derived. */
+    azureSpSetupReadinessSourceScope?: string;
+    azureSpSetupReadinessSetupId?: string;
+    azureSpSetupReadinessExecutionId?: string;
+    azureSpSetupReadinessVerifiedAt?: string;
+    /** UTC time of the most recent automatic inherited-Reader validation attempt. */
+    azureSpSetupReadinessLastAttemptedAt?: string;
+    azureSpSetupReadinessErrorCode?: AzureSpSetupErrorCode;
+}
+/** Secret-free AWS fields shared by generic cloud-account list and detail responses. */
+export interface AwsPublicCloudAccountFields {
+    /** Canonical 12-digit AWS account identifier. */
+    accountId?: string;
+    /** AWS estate containing this connected account. */
+    awsEstateId?: string;
+    /** Cross-account role ARN. This is role metadata, not a credential. */
+    roleArn?: string;
+    /** Capabilities for which the connected role is used. */
+    awsRolePurposes?: AwsEstateAccountPurpose[];
+    /** Sanitized machine-readable reason for the current lifecycle state. */
+    statusReason?: string;
+    /** Sanitized user-facing lifecycle detail. */
+    statusMessage?: string;
+    /** Evidence that a provider sync produced usable artifacts, when available. */
+    lastSuccessfulSyncAt?: string;
+}
+export interface CloudAccount extends AzureGuestAccessCloudAccountFields, AzureSpSetupCloudAccountFields, AwsPublicCloudAccountFields, ProviderScopeDisplayMetadata {
+    /** Partition Key */
+    companyId: string;
+    /** Stable cloud-account row identifier. Provider account metadata is carried in provider-specific fields. */
     id: string;
     name: string;
     companyName: string;
+    /** AWS, Azure, GCP, etc. */
     provider: string;
+    /** Missing authMode should be treated as servicePrincipal by consumers for backward compatibility. */
+    authMode?: CloudAccountAuthMode;
+    /** Optional list of subscription group names for this cloud account */
+    groupNames?: string[];
+    /** Azure Tenant ID */
     tenantId?: string;
     secret?: string;
     secretExpiresAt?: Date;
@@ -13,16 +436,182 @@ export interface CloudAccount {
     createdBy: string;
     status: string;
     objectives?: SurveyResponse[];
+    /** Preferred recommendation effort-estimate profile for this cloud account. */
+    effortProfile?: EffortEstimateProfileName;
+    writeSecret?: string;
+    writeSecretExpiresAt?: Date;
+    writeClientId?: string;
+    writeBitmask?: number;
+    readBitmask?: number;
+    tenantSyncStatus?: CloudAccountTenantSyncStatus;
+    tenantSyncRequestedAt?: Date;
+    tenantSyncStartedAt?: Date;
+    tenantSyncCompletedAt?: Date;
+    tenantSyncError?: string;
+    tenantSyncSource?: CloudAccountTenantSyncSource;
+    firstSyncNotificationStatus?: CloudAccountFirstSyncNotificationStatus;
+    firstSyncNotificationUserId?: string;
+    /** Azure sync features disabled for this cloud account. Cloud-account opt-outs are hard denies for subscriptions. */
+    syncFeatureOptOuts?: AzureSyncFeatureId[];
+    /**
+     * Internal legacy delegated-user token cache. Do not expose this field in public API DTOs.
+     * Guest access token relay payloads use AzureGuestAccessTokenRelayPayload and must not be
+     * stored on CloudAccount or returned through PublicCloudAccountDto.
+     */
+    delegatedTokenCache?: string;
+    /** Legacy delegated-user onboarding status. Guest access lifecycle state uses guestAccessStatus fields. */
+    onboardingStatus?: AzureDelegatedOnboardingStatus;
+    scanSchedulingMode?: CloudAccountScanSchedulingMode;
+    delegatedSetupExpiresAt?: Date | string;
+    delegatedTrialStartedAt?: Date | string;
+    delegatedTrialExpiresAt?: Date | string;
+    reauthRequired?: boolean;
+    lastAuthErrorCode?: AzureDelegatedAuthErrorCode;
+    lastAuthErrorAt?: Date | string;
+    connectedUserObjectId?: string;
+    connectedUserTenantId?: string;
+    connectedUserEmail?: string;
+    connectedUserDisplayName?: string;
+    connectedAt?: Date | string;
+    lastTokenRefreshAt?: Date | string;
+    lastDelegatedTokenCacheUpdatedAt?: Date | string;
+    gdapAuthorizationCompanyId?: string;
+    gdapAuthorizationProfileId?: string;
+    gdapPartnerTenantId?: string;
+    gdapCustomerTenantId?: string;
+    gdapRelationshipId?: string;
+    gdapRelationshipDisplayName?: string;
+    gdapRelationshipStatus?: AzureGdapRelationshipStatus;
+    gdapAccessAssignmentId?: string;
+    gdapAccessAssignmentStatus?: AzureGdapAccessAssignmentStatus;
+    gdapSecurityGroupId?: string;
+    gdapSecurityGroupDisplayName?: string;
+    gdapRolesJson?: string;
+    gdapExpiresAt?: Date | string;
+    gdapAutoExtendEnabled?: boolean;
+    gdapPartnerAuthorizationStatus?: AzureGdapValidationStatus;
+    gdapAppConsentStatus?: AzureGdapValidationStatus;
+    gdapLastValidatedAt?: Date | string;
+    gdapLastValidationStatus?: AzureGdapValidationStatus;
+    gdapLastValidationErrorCode?: string;
+    /** Sanitized public-safe validation message. Do not store raw Microsoft claims or token errors here. */
+    gdapLastValidationMessage?: string;
+    gdapScheduledEligible?: boolean;
+    gdapScheduledEligibilityReason?: string;
+    gdapCapabilities?: AzureGdapCapabilityStatus[];
+    /** Internal partner billing scope. Do not expose billing account/customer identifiers in public API DTOs. */
+    cspPartnerBillingScope?: AzureCspPartnerBillingScope;
+    /** Internal GDAP credential locator. Do not expose this field in public API DTOs. */
+    gdapCredentialReference?: string;
+    /** Internal manual billing export locator override. Do not expose this field in public API DTOs. */
+    billingExportLocator?: string | CloudAccountBillingExportLocatorConfiguration;
 }
-export interface SubscriptionAccount {
+export type PublicCloudAccountDto = Omit<CloudAccount, 'delegatedTokenCache' | 'secret' | 'writeSecret' | 'billingExportLocator' | 'gdapCredentialReference' | 'cspPartnerBillingScope'> & AwsForbiddenCredentialFields & {
+    /** Public-safe billing export configuration status. */
+    billingExportConfigurationStatus?: AzureBillingExportConfigurationStatus;
+    /**
+     * Editable, credential-free billing export coordinates. Present only on an authorized
+     * single-account detail read for a caller with cloud-account management access.
+     */
+    billingExports?: AzureBillingExportConfigurationInput;
+    /** Display-only masked preview of the stored read secret. Never contains the full secret value. */
+    secretPreview?: string;
+    /** Display-only masked preview of the stored write secret. Never contains the full secret value. */
+    writeSecretPreview?: string;
+    /** Guest access token relay payloads are internal only and must never appear in public DTOs. */
+    guestAccessTokenRelayPayload?: never;
+    /** Guest access token relay storage locators are internal only and must never appear in public DTOs. */
+    guestAccessTokenRelayReference?: never;
+    /** AWS trust-policy external IDs are setup-only and must never appear in public DTOs. */
+    externalId?: never;
+    awsOnboardingCommandFingerprint?: never;
+    awsDeleteRequestedAt?: never;
+};
+/** Subscription-specific compatibility alias for the shared progress-stage vocabulary. */
+export type SubscriptionSyncProgressStepStatus = SyncProgressStepStatus;
+/** Subscription-specific compatibility alias for the shared progress-substage vocabulary. */
+export type SubscriptionSyncProgressSubStepStatus = SyncProgressSubStepStatus;
+export type SubscriptionSyncProgressContextValue = string | number | boolean;
+export interface SubscriptionSyncProgressSubStep {
     id: string;
-    companyId: string;
+    status: SubscriptionSyncProgressSubStepStatus;
+    label?: string;
+    attempts?: number;
+    lastUpdated?: string;
+    lastError?: string;
+    durationMs?: number;
+    context?: Record<string, SubscriptionSyncProgressContextValue>;
+}
+export interface SubscriptionSyncProgressStep {
+    id: SubscriptionSyncStepId;
+    status: SubscriptionSyncProgressStepStatus;
+    attempts: number;
+    lastUpdated: string;
+    lastError?: string;
+    runId?: string;
+    active: boolean;
+    callCount?: number;
+    note?: string;
+    issue?: SyncProgressIssue;
+    subSteps?: SubscriptionSyncProgressSubStep[];
+}
+export interface SubscriptionSyncProgress {
+    runId?: string;
+    overallStatus: SyncProgressStatus;
+    progressLabel: string;
+    completedSteps: number;
+    totalSteps: number;
+    activeComponents: SubscriptionSyncStepId[];
+    currentStepId?: SubscriptionSyncStepId;
+    lastErrorComponent?: SubscriptionSyncStepId;
+    lastErrorMessage?: string;
+    initiatedAt?: string;
+    completedAt?: string;
+    lastUpdated: string;
+    steps: SubscriptionSyncProgressStep[];
+}
+export interface SubscriptionInfoBase extends AzureSpSetupSubscriptionReadinessFields {
     name: string;
+    friendlyName?: string;
     cloudAccountId: string;
     cloudAccountName: string;
+    /** Optional group name for subscription-level grouping */
+    groupName?: string;
+    /** Optional emoji shortcode (Slack-style, e.g. "/face") */
+    icon?: string;
+    /** Optional subscription type (Production, Non-Production, Mixed) */
+    subscriptionType?: SubscriptionType;
     status?: string;
+    statusLabel?: string;
     error?: string;
+    /**
+     * Timestamp of the last terminal event for this subscription, successful or failed.
+     * This is not a success signal: an errored run advances it. Use `lastSuccessfulSyncAt`
+     * to reason about whether a sync actually succeeded.
+     */
     lastUpdated?: string;
+    /**
+     * ISO 8601 timestamp of the last run that reached terminal success for this subscription.
+     * Absent means no run has ever completed successfully. Advanced only on a `Completed`
+     * status with no error; never advanced by an errored, partial or skipped run.
+     *
+     * Named to match `AwsPublicCloudAccountFields.lastSuccessfulSyncAt` and
+     * `ProviderSyncProgressBase.lastSuccessfulSyncAt`, so the platform carries one
+     * convention for "last successful sync" across providers.
+     */
+    lastSuccessfulSyncAt?: string;
+    /**
+     * ISO 8601 timestamp of the last billing component run that completed successfully and
+     * materially advanced coverage. Absent means billing has never completed for this
+     * subscription. Not advanced on continuation, gap-fill or post-gap-fill budget
+     * exhaustion, partial-data completion, denied billing access, or a freshness-gate skip.
+     *
+     * Distinct from `lastSuccessfulSyncAt` because a run can reach terminal success with the
+     * billing component opted out, skipped or partial. Subscription dispatch ordering and the
+     * billing freshness gate key on this field, not on the run-level one.
+     */
+    lastSuccessfulBillingSyncAt?: string;
+    hostname?: string;
     quotaId?: string;
     duration?: string;
     currency?: string;
@@ -30,6 +619,38 @@ export interface SubscriptionAccount {
     foundCurrency?: boolean;
     ready?: boolean;
     secureScore?: number;
+    /** Defender for Cloud evidence that distinguishes a genuine zero from unavailable or stale score data. */
+    secureScoreEvidence?: SecureScoreEvidence;
+    advisorScore?: number;
+    advisorScoreCost?: number;
+    advisorScoreSecurity?: number;
+    advisorScorePerformance?: number;
+    advisorScoreReliability?: number;
+    advisorScoreOperationalExcellence?: number;
     showAmortizedCosts?: boolean;
+    totalCost?: number;
+    billingItems?: number;
+    activityItems?: number;
+    /** Hour within each twelve-hour UTC cycle when the scheduled scan is dispatched. */
+    scheduledScanSlot?: ScheduledScanSlot;
+    eventId?: string;
+    readBitmask?: number;
+    syncProgress?: SubscriptionSyncProgress | string | null;
+    /** Azure sync features disabled for this subscription in addition to cloud-account opt-outs. */
+    syncFeatureOptOuts?: AzureSyncFeatureId[];
+    /** Azure sync features disabled by the parent cloud account. Returned to administrators only. */
+    cloudAccountSyncFeatureOptOuts?: AzureSyncFeatureId[];
+    /** Effective Azure sync features disabled after applying cloud-account hard denies. Returned to administrators only. */
+    effectiveSyncFeatureOptOuts?: AzureSyncFeatureId[];
+    /** Purpose bound to the current delegated guest-access run. */
+    guestAccessWorkloadKind?: 'fullScan' | 'reviewChecklist';
+    /** Normalized checklist identifier when the current guest-access run is review-checklist-only. */
+    guestAccessChecklistId?: string;
+}
+export interface SubscriptionAccount extends SubscriptionInfoBase {
+    /** Partition Key (Azure Subscription ID) */
+    id: string;
+    /** Row Key */
+    companyId: string;
 }
 //# sourceMappingURL=accounts.d.ts.map