@spottoai/types-package 1.0.2-beta.99 → 1.0.2-dev1138.1

package/dist/esm/accounts/readPermissions.js

@@ -0,0 +1,198 @@
+/**
+ * Subscription-scoped read capability bitmask enum.
+ * Each capability maps to a single bit.
+ */
+export var SubscriptionReadPermission;
+(function (SubscriptionReadPermission) {
+    /** Permission to read Azure Monitor metrics. */
+    SubscriptionReadPermission[SubscriptionReadPermission["MonitoringReader"] = 1] = "MonitoringReader";
+    /** Permission to run Log Analytics / App Insights data queries. */
+    SubscriptionReadPermission[SubscriptionReadPermission["LogAnalyticsDataReader"] = 2] = "LogAnalyticsDataReader";
+    /** Permission to read subscription resource groups. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ResourceGroupsReader"] = 4] = "ResourceGroupsReader";
+    /** Permission to read subscription resource inventory. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ResourceInventoryReader"] = 8] = "ResourceInventoryReader";
+    /** Permission to read Azure Activity Log events. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ActivityLogReader"] = 16] = "ActivityLogReader";
+    /** Permission to run Azure Resource Graph queries. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ResourceGraphReader"] = 32] = "ResourceGraphReader";
+    /** Permission to read Azure Cost Management query results. */
+    SubscriptionReadPermission[SubscriptionReadPermission["CostManagementReader"] = 64] = "CostManagementReader";
+    /** Permission to read Azure Consumption usage details. */
+    SubscriptionReadPermission[SubscriptionReadPermission["ConsumptionUsageReader"] = 128] = "ConsumptionUsageReader";
+    /** Permission to read Azure Advisor recommendations and Advisor score. */
+    SubscriptionReadPermission[SubscriptionReadPermission["AdvisorRecommendationsReader"] = 256] = "AdvisorRecommendationsReader";
+    /** Permission to read Defender for Cloud security posture data. */
+    SubscriptionReadPermission[SubscriptionReadPermission["SecurityReader"] = 512] = "SecurityReader";
+})(SubscriptionReadPermission || (SubscriptionReadPermission = {}));
+/**
+ * Cloud-account-scoped read capability bitmask enum.
+ * Each capability maps to a single bit.
+ */
+export var CloudAccountReadPermission;
+(function (CloudAccountReadPermission) {
+    /** Permission to read management group entities. */
+    CloudAccountReadPermission[CloudAccountReadPermission["ManagementGroupReader"] = 1] = "ManagementGroupReader";
+    /** Permission to read reservation resources and related consumption artifacts. */
+    CloudAccountReadPermission[CloudAccountReadPermission["ReservationsReader"] = 2] = "ReservationsReader";
+    /** Permission to read savings plan resources. */
+    CloudAccountReadPermission[CloudAccountReadPermission["SavingsPlanReader"] = 4] = "SavingsPlanReader";
+    /** Permission to read Microsoft Graph applications/service principals. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphApplicationReadAll"] = 8] = "GraphApplicationReadAll";
+    /** Permission to read Microsoft Graph privileged role assignment schedules. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphRoleAssignmentScheduleReadDirectory"] = 16] = "GraphRoleAssignmentScheduleReadDirectory";
+    /** Permission to read Microsoft Graph privileged role eligibility schedules. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphRoleEligibilityScheduleReadDirectory"] = 32] = "GraphRoleEligibilityScheduleReadDirectory";
+    /** Permission to read Microsoft Graph role-management metadata. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphRoleManagementReadDirectory"] = 64] = "GraphRoleManagementReadDirectory";
+    /** Permission to read Microsoft Graph group memberships. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphGroupMemberReadAll"] = 128] = "GraphGroupMemberReadAll";
+    /** Permission to read Microsoft Graph user metadata. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphUserReadAll"] = 256] = "GraphUserReadAll";
+    /** Permission to read Microsoft Graph audit logs. */
+    CloudAccountReadPermission[CloudAccountReadPermission["GraphAuditLogReadAll"] = 1024] = "GraphAuditLogReadAll";
+})(CloudAccountReadPermission || (CloudAccountReadPermission = {}));
+export const SUBSCRIPTION_READ_PERMISSIONS_METADATA = [
+    {
+        id: SubscriptionReadPermission.MonitoringReader,
+        displayName: 'Monitoring Reader',
+        description: 'Allows Spotto to read Azure Monitor metrics for subscription resources.',
+        requiredRoles: ['Monitoring Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/azure-monitor/roles-permissions-security',
+    },
+    {
+        id: SubscriptionReadPermission.LogAnalyticsDataReader,
+        displayName: 'Log Analytics Data Reader',
+        description: 'Allows Spotto to run Log Analytics and App Insights data queries.',
+        requiredRoles: ['Log Analytics Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access',
+    },
+    {
+        id: SubscriptionReadPermission.ResourceGroupsReader,
+        displayName: 'Resource Groups Reader',
+        description: 'Allows Spotto to read resource groups for subscription inventory and grouping.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/general#reader',
+    },
+    {
+        id: SubscriptionReadPermission.ResourceInventoryReader,
+        displayName: 'Resource Inventory Reader',
+        description: 'Allows Spotto to read subscription resources for inventory, recommendations, relationship graph, and portal/plugin views.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/general#reader',
+    },
+    {
+        id: SubscriptionReadPermission.ActivityLogReader,
+        displayName: 'Activity Log Reader',
+        description: 'Allows Spotto to read Azure Activity Log events for operational context and refresh decisions.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log',
+    },
+    {
+        id: SubscriptionReadPermission.ResourceGraphReader,
+        displayName: 'Resource Graph Reader',
+        description: 'Allows Spotto to run Azure Resource Graph queries used by inventory, governance, reliability, and security checks.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview',
+    },
+    {
+        id: SubscriptionReadPermission.CostManagementReader,
+        displayName: 'Cost Management Reader',
+        description: 'Allows Spotto to read scoped Azure Cost Management data for costs, budgets, and savings calculations.',
+        requiredRoles: ['Cost Management Reader', 'Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/assign-access-acm-data',
+    },
+    {
+        id: SubscriptionReadPermission.ConsumptionUsageReader,
+        displayName: 'Consumption Usage Reader',
+        description: 'Allows Spotto to read Azure usage detail rows for usage attribution and commitment analysis.',
+        requiredRoles: ['Cost Management Reader', 'Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/rest/api/consumption/usage-details/list',
+    },
+    {
+        id: SubscriptionReadPermission.AdvisorRecommendationsReader,
+        displayName: 'Advisor Reader',
+        description: 'Allows Spotto to read Azure Advisor recommendations and Advisor score for recommendation import and optimization workflows.',
+        requiredRoles: ['Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/advisor/advisor-overview',
+    },
+    {
+        id: SubscriptionReadPermission.SecurityReader,
+        displayName: 'Security Reader',
+        description: 'Allows Spotto to read Defender for Cloud assessments, secure score, and security posture data.',
+        requiredRoles: ['Security Reader', 'Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/defender-for-cloud/permissions',
+    },
+];
+export const CLOUD_ACCOUNT_READ_PERMISSIONS_METADATA = [
+    {
+        id: CloudAccountReadPermission.ManagementGroupReader,
+        displayName: 'Management Group Reader',
+        description: 'Allows Spotto to read tenant management group entities.',
+        requiredRoles: ['Management Group Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/governance/management-groups/how-to/protect-resource-hierarchy',
+    },
+    {
+        id: CloudAccountReadPermission.ReservationsReader,
+        displayName: 'Reservations Reader',
+        description: 'Allows Spotto to read reservation resources and reservation usage artifacts.',
+        requiredRoles: ['Reservations Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/view-reservations',
+    },
+    {
+        id: CloudAccountReadPermission.SavingsPlanReader,
+        displayName: 'Savings Plan Reader',
+        description: 'Allows Spotto to read savings plan resources.',
+        requiredRoles: ['Savings plan Reader'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/cost-management-billing/savings-plan/view-utilization',
+    },
+    {
+        id: CloudAccountReadPermission.GraphApplicationReadAll,
+        displayName: 'Graph Application Read.All',
+        description: 'Allows Spotto to read Microsoft Graph applications and service principals.',
+        requiredRoles: ['Application.Read.All'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#applicationreadall',
+    },
+    {
+        id: CloudAccountReadPermission.GraphRoleAssignmentScheduleReadDirectory,
+        displayName: 'Graph RoleAssignmentSchedule Read.Directory',
+        description: 'Allows Spotto to read active Microsoft Graph role assignment schedules.',
+        requiredRoles: ['RoleAssignmentSchedule.Read.Directory'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#roleassignmentschedulereaddirectory',
+    },
+    {
+        id: CloudAccountReadPermission.GraphRoleEligibilityScheduleReadDirectory,
+        displayName: 'Graph RoleEligibilitySchedule Read.Directory',
+        description: 'Allows Spotto to read eligible Microsoft Graph role schedules.',
+        requiredRoles: ['RoleEligibilitySchedule.Read.Directory'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#roleeligibilityschedulereaddirectory',
+    },
+    {
+        id: CloudAccountReadPermission.GraphRoleManagementReadDirectory,
+        displayName: 'Graph RoleManagement Read.Directory',
+        description: 'Allows Spotto to read Microsoft Graph role-management metadata.',
+        requiredRoles: ['RoleManagement.Read.Directory'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#rolemanagementreaddirectory',
+    },
+    {
+        id: CloudAccountReadPermission.GraphGroupMemberReadAll,
+        displayName: 'Graph GroupMember Read.All',
+        description: 'Allows Spotto to read Microsoft Graph group memberships.',
+        requiredRoles: ['GroupMember.Read.All'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#groupmemberreadall',
+    },
+    {
+        id: CloudAccountReadPermission.GraphUserReadAll,
+        displayName: 'Graph User Read.All',
+        description: 'Allows Spotto to read Microsoft Graph user metadata.',
+        requiredRoles: ['User.Read.All'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#userreadall',
+    },
+    {
+        id: CloudAccountReadPermission.GraphAuditLogReadAll,
+        displayName: 'Graph AuditLog Read.All',
+        description: 'Allows Spotto to read Microsoft Graph audit logs.',
+        requiredRoles: ['AuditLog.Read.All'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/graph/permissions-reference#auditlogreadall',
+    },
+];

package/dist/esm/accounts/validation.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/accounts/writePermissions.js

@@ -0,0 +1,43 @@
+/**
+ * Write Permission Bitmask Enum
+ * Each permission gets a unique bit position for efficient storage
+ */
+export var WritePermission;
+(function (WritePermission) {
+    /** Permission to dismiss Azure Advisor recommendations */
+    WritePermission[WritePermission["DismissRecommendations"] = 1] = "DismissRecommendations";
+    /** Permission to enable storage inventory reports on storage accounts */
+    WritePermission[WritePermission["StorageInventory"] = 2] = "StorageInventory";
+    /** Permission to create scoped Azure Policy exemptions */
+    WritePermission[WritePermission["PolicyExemptions"] = 4] = "PolicyExemptions";
+})(WritePermission || (WritePermission = {}));
+/**
+ * Permission metadata array
+ * Define all available write permissions with their metadata
+ */
+export const WRITE_PERMISSIONS_METADATA = [
+    {
+        id: WritePermission.DismissRecommendations,
+        displayName: 'Dismiss Azure Advisor Recommendations',
+        description: 'Allows Spotto to dismiss recommendations in Azure when dismissed here.',
+        requiredRoles: ['Advisor Recommendations Contributor'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/advisor/permissions',
+        scriptGeneratorUrl: '/scripts/advisor-role',
+    },
+    {
+        id: WritePermission.StorageInventory,
+        displayName: 'Enable Storage Inventory Reports',
+        description: 'Allows Spotto to enable blob inventory on storage accounts you select.',
+        requiredRoles: ['Storage Account Contributor'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory',
+        scriptGeneratorUrl: '/scripts/storage-role',
+    },
+    {
+        id: WritePermission.PolicyExemptions,
+        displayName: 'Create Azure Policy Exemptions',
+        description: 'Allows Spotto to create narrowly scoped exemptions for selected Azure Policy initiative controls.',
+        requiredRoles: ['Custom role with Azure Policy exemption actions at the target and assignment scopes'],
+        documentationUrl: 'https://docs.spotto.ai/docs/portal/write-permissions/policy-exemptions',
+        scriptGeneratorUrl: '/scripts/policy-exemptions-role',
+    },
+];

package/dist/esm/ai/index.js

@@ -0,0 +1,2 @@
+/** Common AI interfaces shared between frontend and backend */
+export {};

package/dist/esm/assessments/artifact.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/catalogue.js

@@ -0,0 +1,12 @@
+export const ARCHITECTURE_ASSESSMENT_REQUIRED_CONTEXT_CATEGORIES = [
+    'company-profile',
+    'architecture',
+    'operations',
+    'reliability',
+    'roadmap',
+];
+export const ARCHITECTURE_ASSESSMENT_OPTIONAL_CONTEXT_CATEGORIES = [
+    'security',
+    'performance',
+    'finops',
+];

package/dist/esm/assessments/common.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/evidence.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/export.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/index.js

@@ -0,0 +1,10 @@
+export * from './status.js';
+export * from './common.js';
+export * from './catalogue.js';
+export * from './run.js';
+export * from './evidence.js';
+export * from './artifact.js';
+export * from './review.js';
+export * from './queue.js';
+export * from './export.js';
+export * from './sow.js';

package/dist/esm/assessments/queue.js

@@ -0,0 +1,2 @@
+export const ASSESSMENT_QUEUE_ENTITY = 'assessment';
+export const ASSESSMENT_GENERATE_ACTION = 'generate-assessment';

package/dist/esm/assessments/review.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/run.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/sow.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/assessments/status.js

@@ -0,0 +1,23 @@
+export const ARCHITECTURE_ASSESSMENT_TYPE = 'architecture';
+export const ASSESSMENT_TYPES = [ARCHITECTURE_ASSESSMENT_TYPE];
+export const ASSESSMENT_PROVIDER_NAMES = ['azure'];
+export const ASSESSMENT_RELEASE_STAGES = ['preview', 'ga'];
+export const ASSESSMENT_RUN_STATUSES = ['draft', 'queued', 'running', 'needs_review', 'approved', 'published', 'failed'];
+export const ASSESSMENT_EXPORT_FORMATS = ['docx'];
+export const ASSESSMENT_EXPORT_STATUSES = ['requested', 'completed', 'failed'];
+export const ASSESSMENT_EVIDENCE_SOURCE_TYPES = [
+    'company_context_note',
+    'subscription_report_evidence_pack',
+    'portal_artifact',
+    'raw_artifact',
+    'conformed_artifact',
+    'review_checklist',
+    'derived_summary',
+    'ai_inference',
+    'evidence_gap',
+];
+export const ASSESSMENT_EVIDENCE_CONFIDENCE_LEVELS = ['confirmed', 'customer_supplied', 'derived', 'inferred', 'gap'];
+export const ASSESSMENT_PRIORITY_LEVELS = ['critical', 'high', 'medium', 'low', 'informational'];
+export const ASSESSMENT_EFFORT_BANDS = ['low', 'medium', 'high', 'unknown'];
+export const ASSESSMENT_IMPACT_LEVELS = ['low', 'medium', 'high', 'unknown'];
+export const ASSESSMENT_PILLARS = ['architecture', 'security', 'reliability', 'performance', 'operations', 'finops', 'roadmap'];

package/dist/esm/aws/commitments-planning.js

@@ -0,0 +1 @@
+export { validateAwsCommitmentsPlanningViewIdentity } from './commitmentsPlanningValidation.js';

package/dist/esm/aws/commitmentsPlanningValidation.js

@@ -0,0 +1,121 @@
+import { ProviderName } from '../common/provider.js';
+import { asRecord, assertAccount, assertExactKeys, assertValue } from './pluginPublicArtifactValidationHelpers.js';
+const FORBIDDEN_AWS_COMMITMENTS_KEYS = new Set([
+    'billingScopeId',
+    'breakCostEstimate',
+    'cloudAccountId',
+    'companyId',
+    'credentialHealth',
+    'credentialId',
+    'managementGroupId',
+    'pricingQuote',
+    'quotePolicy',
+    'resourceGroupId',
+    'storageCapacity',
+    'storageDimensions',
+    'subscription',
+    'subscriptionId',
+    'tenantId',
+    'unlockFinancialLedger',
+]);
+/**
+ * Validates the security-sensitive AWS identity boundary of a commitments view.
+ * A full public-artifact validator should call this before publication or response.
+ */
+export function validateAwsCommitmentsPlanningViewIdentity(value, expectedAccountId) {
+    const view = asRecord(value, 'commitmentsPlanning');
+    const providerScope = asRecord(view.providerScope, 'commitmentsPlanning.providerScope');
+    assertExactKeys(providerScope, ['providerName', 'providerScopeId'], 'commitmentsPlanning.providerScope');
+    assertValue(providerScope.providerName, ProviderName.Aws, 'commitmentsPlanning.providerScope.providerName');
+    const accountId = String(providerScope.providerScopeId ?? '');
+    assertAccount(providerScope.providerScopeId, accountId, 'commitmentsPlanning.providerScope.providerScopeId');
+    if (expectedAccountId !== undefined) {
+        assertAccount(expectedAccountId, accountId, 'expectedAccountId');
+    }
+    validateInventory(view.inventory, accountId);
+    validatePurchaseRecommendations(view.purchaseRecommendations, accountId);
+    validateBoundIdentities(view, accountId, 'commitmentsPlanning');
+}
+function validateInventory(value, accountId) {
+    if (!Array.isArray(value))
+        throw new Error('commitmentsPlanning.inventory must be an array.');
+    value.forEach((item, index) => {
+        const field = `commitmentsPlanning.inventory[${index}]`;
+        const record = asRecord(item, field);
+        assertValue(record.sourceKind, 'aws-native', `${field}.sourceKind`);
+        assertValue(record.provider, ProviderName.Aws, `${field}.provider`);
+        assertValue(record.appliedScopeType, 'linked-account', `${field}.appliedScopeType`);
+        validateAppliedScope(record.appliedScopeProperties, accountId, `${field}.appliedScopeProperties`);
+        validateAwsShape(record.shape, `${field}.shape`);
+    });
+}
+function validatePurchaseRecommendations(value, accountId) {
+    if (value === undefined)
+        return;
+    if (!Array.isArray(value))
+        throw new Error('commitmentsPlanning.purchaseRecommendations must be an array.');
+    value.forEach((item, index) => {
+        const field = `commitmentsPlanning.purchaseRecommendations[${index}]`;
+        const record = asRecord(item, field);
+        assertValue(record.purchaseScope, 'linked-account', `${field}.purchaseScope`);
+        validateAppliedScope(record.appliedScopeProperties, accountId, `${field}.appliedScopeProperties`);
+        validateAwsSource(record.source, `${field}.source`);
+        validateAwsShape(record.currentShape, `${field}.currentShape`);
+        validateAwsShape(record.targetShape, `${field}.targetShape`, true);
+        if (record.eligibility !== undefined) {
+            const eligibility = asRecord(record.eligibility, `${field}.eligibility`);
+            validateAwsShape(eligibility.currentShape, `${field}.eligibility.currentShape`);
+            validateAwsShape(eligibility.targetShape, `${field}.eligibility.targetShape`);
+            if (eligibility.source !== undefined)
+                validateAwsSource(eligibility.source, `${field}.eligibility.source`);
+        }
+    });
+}
+function validateAppliedScope(value, accountId, field) {
+    const scope = asRecord(value, field);
+    assertExactKeys(scope, ['accountId', 'region', 'availabilityZone'], field);
+    assertAccount(scope.accountId, accountId, `${field}.accountId`);
+}
+function validateAwsSource(value, field) {
+    const source = asRecord(value, field);
+    assertValue(source.sourceKind, 'aws-native', `${field}.sourceKind`);
+}
+function validateAwsShape(value, field, required = false) {
+    if (value === undefined && !required)
+        return;
+    const shape = asRecord(value, field);
+    assertValue(shape.provider, 'aws', `${field}.provider`);
+}
+function validateBoundIdentities(value, accountId, field) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => validateBoundIdentities(item, accountId, `${field}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== 'object') {
+        if (typeof value === 'string')
+            validateArnAccount(value, accountId, field);
+        return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        if (FORBIDDEN_AWS_COMMITMENTS_KEYS.has(key)) {
+            throw new Error(`${field}.${key} is not allowed in an AWS commitments artifact.`);
+        }
+        if (key === 'accountId')
+            assertAccount(child, accountId, `${field}.${key}`);
+        if (key === 'providerName')
+            assertValue(child, ProviderName.Aws, `${field}.${key}`);
+        if (key === 'provider')
+            assertValue(child, 'aws', `${field}.${key}`);
+        if (key === 'sourceKind' && child === 'azure-native') {
+            throw new Error(`${field}.${key} cannot contain Azure-native evidence.`);
+        }
+        validateBoundIdentities(child, accountId, `${field}.${key}`);
+    }
+}
+function validateArnAccount(value, accountId, field) {
+    if (!value.startsWith('arn:'))
+        return;
+    const arnAccountId = value.split(':', 6)[4];
+    if (arnAccountId)
+        assertAccount(arnAccountId, accountId, field);
+}

package/dist/esm/aws/estates.js

@@ -0,0 +1,21 @@
+import { AWS_FORBIDDEN_CREDENTIAL_FIELDS } from './requests.js';
+/** Schema version for the API-owned AWS company estate manifest. */
+export const AWS_ESTATES_MANIFEST_SCHEMA_VERSION = 1;
+/** Public provider discriminator used by the AWS estate manifest API. */
+export const AWS_ESTATES_MANIFEST_PROVIDER = 'AWS';
+export const AWS_ESTATE_KINDS = ['standalone', 'organization'];
+export const AWS_ESTATE_ACCOUNT_SOURCES = ['manual'];
+export const AWS_ESTATE_ROLE_DEPLOYMENT_MODES = ['customer-managed'];
+export const AWS_ESTATE_ACCOUNT_PURPOSES = ['resource-discovery', 'organization-discovery', 'billing-definition', 'billing-storage'];
+/**
+ * Credential-shaped fields that manifest API boundaries must reject
+ * recursively before persisting untyped JSON.
+ */
+export const AWS_ESTATES_MANIFEST_FORBIDDEN_CREDENTIAL_FIELDS = [
+    ...AWS_FORBIDDEN_CREDENTIAL_FIELDS,
+    'externalId',
+    'accessToken',
+    'connectionString',
+    'sasToken',
+    'storageCredential',
+];

package/dist/esm/aws/index.js

@@ -0,0 +1,18 @@
+export * from './estates.js';
+export * from './commitmentsPlanningValidation.js';
+export * from './onboarding.js';
+export * from './pluginPublicArtifacts.js';
+export * from './pluginPublicArtifactEvidence.js';
+export * from './pluginPublicArtifactValidation.js';
+export * from './portalPublicArtifacts.js';
+export * from './portalCommitmentsPlanningPublicArtifacts.js';
+export * from './portalCommitmentsPlanningPublicArtifactValidation.js';
+export * from './portalRelationshipPublicArtifacts.js';
+export * from './portalRelationshipResourceNodeTypes.js';
+export * from './portalRelationshipPublicArtifactValidation.js';
+export * from './portalPublicArtifactHistoryTypes.js';
+export * from './portalPublicArtifactNestedEvidence.js';
+export * from './portalPublicArtifactNestedEvidenceValidation.js';
+export * from './portalPublicArtifactValidation.js';
+export * from './publicArtifacts.js';
+export * from './requests.js';

package/dist/esm/aws/onboarding.js

@@ -0,0 +1 @@
+export {};