@spottoai/types-package 1.0.2-beta.99 → 1.0.2-dev1138.2

package/dist/esm/aws/pluginPublicArtifactValidationHelpers.js

@@ -0,0 +1,216 @@
+import { AWS_FORBIDDEN_CREDENTIAL_FIELDS } from './requests.js';
+const FORBIDDEN_PUBLIC_KEYS = new Set([
+    ...AWS_FORBIDDEN_CREDENTIAL_FIELDS,
+    'externalId',
+    'roleArn',
+    'secretArn',
+    'secretReference',
+    'credentialReference',
+    'storagePath',
+    'sourcePath',
+    'path',
+    'blobPath',
+    'containerPath',
+    'chunk',
+    'chunks',
+    'lease',
+    'retries',
+    'retry',
+    'refreshState',
+    'lastRefreshExecutionRequestId',
+    'lastRefreshExecutionRequestedAt',
+    'prompt',
+    'promptInput',
+    'sourceBytes',
+    'maxSourceBytes',
+    'bedrockRegion',
+    'guardrailId',
+    'guardrailVersion',
+    'etag',
+    'eTag',
+    'retiredAt',
+]);
+const NORMALIZED_FORBIDDEN_PUBLIC_KEYS = new Set(Array.from(FORBIDDEN_PUBLIC_KEYS, key => key.toLowerCase()));
+const FORBIDDEN_PUBLIC_KEY_PATTERN = /^(?:source|storage|blob|container)(?:path|uri|url|key)$|^s3(?:bucket|key|uri|url)$/i;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+const ISO_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+export function asRecord(value, field) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${field} must be a JSON object.`);
+    return value;
+}
+export function requiredArray(value, field) {
+    if (!Array.isArray(value) || value.length === 0)
+        throw new Error(`${field} must be a non-empty array.`);
+    return value;
+}
+export function stringArray(value, field) {
+    if (!Array.isArray(value))
+        throw new Error(`${field} must be an array.`);
+    const strings = value.map((item, index) => requiredString(item, `${field}[${index}]`));
+    if (new Set(strings).size !== strings.length)
+        throw new Error(`${field} must not contain duplicates.`);
+    const sorted = [...strings].sort((left, right) => left.localeCompare(right));
+    if (JSON.stringify(strings) !== JSON.stringify(sorted))
+        throw new Error(`${field} must be sorted.`);
+    return strings;
+}
+export function requiredString(value, field) {
+    if (typeof value !== 'string' || value.trim() !== value || value.length === 0)
+        throw new Error(`${field} must be a non-empty trimmed string.`);
+    return value;
+}
+export function isoTimestamp(value, field) {
+    const timestamp = requiredString(value, field);
+    if (!ISO_TIMESTAMP_PATTERN.test(timestamp) || Number.isNaN(Date.parse(timestamp)))
+        throw new Error(`${field} must be an ISO UTC timestamp.`);
+    return timestamp;
+}
+export function sha256(value, field) {
+    const digest = requiredString(value, field);
+    if (!SHA256_PATTERN.test(digest))
+        throw new Error(`${field} must be a lowercase hexadecimal SHA-256.`);
+    return digest;
+}
+export function requiredEnum(value, values, field) {
+    if (typeof value !== 'string' || !values.includes(value))
+        throw new Error(`${field} is not declared.`);
+    return value;
+}
+export function optionalEnum(value, values, field) {
+    if (value !== undefined)
+        requiredEnum(value, values, field);
+}
+export function optionalRecord(value, field) {
+    if (value !== undefined)
+        asRecord(value, field);
+}
+export function assertAccount(value, accountId, field) {
+    assertValue(value, accountId, field);
+    if (!/^\d{12}$/.test(accountId))
+        throw new Error(`${field} must be a 12-digit AWS account id.`);
+}
+export function assertExactKeys(value, allowed, field) {
+    const allowedKeys = new Set(allowed);
+    const unknown = Object.keys(value).filter(key => !allowedKeys.has(key));
+    if (unknown.length > 0)
+        throw new Error(`${field} contains undeclared fields: ${unknown.sort().join(', ')}.`);
+}
+export function assertNoForbiddenKeys(value, field) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => assertNoForbiddenKeys(item, `${field}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        if (isForbiddenPublicKey(key))
+            throw new Error(`${field}.${key} is not allowed in a public artifact.`);
+        assertNoForbiddenKeys(child, `${field}.${key}`);
+    }
+}
+/** Rejects non-JSON values, non-plain objects, and forbidden public keys recursively. */
+export function assertPublicJson(value, field) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new Error(`${field} must contain only finite JSON numbers.`);
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => assertPublicJson(item, `${field}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== 'object' || Object.getPrototypeOf(value) !== Object.prototype) {
+        throw new Error(`${field} must contain only plain JSON values.`);
+    }
+    for (const [key, child] of Object.entries(value)) {
+        if (isForbiddenPublicKey(key))
+            throw new Error(`${field}.${key} is not allowed in a public artifact.`);
+        assertPublicJson(child, `${field}.${key}`);
+    }
+}
+function isForbiddenPublicKey(key) {
+    return NORMALIZED_FORBIDDEN_PUBLIC_KEYS.has(key.toLowerCase()) || FORBIDDEN_PUBLIC_KEY_PATTERN.test(key);
+}
+export function assertRequiredKeys(value, required, field) {
+    const missing = required.filter(key => !(key in value));
+    if (missing.length > 0)
+        throw new Error(`${field} is missing required fields: ${missing.join(', ')}.`);
+}
+export function assertValue(actual, expected, field) {
+    if (actual !== expected)
+        throw new Error(`${field} must match its exact binding.`);
+}
+export function assertJsonEqual(actual, expected, field) {
+    if (JSON.stringify(actual) !== JSON.stringify(expected))
+        throw new Error(`${field} must match its exact binding.`);
+}
+export function validateDescriptor(value, field) {
+    const descriptor = asRecord(value, field);
+    assertExactKeys(descriptor, ['name', 'mediaType', 'contentEncoding', 'byteLength', 'sha256'], field);
+    requiredString(descriptor.name, `${field}.name`);
+    assertValue(descriptor.mediaType, 'application/json', `${field}.mediaType`);
+    requiredEnum(descriptor.contentEncoding, ['identity', 'gzip'], `${field}.contentEncoding`);
+    if (!Number.isSafeInteger(descriptor.byteLength) || Number(descriptor.byteLength) < 0)
+        throw new Error(`${field}.byteLength must be a non-negative safe integer.`);
+    sha256(descriptor.sha256, `${field}.sha256`);
+}
+export function validateBilling(value, field = 'target.billing') {
+    const billing = asRecord(value, field);
+    if (billing.source === 'cur') {
+        assertExactKeys(billing, ['source', 'reportName', 'billingPeriod'], field);
+        requiredString(billing.reportName, `${field}.reportName`);
+    }
+    else if (billing.source === 'cur-2.0-data-exports') {
+        assertExactKeys(billing, ['source', 'exportName', 'billingPeriod'], field);
+        requiredString(billing.exportName, `${field}.exportName`);
+    }
+    else {
+        throw new Error(`${field}.source is not declared.`);
+    }
+    const period = asRecord(billing.billingPeriod, `${field}.billingPeriod`);
+    assertExactKeys(period, ['start', 'end'], `${field}.billingPeriod`);
+    calendarDate(period.start, `${field}.billingPeriod.start`);
+    calendarDate(period.end, `${field}.billingPeriod.end`);
+    if (String(period.start) > String(period.end))
+        throw new Error(`${field}.billingPeriod start must not exceed end.`);
+}
+function calendarDate(value, field) {
+    const date = requiredString(value, field);
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(date) || Number.isNaN(Date.parse(`${date}T00:00:00.000Z`)))
+        throw new Error(`${field} must be a valid calendar date.`);
+    if (new Date(`${date}T00:00:00.000Z`).toISOString().slice(0, 10) !== date)
+        throw new Error(`${field} must be a valid calendar date.`);
+    return date;
+}
+export function validateSelector(value, field) {
+    const selector = asRecord(value, field);
+    if (selector.kind === 'stable-key') {
+        assertExactKeys(selector, ['kind', 'stableKey'], field);
+        requiredString(selector.stableKey, `${field}.stableKey`);
+    }
+    else if (selector.kind === 'resource-arn') {
+        assertExactKeys(selector, ['kind', 'resourceArn'], field);
+        requiredString(selector.resourceArn, `${field}.resourceArn`);
+    }
+    else {
+        throw new Error(`${field}.kind is not declared.`);
+    }
+}
+export function validateMetricWindow(value, field) {
+    const window = asRecord(value, field);
+    assertExactKeys(window, ['start', 'end'], field);
+    isoTimestamp(window.start, `${field}.start`);
+    isoTimestamp(window.end, `${field}.end`);
+    if (String(window.start) > String(window.end))
+        throw new Error(`${field}.start must not exceed end.`);
+}
+export function validateTagRuleScope(value) {
+    if (value === undefined)
+        return;
+    const scope = asRecord(value, 'tagRuleScope');
+    assertExactKeys(scope, ['companyId'], 'tagRuleScope');
+    requiredString(scope.companyId, 'tagRuleScope.companyId');
+}

package/dist/esm/aws/pluginPublicArtifacts.js

@@ -0,0 +1,44 @@
+import { sha256Utf8 } from '../common/sha256.js';
+export const AWS_PLUGIN_PUBLIC_ARTIFACT_SCHEMA_VERSION = 1;
+export const AWS_PLUGIN_SOURCE_ARTIFACT_TYPES = [
+    'account-summary',
+    'resource-collection',
+    'ai-cost-summary',
+    'relationships',
+    'lifecycle',
+    'recommendations',
+    'recommendation-actionability',
+    'commitment-analysis',
+    'reliability',
+    'account-governance',
+];
+export const AWS_PLUGIN_SUBSCRIPTION_SECTIONS = [
+    'account-summary',
+    'resources',
+    'ai-cost-summary',
+    'service-retirement',
+    'recommendations',
+    'commitment-analysis',
+    'reliability',
+    'account-governance',
+];
+export const AWS_PLUGIN_RESOURCE_SECTIONS = ['resource', 'relationships', 'service-retirement', 'recommendations'];
+/** Builds the path-free subscription logical name from a target-key SHA-256. */
+export function buildAwsPluginSubscriptionLogicalName(targetKeySha256) {
+    return `plugin-subscription--${normalizeSha256(targetKeySha256, 'targetKeySha256')}.json.gz`;
+}
+/** Builds the path-free resource logical name from stable and target SHA-256 values. */
+export function buildAwsPluginResourceLogicalName(stableKeySha256, targetKeySha256) {
+    return `plugin-resource--${normalizeSha256(stableKeySha256, 'stableKeySha256')}--${normalizeSha256(targetKeySha256, 'targetKeySha256')}.json.gz`;
+}
+/** Browser-safe SHA-256 used to bind stable and target identity to logical names. */
+export function sha256AwsPluginIdentity(value) {
+    return sha256Utf8(value);
+}
+function normalizeSha256(value, field) {
+    const normalized = value.trim().toLowerCase();
+    if (!/^[a-f0-9]{64}$/.test(normalized)) {
+        throw new Error(`${field} must be a lowercase hexadecimal SHA-256.`);
+    }
+    return normalized;
+}