@spottoai/types-package 1.0.2-dev1138.1 → 1.0.2-dev1138.12

package/dist/esm/environment/references.js

@@ -0,0 +1,230 @@
+import { ENVIRONMENT_ARTIFACT_KINDS_V1, ENVIRONMENT_CONTRACT_LIMITS_V1, } from './contracts.js';
+import { hasControlCharacter, isBoundedString, utf8ByteLength } from './internal.js';
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+const ARTIFACT_PREFIX = 'spotto://artifact/v1/';
+const RESOURCE_PREFIX = 'spotto://resource/v1/';
+const ARTIFACT_KINDS = new Set(ENVIRONMENT_ARTIFACT_KINDS_V1);
+const isCanonicalScopeQualifiedSubject = (value) => {
+    try {
+        const parsed = JSON.parse(value);
+        return (Array.isArray(parsed) &&
+            ((parsed.length === 4 && parsed[0] === 'azure-subscription') || (parsed.length === 2 && parsed[0] === 'azure-tenant')) &&
+            parsed
+                .slice(1)
+                .every(item => isBoundedString(item, ENVIRONMENT_CONTRACT_LIMITS_V1.scopeIdentifierScalars, { trimmed: true, controls: true })) &&
+            JSON.stringify(parsed) === value);
+    }
+    catch {
+        return false;
+    }
+};
+const encodeUtf8 = (value) => {
+    const bytes = [];
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        if (codePoint <= 0x7f)
+            bytes.push(codePoint);
+        else if (codePoint <= 0x7ff)
+            bytes.push(0xc0 | (codePoint >> 6), 0x80 | (codePoint & 0x3f));
+        else if (codePoint <= 0xffff)
+            bytes.push(0xe0 | (codePoint >> 12), 0x80 | ((codePoint >> 6) & 0x3f), 0x80 | (codePoint & 0x3f));
+        else
+            bytes.push(0xf0 | (codePoint >> 18), 0x80 | ((codePoint >> 12) & 0x3f), 0x80 | ((codePoint >> 6) & 0x3f), 0x80 | (codePoint & 0x3f));
+    }
+    return bytes;
+};
+const encodeBase64Url = (bytes) => {
+    let output = '';
+    for (let index = 0; index < bytes.length; index += 3) {
+        const first = bytes[index];
+        const second = bytes[index + 1];
+        const third = bytes[index + 2];
+        output += BASE64URL_ALPHABET[first >> 2];
+        output += BASE64URL_ALPHABET[((first & 0x03) << 4) | ((second ?? 0) >> 4)];
+        if (second !== undefined)
+            output += BASE64URL_ALPHABET[((second & 0x0f) << 2) | ((third ?? 0) >> 6)];
+        if (third !== undefined)
+            output += BASE64URL_ALPHABET[third & 0x3f];
+    }
+    return output;
+};
+const decodeBase64Url = (value) => {
+    if (!/^[A-Za-z0-9_-]+$/u.test(value) || value.length % 4 === 1)
+        return null;
+    const bytes = [];
+    for (let index = 0; index < value.length; index += 4) {
+        const first = BASE64URL_ALPHABET.indexOf(value[index]);
+        const second = BASE64URL_ALPHABET.indexOf(value[index + 1]);
+        const thirdCharacter = value[index + 2];
+        const fourthCharacter = value[index + 3];
+        const third = thirdCharacter === undefined ? 0 : BASE64URL_ALPHABET.indexOf(thirdCharacter);
+        const fourth = fourthCharacter === undefined ? 0 : BASE64URL_ALPHABET.indexOf(fourthCharacter);
+        if (first < 0 || second < 0 || third < 0 || fourth < 0)
+            return null;
+        bytes.push((first << 2) | (second >> 4));
+        if (thirdCharacter !== undefined)
+            bytes.push(((second & 0x0f) << 4) | (third >> 2));
+        if (fourthCharacter !== undefined)
+            bytes.push(((third & 0x03) << 6) | fourth);
+    }
+    return encodeBase64Url(bytes) === value ? bytes : null;
+};
+const decodeUtf8 = (bytes) => {
+    let output = '';
+    for (let index = 0; index < bytes.length;) {
+        const first = bytes[index];
+        let codePoint;
+        let continuationCount;
+        if (first <= 0x7f) {
+            codePoint = first;
+            continuationCount = 0;
+        }
+        else if (first >= 0xc2 && first <= 0xdf) {
+            codePoint = first & 0x1f;
+            continuationCount = 1;
+        }
+        else if (first >= 0xe0 && first <= 0xef) {
+            codePoint = first & 0x0f;
+            continuationCount = 2;
+        }
+        else if (first >= 0xf0 && first <= 0xf4) {
+            codePoint = first & 0x07;
+            continuationCount = 3;
+        }
+        else
+            return null;
+        if (index + continuationCount >= bytes.length)
+            return null;
+        for (let offset = 1; offset <= continuationCount; offset += 1) {
+            const next = bytes[index + offset];
+            if ((next & 0xc0) !== 0x80)
+                return null;
+            codePoint = (codePoint << 6) | (next & 0x3f);
+        }
+        if ((continuationCount === 2 && codePoint < 0x800) ||
+            (continuationCount === 3 && codePoint < 0x10000) ||
+            (codePoint >= 0xd800 && codePoint <= 0xdfff) ||
+            codePoint > 0x10ffff) {
+            return null;
+        }
+        output += String.fromCodePoint(codePoint);
+        index += continuationCount + 1;
+    }
+    return output;
+};
+const decodePayload = (value) => {
+    const bytes = decodeBase64Url(value);
+    if (bytes === null || bytes.length > ENVIRONMENT_CONTRACT_LIMITS_V1.logicalReferencePayloadBytes)
+        return null;
+    const decoded = decodeUtf8(bytes);
+    if (decoded === null || encodeBase64Url(encodeUtf8(decoded)) !== value)
+        return null;
+    return decoded;
+};
+const assertReferencePayload = (value, label, maximumScalars) => {
+    if (!isBoundedString(value, maximumScalars, { trimmed: true, controls: true })) {
+        throw new TypeError(`${label} must be a non-empty, trimmed, bounded Unicode string without control characters.`);
+    }
+    if (utf8ByteLength(value) > ENVIRONMENT_CONTRACT_LIMITS_V1.logicalReferencePayloadBytes) {
+        throw new RangeError(`${label} exceeds the V1 logical-reference payload limit.`);
+    }
+};
+const isCanonicalAzureResourceId = (value) => {
+    if (!/^\/subscriptions\/[^/]+\/(?:resourceGroups\/[^/]+\/)?providers\/[^/]+\/[^/]+\/[^/]+(?:\/[^/]+\/[^/]+)*$/iu.test(value) ||
+        value.includes('\\') ||
+        value.includes('?') ||
+        value.includes('#') ||
+        value.includes('%') ||
+        hasControlCharacter(value)) {
+        return false;
+    }
+    return value.split('/').every(segment => segment !== '.' && segment !== '..');
+};
+/** Builds an opaque logical artifact reference. The decoded subject is never a storage path. */
+export const buildEnvironmentLogicalArtifactReferenceV1 = (artifactKind, canonicalScopeQualifiedSubject) => {
+    if (!ARTIFACT_KINDS.has(artifactKind))
+        throw new TypeError('Unsupported V1 environment artifact kind.');
+    assertReferencePayload(canonicalScopeQualifiedSubject, 'Artifact subject', ENVIRONMENT_CONTRACT_LIMITS_V1.customerStringScalars);
+    if (!isCanonicalScopeQualifiedSubject(canonicalScopeQualifiedSubject)) {
+        throw new TypeError('Artifact subject is not a canonical V1 scope-qualified subject.');
+    }
+    return `${ARTIFACT_PREFIX}${artifactKind}/${encodeBase64Url(encodeUtf8(canonicalScopeQualifiedSubject))}`;
+};
+/** Parses a V1 logical artifact reference into its allowlisted kind and opaque subject. */
+export const parseEnvironmentLogicalArtifactReferenceV1 = (value) => {
+    if (typeof value !== 'string' || !value.startsWith(ARTIFACT_PREFIX))
+        return null;
+    const remainder = value.slice(ARTIFACT_PREFIX.length);
+    const separator = remainder.indexOf('/');
+    if (separator <= 0 || remainder.indexOf('/', separator + 1) >= 0)
+        return null;
+    const artifactKind = remainder.slice(0, separator);
+    if (!ARTIFACT_KINDS.has(artifactKind))
+        return null;
+    const subject = decodePayload(remainder.slice(separator + 1));
+    if (subject === null || !isCanonicalScopeQualifiedSubject(subject)) {
+        return null;
+    }
+    return { kind: 'artifact', artifactKind: artifactKind, subject };
+};
+/** Builds an opaque logical Azure resource reference from a canonical resource ID. */
+export const buildEnvironmentLogicalResourceReferenceV1 = (canonicalAzureResourceId) => {
+    assertReferencePayload(canonicalAzureResourceId, 'Azure resource ID', ENVIRONMENT_CONTRACT_LIMITS_V1.scopeIdentifierScalars);
+    if (!isCanonicalAzureResourceId(canonicalAzureResourceId))
+        throw new TypeError('Azure resource ID is not canonical or safe.');
+    return `${RESOURCE_PREFIX}${encodeBase64Url(encodeUtf8(canonicalAzureResourceId))}`;
+};
+/** Parses a V1 logical resource reference into a canonical Azure resource ID. */
+export const parseEnvironmentLogicalResourceReferenceV1 = (value) => {
+    if (typeof value !== 'string' || !value.startsWith(RESOURCE_PREFIX))
+        return null;
+    const resourceId = decodePayload(value.slice(RESOURCE_PREFIX.length));
+    if (resourceId === null || !isCanonicalAzureResourceId(resourceId))
+        return null;
+    return { kind: 'resource', resourceId };
+};
+/**
+ * Derives the canonical Azure resource type from a canonical ARM resource ID.
+ * Resource names are consumed structurally, so a resource named `providers`
+ * cannot be mistaken for an extension-resource provider boundary.
+ */
+export const deriveEnvironmentAzureResourceTypeV1 = (canonicalAzureResourceId) => {
+    if (!isCanonicalAzureResourceId(canonicalAzureResourceId))
+        return null;
+    const segments = canonicalAzureResourceId.toLowerCase().split('/').filter(Boolean);
+    const firstProviderIndex = segments.indexOf('providers');
+    if (firstProviderIndex < 0)
+        return null;
+    let providerIndex = firstProviderIndex;
+    let namespace = segments[providerIndex + 1];
+    let typeSegments = [];
+    let index = providerIndex + 2;
+    while (namespace && index < segments.length) {
+        const typeOrProviderMarker = segments[index];
+        if (!typeOrProviderMarker)
+            return null;
+        if (typeOrProviderMarker === 'providers') {
+            providerIndex = index;
+            namespace = segments[providerIndex + 1];
+            typeSegments = [];
+            index = providerIndex + 2;
+            continue;
+        }
+        typeSegments.push(typeOrProviderMarker);
+        if (segments[index + 1] === undefined)
+            return null;
+        index += 2;
+    }
+    if (!namespace || typeSegments.length === 0)
+        return null;
+    const resourceType = `${namespace}/${typeSegments.join('/')}`;
+    return [...resourceType].length <= ENVIRONMENT_CONTRACT_LIMITS_V1.safeLabelScalars ? resourceType : null;
+};
+/** Parses either closed V1 logical evidence-reference kind. */
+export const parseEnvironmentLogicalEvidenceReferenceV1 = (value) => parseEnvironmentLogicalArtifactReferenceV1(value) ?? parseEnvironmentLogicalResourceReferenceV1(value);
+/** Returns true when a value is a canonical V1 logical artifact reference. */
+export const isEnvironmentLogicalArtifactReferenceV1 = (value) => parseEnvironmentLogicalArtifactReferenceV1(value) !== null;
+/** Returns true when a value is a canonical V1 logical resource reference. */
+export const isEnvironmentLogicalResourceReferenceV1 = (value) => parseEnvironmentLogicalResourceReferenceV1(value) !== null;
+/** Returns true when a value is one of the closed V1 logical evidence-reference kinds. */
+export const isEnvironmentLogicalEvidenceReferenceV1 = (value) => parseEnvironmentLogicalEvidenceReferenceV1(value) !== null;

package/dist/esm/environment/tenant.js

@@ -0,0 +1,190 @@
+import { ENVIRONMENT_CONTRACT_LIMITS_V1 } from './contracts.js';
+import { ENVIRONMENT_RUN_ID_PATTERN, SHA256_PATTERN, hasExactKeys, hasSafeContainerShape, isBoundedString, isCanonicalUtcTimestamp, isNonNegativeInteger, isRecord, isSafeLabel, isScopeIdentifier, isSourceIdentity, utf8ByteLength, } from './internal.js';
+import { isEnvironmentLogicalEvidenceReferenceV1 } from './references.js';
+import { isEnvironmentCoverageStateV1 } from './validation.js';
+export const ENVIRONMENT_TENANT_DOCUMENT_NAMES_V1 = [
+    'projection.json',
+    'environment-index.md',
+    'identity.md',
+    'governance.md',
+    'commitments.md',
+];
+const REFERENCE_PATTERN = /^spotto:\/\/(?:artifact|resource)\/v1\//u;
+const SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'informational', 'unknown']);
+const PRINCIPAL_TYPES = new Set(['user', 'group', 'servicePrincipal', 'unknown']);
+const ASSIGNMENT_MODES = new Set(['permanent', 'eligible', 'active', 'unknown']);
+/** Builds the canonical logical subject for a tenant environment artifact. */
+export const buildEnvironmentTenantScopeQualifiedSubjectV1 = (scope) => {
+    if (!isEnvironmentTenantScopeV1(scope))
+        throw new TypeError('Invalid tenant environment scope.');
+    return JSON.stringify([scope.kind, scope.tenantId]);
+};
+/** Validates a tenant environment scope. */
+export const isEnvironmentTenantScopeV1 = (value) => isRecord(value) && hasExactKeys(value, ['kind', 'tenantId']) && value.kind === 'azure-tenant' && isScopeIdentifier(value.tenantId);
+/** Validates the completed tenant-sync generation bound to a tenant environment generation. */
+export const isEnvironmentTenantSourceBindingV1 = (value) => isRecord(value) &&
+    hasExactKeys(value, ['kind', 'scope', 'tenantSyncRunId', 'completedAt']) &&
+    value.kind === 'azure-tenant-sync' &&
+    isEnvironmentTenantScopeV1(value.scope) &&
+    isSourceIdentity(value.tenantSyncRunId) &&
+    isCanonicalUtcTimestamp(value.completedAt);
+const scopesEqual = (left, right) => left.tenantId === right.tenantId;
+const isReferenceArray = (value) => Array.isArray(value) && value.length <= ENVIRONMENT_CONTRACT_LIMITS_V1.boundedListItems && value.every(isEnvironmentLogicalEvidenceReferenceV1);
+const isBoundedList = (value, itemGuard) => isRecord(value) &&
+    hasExactKeys(value, ['items', 'totalCount', 'includedCount', 'truncated'], ['continuationReference']) &&
+    Array.isArray(value.items) &&
+    value.items.length <= ENVIRONMENT_CONTRACT_LIMITS_V1.boundedListItems &&
+    value.items.every(itemGuard) &&
+    isNonNegativeInteger(value.totalCount) &&
+    value.includedCount === value.items.length &&
+    value.totalCount >= value.includedCount &&
+    value.truncated === value.totalCount > value.includedCount &&
+    (value.continuationReference === undefined || isEnvironmentLogicalEvidenceReferenceV1(value.continuationReference)) &&
+    (!value.truncated || value.continuationReference !== undefined);
+const isCountRecord = (value, keys) => isRecord(value) && hasExactKeys(value, keys) && keys.every(key => isNonNegativeInteger(value[key]));
+const isGlobalAdministrator = (value) => isRecord(value) &&
+    hasExactKeys(value, ['principalId', 'safeLabel', 'principalType', 'assignmentModes', 'mfaStatus', 'sourceReferences']) &&
+    isScopeIdentifier(value.principalId) &&
+    isSafeLabel(value.safeLabel) &&
+    typeof value.principalType === 'string' &&
+    PRINCIPAL_TYPES.has(value.principalType) &&
+    Array.isArray(value.assignmentModes) &&
+    value.assignmentModes.length <= 4 &&
+    value.assignmentModes.every(mode => typeof mode === 'string' && ASSIGNMENT_MODES.has(mode)) &&
+    new Set(value.assignmentModes).size === value.assignmentModes.length &&
+    (value.mfaStatus === 'mfa' || value.mfaStatus === 'unknown') &&
+    isReferenceArray(value.sourceReferences);
+const isGovernanceFinding = (value) => isRecord(value) &&
+    hasExactKeys(value, ['findingId', 'safeLabel', 'severity', 'sourceReferences'], ['category', 'scopeType']) &&
+    isScopeIdentifier(value.findingId) &&
+    isSafeLabel(value.safeLabel) &&
+    typeof value.severity === 'string' &&
+    SEVERITIES.has(value.severity) &&
+    (value.category === undefined || isSafeLabel(value.category)) &&
+    (value.scopeType === undefined || isSafeLabel(value.scopeType)) &&
+    isReferenceArray(value.sourceReferences);
+const isCommitment = (value) => isRecord(value) &&
+    hasExactKeys(value, ['commitmentId', 'kind', 'safeLabel', 'sourceReferences'], ['status', 'expiry', 'quantity']) &&
+    isScopeIdentifier(value.commitmentId) &&
+    (value.kind === 'reservation' || value.kind === 'savings-plan') &&
+    isSafeLabel(value.safeLabel) &&
+    (value.status === undefined || isSafeLabel(value.status)) &&
+    (value.expiry === undefined || isCanonicalUtcTimestamp(value.expiry)) &&
+    (value.quantity === undefined || isNonNegativeInteger(value.quantity)) &&
+    isReferenceArray(value.sourceReferences);
+const isWarning = (value) => isRecord(value) &&
+    hasExactKeys(value, ['code', 'safeLabel', 'sourceReferences'], ['pillar', 'detail']) &&
+    isScopeIdentifier(value.code) &&
+    isSafeLabel(value.safeLabel) &&
+    value.pillar === undefined &&
+    (value.detail === undefined || isBoundedString(value.detail, ENVIRONMENT_CONTRACT_LIMITS_V1.customerStringScalars, { controls: true })) &&
+    isReferenceArray(value.sourceReferences);
+/** Validates the strict tenant environment projection. */
+export const isEnvironmentTenantProjectionV1 = (value) => {
+    if (!hasSafeContainerShape(value) || !isRecord(value))
+        return false;
+    if (!hasExactKeys(value, [
+        'schemaVersion',
+        'scope',
+        'sourceBinding',
+        'generatedAt',
+        'tenant',
+        'sourceCoverage',
+        'identitySummary',
+        'governanceSummary',
+        'commitmentSummary',
+        'globalAdministrators',
+        'governanceFindings',
+        'commitments',
+        'warnings',
+        'sourceReferences',
+    ]) ||
+        value.schemaVersion !== 1 ||
+        !isEnvironmentTenantScopeV1(value.scope) ||
+        !isEnvironmentTenantSourceBindingV1(value.sourceBinding) ||
+        !scopesEqual(value.scope, value.sourceBinding.scope) ||
+        !isCanonicalUtcTimestamp(value.generatedAt) ||
+        Date.parse(value.generatedAt) < Date.parse(value.sourceBinding.completedAt) ||
+        !isRecord(value.tenant) ||
+        !hasExactKeys(value.tenant, ['safeLabel']) ||
+        !isSafeLabel(value.tenant.safeLabel) ||
+        !isRecord(value.sourceCoverage) ||
+        !hasExactKeys(value.sourceCoverage, ['tenantSync', 'governance', 'identity', 'commitments']) ||
+        !Object.values(value.sourceCoverage).every(isEnvironmentCoverageStateV1) ||
+        !isCountRecord(value.identitySummary, [
+            'applicationCount',
+            'servicePrincipalCount',
+            'globalAdministratorCount',
+            'permanentGlobalAdministratorCount',
+            'eligibleGlobalAdministratorCount',
+            'mfaKnownGlobalAdministratorCount',
+        ]) ||
+        !isCountRecord(value.governanceSummary, [
+            'managementGroupCount',
+            'subscriptionCount',
+            'policyAssignmentCount',
+            'policyExemptionCount',
+            'roleAssignmentCount',
+            'privilegedAssignmentCount',
+            'customRoleCount',
+            'findingCount',
+        ]) ||
+        !isCountRecord(value.commitmentSummary, ['reservationCount', 'savingsPlanCount', 'expiringWithin90DaysCount']) ||
+        !isBoundedList(value.globalAdministrators, isGlobalAdministrator) ||
+        !isBoundedList(value.governanceFindings, isGovernanceFinding) ||
+        !isBoundedList(value.commitments, isCommitment) ||
+        !isBoundedList(value.warnings, isWarning) ||
+        !isReferenceArray(value.sourceReferences)) {
+        return false;
+    }
+    return utf8ByteLength(JSON.stringify(value)) <= ENVIRONMENT_CONTRACT_LIMITS_V1.projectionBytes;
+};
+const descriptorLimit = (name) => name === 'projection.json' ? ENVIRONMENT_CONTRACT_LIMITS_V1.projectionBytes : ENVIRONMENT_CONTRACT_LIMITS_V1.environmentIndexBytes;
+/** Validates one tenant environment document descriptor. */
+export const isEnvironmentTenantDocumentDescriptorV1 = (value) => isRecord(value) &&
+    hasExactKeys(value, ['name', 'mediaType', 'byteCount', 'contentSha256', 'approximateTokenCount']) &&
+    typeof value.name === 'string' &&
+    ENVIRONMENT_TENANT_DOCUMENT_NAMES_V1.includes(value.name) &&
+    value.mediaType === (value.name === 'projection.json' ? 'application/json' : 'text/markdown; charset=utf-8') &&
+    isNonNegativeInteger(value.byteCount) &&
+    value.byteCount > 0 &&
+    value.byteCount <= descriptorLimit(value.name) &&
+    typeof value.contentSha256 === 'string' &&
+    SHA256_PATTERN.test(value.contentSha256) &&
+    isNonNegativeInteger(value.approximateTokenCount);
+/** Validates the exact five-file tenant environment descriptor set. */
+export const isEnvironmentTenantDocumentDescriptorSetV1 = (value) => Array.isArray(value) &&
+    value.length === ENVIRONMENT_TENANT_DOCUMENT_NAMES_V1.length &&
+    value.every(isEnvironmentTenantDocumentDescriptorV1) &&
+    new Set(value.map(item => item.name)).size === ENVIRONMENT_TENANT_DOCUMENT_NAMES_V1.length;
+/** Builds the canonical tenant tree-digest preimage. */
+export const buildEnvironmentTenantTreeDigestPreimageV1 = (descriptors) => {
+    if (!isEnvironmentTenantDocumentDescriptorSetV1(descriptors))
+        throw new TypeError('Invalid tenant environment descriptor set.');
+    return JSON.stringify(descriptors
+        .map(descriptor => [descriptor.name, descriptor.contentSha256])
+        .sort((left, right) => (left[0] < right[0] ? -1 : left[0] > right[0] ? 1 : 0)));
+};
+/** Validates the atomically visible tenant environment completion pointer. */
+export const isEnvironmentTenantCompiledGenerationPointerV1 = (value) => hasSafeContainerShape(value) &&
+    isRecord(value) &&
+    hasExactKeys(value, ['schemaVersion', 'status', 'environmentRunId', 'scope', 'sourceBinding', 'treeDigestSha256', 'fileCount', 'generatedAt']) &&
+    value.schemaVersion === 1 &&
+    value.status === 'completed' &&
+    typeof value.environmentRunId === 'string' &&
+    value.environmentRunId.length <= ENVIRONMENT_CONTRACT_LIMITS_V1.environmentRunIdAsciiCharacters &&
+    ENVIRONMENT_RUN_ID_PATTERN.test(value.environmentRunId) &&
+    value.environmentRunId !== '.' &&
+    value.environmentRunId !== '..' &&
+    isEnvironmentTenantScopeV1(value.scope) &&
+    isEnvironmentTenantSourceBindingV1(value.sourceBinding) &&
+    scopesEqual(value.scope, value.sourceBinding.scope) &&
+    value.environmentRunId !== value.sourceBinding.tenantSyncRunId &&
+    typeof value.treeDigestSha256 === 'string' &&
+    SHA256_PATTERN.test(value.treeDigestSha256) &&
+    value.fileCount === ENVIRONMENT_TENANT_DOCUMENT_NAMES_V1.length &&
+    isCanonicalUtcTimestamp(value.generatedAt) &&
+    Date.parse(value.generatedAt) >= Date.parse(value.sourceBinding.completedAt) &&
+    utf8ByteLength(JSON.stringify(value)) <= ENVIRONMENT_CONTRACT_LIMITS_V1.completedPointerBytes;
+/** Narrow syntax guard used before tenant references are passed to the common parser. */
+export const isEnvironmentTenantLogicalReferenceV1 = (value) => typeof value === 'string' && REFERENCE_PATTERN.test(value) && isEnvironmentLogicalEvidenceReferenceV1(value);