@spottoai/types-package 1.0.2-dev1138.12 → 1.0.2-dev1138.14

package/dist/esm/aws/commitmentsPlanningValidation.js

@@ -1,5 +1,6 @@
 import { ProviderName } from '../common/provider.js';
-import { asRecord, assertAccount, assertExactKeys, assertValue } from './pluginPublicArtifactValidationHelpers.js';
+import { asRecord, assertExactKeys, assertValue } from '../common/validationHelpers.js';
+import { assertAccount } from './validationHelpers.js';
 const FORBIDDEN_AWS_COMMITMENTS_KEYS = new Set([
     'billingScopeId',
     'breakCostEstimate',

package/dist/esm/aws/index.js

@@ -1,23 +1,12 @@
 export * from './estates.js';
+export * from './commitmentsPlanningView.js';
 export * from './commitmentsPlanningValidation.js';
 export * from './organizationCommitments.js';
 export * from './organizationCommitmentsApiValidation.js';
 export * from './organizationCommitmentsValidation.js';
 export * from './onboarding.js';
-export * from './pluginPublicArtifacts.js';
-export * from './pluginPublicArtifactEvidence.js';
-export * from './pluginPublicArtifactValidation.js';
-export * from './portalPublicArtifacts.js';
-export * from './portalCommitmentsPlanningPublicArtifacts.js';
-export * from './portalCommitmentsPlanningPublicArtifactValidation.js';
 export * from './portalOrganizationCommitmentsPlanningPublicArtifacts.js';
 export * from './portalOrganizationCommitmentsPlanningPublicArtifactValidation.js';
-export * from './portalRelationshipPublicArtifacts.js';
-export * from './portalRelationshipResourceNodeTypes.js';
-export * from './portalRelationshipPublicArtifactValidation.js';
-export * from './portalPublicArtifactHistoryTypes.js';
-export * from './portalPublicArtifactNestedEvidence.js';
-export * from './portalPublicArtifactNestedEvidenceValidation.js';
-export * from './portalPublicArtifactValidation.js';
 export * from './publicArtifacts.js';
 export * from './requests.js';
+export * from './resourceGraph.js';

package/dist/esm/aws/organizationCommitments.js

@@ -1,4 +1,4 @@
-import { sha256AwsPluginIdentity } from './pluginPublicArtifacts.js';
+import { sha256Hex } from '../common/sha256.js';
 export const AWS_ORGANIZATION_COMMITMENTS_SCHEMA_VERSION = 1;
 export const AWS_ORGANIZATION_COMMITMENTS_REFRESH_STAGES = [
     'account-inventory',
@@ -38,7 +38,7 @@ export const AWS_ORGANIZATION_COMMITMENTS_SESSION_ID_PREFIX = 'aws-org-commitmen
 export function buildAwsOrganizationCommitmentsSessionId(companyId, estateId) {
     const company = requiredSessionIdentity(companyId, 'companyId');
     const estate = requiredSessionIdentity(estateId, 'estateId');
-    return `${AWS_ORGANIZATION_COMMITMENTS_SESSION_ID_PREFIX}${sha256AwsPluginIdentity(JSON.stringify(['aws-organization-commitments', company, estate]))}`;
+    return `${AWS_ORGANIZATION_COMMITMENTS_SESSION_ID_PREFIX}${sha256Hex(JSON.stringify(['aws-organization-commitments', company, estate]))}`;
 }
 function requiredSessionIdentity(value, field) {
     if (typeof value !== 'string' || value.trim() !== value || value.length === 0) {

package/dist/esm/aws/organizationCommitmentsApiValidation.js

@@ -1,6 +1,6 @@
 import { AWS_ORGANIZATION_COMMITMENTS_ISSUE_CODES, AWS_ORGANIZATION_COMMITMENTS_REFRESH_STAGES, AWS_ORGANIZATION_COMMITMENTS_REFRESH_STAGE_STATUSES, AWS_ORGANIZATION_COMMITMENTS_REFRESH_STATES, AWS_ORGANIZATION_COMMITMENTS_SCHEMA_VERSION, AWS_ORGANIZATION_COMMITMENTS_SCOPE_UNAVAILABLE_REASONS, } from './organizationCommitments.js';
-import { asRecord, assertExactKeys, assertPublicJson, assertValue, isoTimestamp, nonNegativeInteger, requiredBoolean, requiredEnum, requiredString, validateGeneration, } from './portalPublicArtifactValidationCommon.js';
-import { assertAccount } from './pluginPublicArtifactValidationHelpers.js';
+import { asRecord, assertExactKeys, assertValue, isoTimestamp, nonNegativeInteger, requiredBoolean, requiredEnum, requiredString, validateGeneration, } from '../common/validationHelpers.js';
+import { assertAccount, assertAwsPublicJson } from './validationHelpers.js';
 const ORGANIZATION_ID = /^o-[a-z0-9]{10,32}$/u;
 /** Validates one API-authored organization commitments refresh receipt. */
 export function validateAwsOrganizationCommitmentsRefreshAcceptedResponse(value, expected) {
@@ -32,7 +32,7 @@ export function validateAwsOrganizationCommitmentsRefreshAcceptedResponse(value,
             throw new Error('organizationCommitmentsAdmission.nextEligibleAt must be later than acceptedAt.');
         }
     }
-    assertPublicJson(response, 'organizationCommitmentsAdmission');
+    assertAwsPublicJson(response, 'organizationCommitmentsAdmission');
     return value;
 }
 /** Validates the safe organization scope selector response for one company. */
@@ -73,7 +73,7 @@ export function validateAwsOrganizationCommitmentsScopeListResponse(value, expec
     });
     assertUniqueSorted(estateIds, 'organizationCommitmentsScopes.organizations estateId');
     assertUnique(organizationIds, 'organizationCommitmentsScopes.organizations organizationId');
-    assertPublicJson(response, 'organizationCommitmentsScopes');
+    assertAwsPublicJson(response, 'organizationCommitmentsScopes');
     return value;
 }
 /** Validates one sanitized Blob-backed organization commitments status projection. */
@@ -132,7 +132,7 @@ export function validateAwsOrganizationCommitmentsRefreshStatusResponse(value, e
     if (state === 'fresh' && response.latestArtifact === undefined) {
         throw new Error('organizationCommitmentsStatus.latestArtifact is required when the refresh is fresh.');
     }
-    assertPublicJson(response, 'organizationCommitmentsStatus');
+    assertAwsPublicJson(response, 'organizationCommitmentsStatus');
     return value;
 }
 function validateStages(value) {

package/dist/esm/aws/organizationCommitmentsValidation.js

@@ -1,5 +1,6 @@
 import { ProviderName } from '../common/provider.js';
-import { asRecord, assertAccount, assertExactKeys, assertValue, requiredEnum, requiredString } from './pluginPublicArtifactValidationHelpers.js';
+import { asRecord, assertExactKeys, assertValue, requiredEnum, requiredString } from '../common/validationHelpers.js';
+import { assertAccount } from './validationHelpers.js';
 const ORGANIZATION_ID = /^o-[a-z0-9]{10,32}$/u;
 const FORBIDDEN_ORGANIZATION_COMMITMENTS_KEYS = new Set([
     'billingScopeId',

package/dist/esm/aws/portalOrganizationCommitmentsPlanningPublicArtifactValidation.js

@@ -1,8 +1,10 @@
+import { assertCommitmentsFreshnessDiagnostics } from '../azure/commitmentsPlanningValidation.js';
 import { AWS_ORGANIZATION_COMMITMENTS_ATTRIBUTION_UNAVAILABLE_REASONS, } from './organizationCommitments.js';
 import { validateAwsOrganizationCommitmentsPlanningViewIdentity, } from './organizationCommitmentsValidation.js';
 import { AWS_ORGANIZATION_COMMITMENTS_PLANNING_LOGICAL_NAME, AWS_ORGANIZATION_COMMITMENTS_PUBLIC_ARTIFACT_SCHEMA_VERSION, } from './portalOrganizationCommitmentsPlanningPublicArtifacts.js';
-import { AWS_PORTAL_PUBLIC_ARTIFACT_SCHEMA_VERSION } from './portalPublicArtifacts.js';
-import { asRecord, assertExactKeys, assertPublicJson, assertValue, finiteNumber, isoTimestamp, requiredEnum, requiredString, validateGeneration, } from './portalPublicArtifactValidationCommon.js';
+import { AWS_PORTAL_PUBLIC_ARTIFACT_SCHEMA_VERSION } from './publicArtifacts.js';
+import { asRecord, assertExactKeys, assertValue, finiteNumber, isoTimestamp, requiredEnum, requiredString, validateGeneration, } from '../common/validationHelpers.js';
+import { assertAwsPublicJson } from './validationHelpers.js';
 const TOP_LEVEL_KEYS = [
     'schemaVersion',
     'portalSchemaVersion',
@@ -31,7 +33,7 @@ const TOP_LEVEL_KEYS = [
 export function validateAwsOrganizationCommitmentsPlanningView(value, expected) {
     validateAwsOrganizationCommitmentsPlanningViewIdentity(value, expected);
     validateBody(value);
-    assertPublicJson(value, 'organizationCommitmentsPlanning');
+    assertAwsPublicJson(value, 'organizationCommitmentsPlanning');
     return value;
 }
 /** Validates one untrusted immutable AWS organization Commitments Planning artifact. */
@@ -53,7 +55,7 @@ export function validateAwsPortalOrganizationCommitmentsPlanningArtifact(value,
     if (artifact.month !== undefined)
         requiredString(artifact.month, 'artifact.month');
     validateAwsOrganizationCommitmentsPlanningView(artifact, expected);
-    assertPublicJson(artifact, 'artifact');
+    assertAwsPublicJson(artifact, 'artifact');
     return value;
 }
 function validateBody(view) {
@@ -344,7 +346,7 @@ function validateFreshness(value, field) {
     requiredEnum(freshness.status, ['current', 'stale', 'partial', 'unavailable'], `${field}.status`);
     isoTimestamp(freshness.generatedAt, `${field}.generatedAt`);
     records(freshness.entries, `${field}.entries`, (entry, itemField) => {
-        const item = exact(entry, ['section', 'status', 'generatedAt', 'observedAt', 'lastSuccessfulSyncAt', 'reason', 'sourceKind'], itemField);
+        const item = exact(entry, ['section', 'status', 'generatedAt', 'observedAt', 'lastSuccessfulSyncAt', 'ageHours', 'reasonCode', 'reason', 'sourceKind'], itemField);
         requiredString(item.section, `${itemField}.section`);
         requiredEnum(item.status, ['current', 'stale', 'partial', 'unavailable'], `${itemField}.status`);
         optionalTimestamp(item.generatedAt, `${itemField}.generatedAt`);
@@ -352,6 +354,7 @@ function validateFreshness(value, field) {
         optionalTimestamp(item.lastSuccessfulSyncAt, `${itemField}.lastSuccessfulSyncAt`);
         optionalString(item.reason, `${itemField}.reason`);
         optionalString(item.sourceKind, `${itemField}.sourceKind`);
+        assertCommitmentsFreshnessDiagnostics(item, itemField);
     });
     optionalStrings(freshness.warnings, `${field}.warnings`);
 }

package/dist/esm/aws/publicArtifacts.js

@@ -1,4 +1,6 @@
 export const AWS_PUBLIC_ARTIFACT_SCHEMA_VERSION = 1;
+/** Portal envelope version shared by the AWS Portal artifacts. */
+export const AWS_PORTAL_PUBLIC_ARTIFACT_SCHEMA_VERSION = 1;
 export const AWS_PUBLIC_ARTIFACT_TYPES = [
     'resource-collection',
     'resource-collection-history',

package/dist/esm/aws/relationships.js

@@ -1 +1,4 @@
-export { validateAwsPortalRelationshipArtifact } from './portalRelationshipPublicArtifactValidation.js';
+/** Browser-safe entry for the AWS resource graph contract, its validator, and the provider-neutral graph vocabulary. */
+export * from './resourceGraph.js';
+export * from '../common/resourceGraph.js';
+export * from '../common/resourceIdentity.js';

package/dist/esm/aws/requests.js

@@ -3,9 +3,11 @@ export const AWS_COMMAND_SCHEMA_VERSION = 1;
 /** Canonical provider wire value for AWS commands. */
 export const AWS_COMMAND_PROVIDER = 'aws';
 /** Entities handled by AWS estate orchestration. */
-export const AWS_COMMAND_ENTITIES = ['estate', 'account', 'billing-source', 'organization-commitments'];
+export const AWS_COMMAND_ENTITIES = ['estate', 'account', 'billing-source', 'organization-commitments', 'scheduler'];
 /** Actions supported across AWS estate orchestration commands. */
-export const AWS_COMMAND_ACTIONS = ['reconcile', 'refresh', 'delete'];
+export const AWS_COMMAND_ACTIONS = ['reconcile', 'refresh', 'delete', 'tick'];
+/** Scheduled AWS scan cadences emitted by the enqueue-only API scheduler. */
+export const AWS_SCHEDULED_REFRESH_SCAN_KINDS = ['full', 'components'];
 /** Credential-shaped keys forbidden from shared AWS configuration and commands. */
 export const AWS_FORBIDDEN_CREDENTIAL_FIELDS = [
     'accessKeyId',

package/dist/esm/aws/resourceGraph.js

@@ -0,0 +1,63 @@
+import { validateResourceGraphArtifact, } from '../common/resourceGraphValidation.js';
+import { AWS_ACCOUNT_ID_PATTERN, AWS_REGION_PATTERN, isAwsCredentialKey, isForbiddenAwsPublicKey } from './validationHelpers.js';
+/** CloudFormation-style resource type, for example `AWS::EC2::Instance`. */
+export const AWS_RESOURCE_TYPE_PATTERN = /^AWS::[A-Za-z0-9]+::[A-Za-z0-9]+$/;
+/** Region value for account-global resources such as IAM. */
+export const AWS_GLOBAL_REGION = 'global';
+const ARN_PATTERN = /^arn:(aws(?:-[a-z0-9-]+)?):[^:]+:([^:]*):([^:]*):.+$/;
+const AVAILABILITY_ZONE_KEY_PATTERN = /(?:^a|A)vailabilityZone(?:Name)?s?$/;
+const AWS_RESOURCE_GRAPH_RULES = {
+    provider: 'aws',
+    isAccountId: value => AWS_ACCOUNT_ID_PATTERN.test(value),
+    isRegion: value => value === AWS_GLOBAL_REGION || AWS_REGION_PATTERN.test(value),
+    isResourceType: value => AWS_RESOURCE_TYPE_PATTERN.test(value),
+    validateNativeId: (nativeId, scope, field) => {
+        if (nativeId.startsWith('arn:'))
+            validateScopedArn(nativeId, scope, field, false);
+    },
+    validateZone: validateAvailabilityZone,
+    validateAttribute: validateAttributeFormat,
+    isForbiddenKey: (key, inAttributes) => (inAttributes ? isAwsCredentialKey(key) : isForbiddenAwsPublicKey(key)),
+};
+/**
+ * Validates one untrusted AWS resource graph. Adds AWS identifier formats to
+ * the generic structural checks; any discovery family is accepted.
+ */
+export function validateAwsResourceGraphArtifact(value) {
+    return validateResourceGraphArtifact(value, AWS_RESOURCE_GRAPH_RULES);
+}
+/**
+ * An ARN must stay inside its node's account and Region. Empty ARN segments
+ * (S3, IAM) are allowed; attribute references may also name AWS-owned (`aws`) resources.
+ */
+function validateScopedArn(value, scope, field, allowAwsOwned) {
+    const match = ARN_PATTERN.exec(value);
+    if (!match)
+        throw new Error(`${field} must be a canonical AWS ARN.`);
+    const [, , arnRegion, arnAccountId] = match;
+    const expectedRegion = scope.region === AWS_GLOBAL_REGION ? '' : scope.region;
+    if (arnRegion !== '' && arnRegion !== expectedRegion)
+        throw new Error(`${field} ARN Region must match its node Region.`);
+    if (arnAccountId !== '' && arnAccountId !== scope.accountId && !(allowAwsOwned && arnAccountId === 'aws'))
+        throw new Error(`${field} ARN account must match the artifact account.`);
+}
+function validateAvailabilityZone(value, region, field) {
+    if (region === AWS_GLOBAL_REGION || value === region || !value.startsWith(region))
+        throw new Error(`${field} must belong to its node Region.`);
+}
+function validateAttributeFormat(key, value, scope, field) {
+    if (key.endsWith('Arn')) {
+        if (typeof value !== 'string')
+            throw new Error(`${field} must be an ARN string.`);
+        validateScopedArn(value, scope, field, true);
+    }
+    if (AVAILABILITY_ZONE_KEY_PATTERN.test(key)) {
+        const zones = Array.isArray(value) ? value : [value];
+        zones.forEach((zone, index) => {
+            const zoneField = Array.isArray(value) ? `${field}[${index}]` : field;
+            if (typeof zone !== 'string')
+                throw new Error(`${zoneField} must be an Availability Zone name.`);
+            validateAvailabilityZone(zone, scope.region ?? AWS_GLOBAL_REGION, zoneField);
+        });
+    }
+}

package/dist/esm/aws/validationHelpers.js

@@ -0,0 +1,46 @@
+import { assertPlainJson, assertValue } from '../common/validationHelpers.js';
+import { AWS_FORBIDDEN_CREDENTIAL_FIELDS } from './requests.js';
+export const AWS_ACCOUNT_ID_PATTERN = /^\d{12}$/;
+export const AWS_REGION_PATTERN = /^[a-z]{2}(?:-gov)?-[a-z0-9-]+-\d+$/;
+/** Credential material and setup secrets; rejected at every depth of a public artifact. */
+const CREDENTIAL_KEYS = new Set([...AWS_FORBIDDEN_CREDENTIAL_FIELDS, 'externalId', 'secretReference', 'credentialReference'].map(key => key.toLowerCase()));
+/** Setup locators and engine-operational markers that never belong on a public envelope. */
+const OPERATIONAL_KEYS = new Set([
+    'roleArn',
+    'secretArn',
+    'storagePath',
+    'sourcePath',
+    'path',
+    'blobPath',
+    'containerPath',
+    'chunk',
+    'chunks',
+    'lease',
+    'retries',
+    'retry',
+    'refreshState',
+    'lastRefreshExecutionRequestId',
+    'lastRefreshExecutionRequestedAt',
+    'prompt',
+    'promptInput',
+    'sourceBytes',
+    'maxSourceBytes',
+    'bedrockRegion',
+    'guardrailId',
+    'guardrailVersion',
+    'etag',
+    'eTag',
+    'retiredAt',
+].map(key => key.toLowerCase()));
+const OPERATIONAL_KEY_PATTERN = /^(?:source|storage|blob|container)(?:path|uri|url|key)$|^s3(?:bucket|key|uri|url)$/i;
+export const isAwsCredentialKey = (key) => CREDENTIAL_KEYS.has(key.toLowerCase());
+export const isForbiddenAwsPublicKey = (key) => isAwsCredentialKey(key) || OPERATIONAL_KEYS.has(key.toLowerCase()) || OPERATIONAL_KEY_PATTERN.test(key);
+/** Rejects non-JSON values plus credential, physical-path, and operational-marker keys recursively. */
+export function assertAwsPublicJson(value, field) {
+    assertPlainJson(value, field, isForbiddenAwsPublicKey);
+}
+export function assertAccount(value, accountId, field) {
+    assertValue(value, accountId, field);
+    if (!AWS_ACCOUNT_ID_PATTERN.test(accountId))
+        throw new Error(`${field} must be a 12-digit AWS account id.`);
+}

package/dist/esm/azure/commitmentsPlanning.js

@@ -1 +1,8 @@
-export {};
+/** Every `CommitmentsFreshnessReasonCode`, for dependency-free runtime guards. */
+export const COMMITMENTS_FRESHNESS_REASON_CODES = [
+    'collection-stale',
+    'permission-denied',
+    'collection-failed',
+    'not-collected',
+    'status-invalid',
+];

package/dist/esm/azure/commitmentsPlanningValidation.js

@@ -0,0 +1,39 @@
+/** Dependency-free runtime guards for Azure commitments planning freshness evidence. */
+import { COMMITMENTS_FRESHNESS_REASON_CODES, } from './commitmentsPlanning.js';
+import { isDateTime, isFiniteNumber, isOptionalString, isRecord, isString, isStringArray } from '../common/validationHelpers.js';
+const FRESHNESS_STATUSES = ['current', 'stale', 'partial', 'unavailable'];
+const SOURCE_KINDS = ['azure-native', 'aws-native', 'spotto-derived', 'fallback-heuristic', 'manual', 'unknown'];
+export const isCommitmentsFreshnessStatus = (value) => typeof value === 'string' && FRESHNESS_STATUSES.includes(value);
+export const isCommitmentsFreshnessReasonCode = (value) => typeof value === 'string' && COMMITMENTS_FRESHNESS_REASON_CODES.includes(value);
+/** Finite, non-negative and rounded to one decimal place. */
+export const isCommitmentsFreshnessAgeHours = (value) => isFiniteNumber(value) && value >= 0 && Number(value.toFixed(1)) === value;
+/**
+ * Checks only the diagnostic fields shared by every commitments freshness producer:
+ * `ageHours` requires `lastSuccessfulSyncAt` and is a non-negative one-decimal number;
+ * `reasonCode` is a known code, and `collection-stale` appears only with status `stale`.
+ */
+export const hasValidCommitmentsFreshnessDiagnostics = (entry) => (entry.ageHours === undefined || (isCommitmentsFreshnessAgeHours(entry.ageHours) && entry.lastSuccessfulSyncAt !== undefined)) &&
+    (entry.reasonCode === undefined ||
+        (isCommitmentsFreshnessReasonCode(entry.reasonCode) && (entry.reasonCode !== 'collection-stale' || entry.status === 'stale')));
+/** Throwing form of `hasValidCommitmentsFreshnessDiagnostics` for exact public-artifact validators. */
+export function assertCommitmentsFreshnessDiagnostics(entry, field) {
+    if (!hasValidCommitmentsFreshnessDiagnostics(entry)) {
+        throw new Error(`${field} ageHours must be a non-negative one-decimal number with lastSuccessfulSyncAt, and reasonCode must be a known code (collection-stale only with status stale).`);
+    }
+}
+const isOptionalDateTime = (value) => value === undefined || isDateTime(value);
+export const isCommitmentsFreshnessEntry = (value) => isRecord(value) &&
+    isString(value.section) &&
+    isCommitmentsFreshnessStatus(value.status) &&
+    isOptionalDateTime(value.generatedAt) &&
+    isOptionalDateTime(value.observedAt) &&
+    isOptionalDateTime(value.lastSuccessfulSyncAt) &&
+    isOptionalString(value.reason) &&
+    (value.sourceKind === undefined || (typeof value.sourceKind === 'string' && SOURCE_KINDS.includes(value.sourceKind))) &&
+    hasValidCommitmentsFreshnessDiagnostics(value);
+export const isCommitmentsFreshnessSummary = (value) => isRecord(value) &&
+    isCommitmentsFreshnessStatus(value.status) &&
+    isDateTime(value.generatedAt) &&
+    Array.isArray(value.entries) &&
+    value.entries.every(isCommitmentsFreshnessEntry) &&
+    (value.warnings === undefined || isStringArray(value.warnings));

package/dist/esm/azure/payloads.js

@@ -1 +1,84 @@
-export {};
+const SCHEDULER_TICK_PREFIX_V1 = 'scheduler:tick:';
+const SCHEDULER_TICK_MAX_ID_LENGTH_V1 = 128;
+const SCHEDULER_TICK_KEYS_V1 = [
+    'schemaVersion',
+    'entity',
+    'action',
+    'companyId',
+    'cloudAccountId',
+    'tenantId',
+    'clientId',
+    'tickId',
+    'scheduledAtUtc',
+    'correlationId',
+];
+const CANONICAL_UTC_TIMESTAMP_MILLISECONDS = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u;
+const isCanonicalUtcTimestampMilliseconds = (value) => {
+    if (typeof value !== 'string' || !CANONICAL_UTC_TIMESTAMP_MILLISECONDS.test(value))
+        return false;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
+};
+const hasExactSchedulerTickKeysV1 = (value) => {
+    const keys = Object.keys(value);
+    return keys.length === SCHEDULER_TICK_KEYS_V1.length && SCHEDULER_TICK_KEYS_V1.every(key => Object.prototype.hasOwnProperty.call(value, key));
+};
+const normalizeSchedulerTickInstantV1 = (scheduledAt) => {
+    if (typeof scheduledAt === 'string') {
+        if (!isCanonicalUtcTimestampMilliseconds(scheduledAt)) {
+            throw new TypeError('Scheduler tick time must be a canonical UTC timestamp with milliseconds');
+        }
+        return scheduledAt;
+    }
+    const milliseconds = scheduledAt instanceof Date ? scheduledAt.getTime() : scheduledAt;
+    if (!Number.isFinite(milliseconds))
+        throw new TypeError('Scheduler tick time must be finite');
+    const normalized = new Date(milliseconds).toISOString();
+    if (!isCanonicalUtcTimestampMilliseconds(normalized)) {
+        throw new TypeError('Scheduler tick time must use a four-digit UTC year');
+    }
+    return normalized;
+};
+/** Creates the deterministic internal queue envelope for one cron occurrence. */
+export const createSchedulerTickRequestMessageV1 = (scheduledAt) => {
+    const scheduledAtUtc = normalizeSchedulerTickInstantV1(scheduledAt);
+    const tickId = `${SCHEDULER_TICK_PREFIX_V1}${scheduledAtUtc}`;
+    return {
+        schemaVersion: 1,
+        entity: 'scheduler',
+        action: 'tick',
+        companyId: '*',
+        cloudAccountId: '*',
+        tenantId: '*',
+        clientId: '*',
+        tickId,
+        scheduledAtUtc,
+        correlationId: tickId,
+    };
+};
+/** Exact validator for the internal scheduler tick queue boundary. */
+export const isSchedulerTickRequestMessageV1 = (value) => {
+    try {
+        if (typeof value !== 'object' || value === null || Array.isArray(value))
+            return false;
+        const candidate = value;
+        if (!hasExactSchedulerTickKeysV1(candidate) || !isCanonicalUtcTimestampMilliseconds(candidate['scheduledAtUtc'])) {
+            return false;
+        }
+        const expectedTickId = `${SCHEDULER_TICK_PREFIX_V1}${candidate['scheduledAtUtc']}`;
+        return (candidate['schemaVersion'] === 1 &&
+            candidate['entity'] === 'scheduler' &&
+            candidate['action'] === 'tick' &&
+            candidate['companyId'] === '*' &&
+            candidate['cloudAccountId'] === '*' &&
+            candidate['tenantId'] === '*' &&
+            candidate['clientId'] === '*' &&
+            typeof candidate['tickId'] === 'string' &&
+            candidate['tickId'].length <= SCHEDULER_TICK_MAX_ID_LENGTH_V1 &&
+            candidate['tickId'] === expectedTickId &&
+            candidate['correlationId'] === expectedTickId);
+    }
+    catch {
+        return false;
+    }
+};

package/dist/esm/azure/reportEvidence.js

@@ -5,6 +5,8 @@ export const REPORT_EVIDENCE_LIMITS = {
     complianceAssessments: 2000,
     activityDays: 400,
     activityMonths: 13,
+    commitmentsFreshnessEntries: 50,
+    commitmentsFreshnessWarnings: 10,
     recommendationResources: 2,
     resourceCatalogue: 2000,
     totalRecommendationResourceRows: 10000,
@@ -17,5 +19,11 @@ export const REPORT_EVIDENCE_LIMITS = {
     upcomingEvents: 20,
     historyPeriods: 13,
     historyRecommendations: 2000,
+    historyComparisonIdentities: 2000,
+    costChangePeriods: 13,
+    costChangeDrivers: 50,
+    costChangeReasons: 10,
     tenantGlobalAdministrators: 50,
 };
+/** Lowercase Azure RBAC principal types. Producers omit `principalType` when the source type is absent or outside this list. */
+export const REPORT_PRINCIPAL_TYPES = ['user', 'group', 'serviceprincipal', 'foreigngroup', 'device'];