@spottoai/types-package 1.0.2-dev1138.13 → 1.0.2-dev1138.14

package/dist/accounts/subscriptionWriteAccess.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUBSCRIPTION_WRITE_CAPABILITY_PERMISSIONS = exports.SUBSCRIPTION_WRITE_CAPABILITY_KEYS = exports.SUBSCRIPTION_WRITE_ACCESS_MAX_LISTED_ACTIONS = exports.SUBSCRIPTION_WRITE_ACCESS_MAX_LISTED_SCOPES = exports.SUBSCRIPTION_WRITE_ACCESS_SCHEMA_VERSION = void 0;
+exports.deriveSubscriptionWriteBitmasks = deriveSubscriptionWriteBitmasks;
+exports.hasEffectiveWritePermission = hasEffectiveWritePermission;
+exports.isSubscriptionWriteAccessDocumentV1 = isSubscriptionWriteAccessDocumentV1;
+const writePermissions_1 = require("./writePermissions");
+/**
+ * Effective write access for one subscription, as observed from Azure by cloud-engine on each scan.
+ *
+ * This is a fact about Azure (what the cloud account's identity is currently allowed to do), not a
+ * customer choice. Customer consent stays on the cloud account. Storage paths for the document are
+ * owned by cloud-engine; this package defines only its shape.
+ */
+exports.SUBSCRIPTION_WRITE_ACCESS_SCHEMA_VERSION = 1;
+/** Maximum narrower scopes listed per capability; `grantedScopeCount` carries the full count. */
+exports.SUBSCRIPTION_WRITE_ACCESS_MAX_LISTED_SCOPES = 50;
+/** Maximum missing actions listed per capability. */
+exports.SUBSCRIPTION_WRITE_ACCESS_MAX_LISTED_ACTIONS = 100;
+exports.SUBSCRIPTION_WRITE_CAPABILITY_KEYS = [
+    'advisorDismissSync',
+    'storageInventory',
+    'policyExemptions',
+    'resourceScheduling',
+    'remediationCleanup',
+    'remediationRightsize',
+    'commitmentsManage',
+];
+/** The WritePermission bit each capability sets in the subscription bitmasks. */
+exports.SUBSCRIPTION_WRITE_CAPABILITY_PERMISSIONS = {
+    advisorDismissSync: writePermissions_1.WritePermission.DismissRecommendations,
+    storageInventory: writePermissions_1.WritePermission.StorageInventory,
+    policyExemptions: writePermissions_1.WritePermission.PolicyExemptions,
+    resourceScheduling: writePermissions_1.WritePermission.ResourceScheduling,
+    remediationCleanup: writePermissions_1.WritePermission.RemediationCleanup,
+    remediationRightsize: writePermissions_1.WritePermission.RemediationRightsize,
+    commitmentsManage: writePermissions_1.WritePermission.CommitmentsManage,
+};
+/** Derives the subscription row bitmasks from per-capability results. `available` and `partial` set the effective bit; `partial` also sets the partial bit. */
+function deriveSubscriptionWriteBitmasks(capabilities) {
+    let effectiveWriteBitmask = 0;
+    let partialWriteBitmask = 0;
+    for (const key of exports.SUBSCRIPTION_WRITE_CAPABILITY_KEYS) {
+        const status = capabilities[key]?.status;
+        const bit = exports.SUBSCRIPTION_WRITE_CAPABILITY_PERMISSIONS[key];
+        if (status === 'available' || status === 'partial')
+            effectiveWriteBitmask |= bit;
+        if (status === 'partial')
+            partialWriteBitmask |= bit;
+    }
+    return { effectiveWriteBitmask, partialWriteBitmask };
+}
+/** True when the subscription bitmasks show the permission as granted, fully or at narrower scopes. Unknown bits from newer producers are ignored. */
+function hasEffectiveWritePermission(effectiveWriteBitmask, permission) {
+    return ((effectiveWriteBitmask ?? 0) & writePermissions_1.KNOWN_WRITE_PERMISSION_MASK & permission) === permission;
+}
+const CAPABILITY_STATUSES = ['available', 'partial', 'unavailable', 'unknown'];
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isNonEmptyString = (value) => typeof value === 'string' && value.trim().length > 0;
+const isUint32 = (value) => typeof value === 'number' && Number.isInteger(value) && value >= 0 && value <= 0xffffffff;
+const isStringArray = (value, maxLength) => Array.isArray(value) && value.length <= maxLength && value.every(isNonEmptyString);
+const isCapabilityResult = (value) => {
+    if (!isRecord(value))
+        return false;
+    if (!CAPABILITY_STATUSES.includes(value.status))
+        return false;
+    if (value.missingActions !== undefined && !isStringArray(value.missingActions, exports.SUBSCRIPTION_WRITE_ACCESS_MAX_LISTED_ACTIONS))
+        return false;
+    if (value.grantedScopes !== undefined && !isStringArray(value.grantedScopes, exports.SUBSCRIPTION_WRITE_ACCESS_MAX_LISTED_SCOPES))
+        return false;
+    if (value.grantedScopeCount !== undefined && !isUint32(value.grantedScopeCount))
+        return false;
+    if (value.reasonCode !== undefined && !isNonEmptyString(value.reasonCode))
+        return false;
+    if (value.status === 'partial' && !(isUint32(value.grantedScopeCount) && value.grantedScopeCount > 0))
+        return false;
+    return true;
+};
+/**
+ * Validates a parsed document. Unknown capability keys and bits from a newer producer are ignored;
+ * every capability known to this package version must be present, and the bitmasks must match the results.
+ */
+function isSubscriptionWriteAccessDocumentV1(value) {
+    try {
+        return isSubscriptionWriteAccessDocumentV1Unsafe(value);
+    }
+    catch {
+        return false;
+    }
+}
+function isSubscriptionWriteAccessDocumentV1Unsafe(value) {
+    if (!isRecord(value))
+        return false;
+    if (value.schemaVersion !== exports.SUBSCRIPTION_WRITE_ACCESS_SCHEMA_VERSION || value.provider !== 'azure')
+        return false;
+    if (!isNonEmptyString(value.companyId) || !isNonEmptyString(value.cloudAccountId) || !isNonEmptyString(value.subscriptionId))
+        return false;
+    if (value.principalObjectId !== undefined && !isNonEmptyString(value.principalObjectId))
+        return false;
+    if (!isNonEmptyString(value.checkedAt) || Number.isNaN(Date.parse(value.checkedAt)))
+        return false;
+    if (value.checkStatus === 'failed')
+        return isNonEmptyString(value.reasonCode);
+    if (value.checkStatus !== 'complete')
+        return false;
+    if (!isUint32(value.effectiveWriteBitmask) || !isUint32(value.partialWriteBitmask))
+        return false;
+    if ((value.partialWriteBitmask & ~value.effectiveWriteBitmask) !== 0)
+        return false;
+    if (!isRecord(value.capabilities))
+        return false;
+    const capabilities = value.capabilities;
+    if (!exports.SUBSCRIPTION_WRITE_CAPABILITY_KEYS.every(key => isCapabilityResult(capabilities[key])))
+        return false;
+    const derived = deriveSubscriptionWriteBitmasks(capabilities);
+    return ((value.effectiveWriteBitmask & writePermissions_1.KNOWN_WRITE_PERMISSION_MASK) === derived.effectiveWriteBitmask &&
+        (value.partialWriteBitmask & writePermissions_1.KNOWN_WRITE_PERMISSION_MASK) === derived.partialWriteBitmask);
+}
+//# sourceMappingURL=subscriptionWriteAccess.js.map

package/dist/accounts/subscriptionWriteAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriptionWriteAccess.js","sourceRoot":"","sources":["../../src/accounts/subscriptionWriteAccess.ts"],"names":[],"mappings":";;;AAgGA,0EAYC;AAGD,kEAEC;AA4BD,kFAMC;AAlJD,yDAAkF;AAElF;;;;;;GAMG;AACU,QAAA,wCAAwC,GAAG,CAAU,CAAC;AAEnE,iGAAiG;AACpF,QAAA,2CAA2C,GAAG,EAAW,CAAC;AAEvE,qDAAqD;AACxC,QAAA,4CAA4C,GAAG,GAAY,CAAC;AAE5D,QAAA,kCAAkC,GAAG;IAChD,oBAAoB;IACpB,kBAAkB;IAClB,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,sBAAsB;IACtB,mBAAmB;CACX,CAAC;AAIX,iFAAiF;AACpE,QAAA,yCAAyC,GAAsE;IAC1H,kBAAkB,EAAE,kCAAe,CAAC,sBAAsB;IAC1D,gBAAgB,EAAE,kCAAe,CAAC,gBAAgB;IAClD,gBAAgB,EAAE,kCAAe,CAAC,gBAAgB;IAClD,kBAAkB,EAAE,kCAAe,CAAC,kBAAkB;IACtD,kBAAkB,EAAE,kCAAe,CAAC,kBAAkB;IACtD,oBAAoB,EAAE,kCAAe,CAAC,oBAAoB;IAC1D,iBAAiB,EAAE,kCAAe,CAAC,iBAAiB;CACrD,CAAC;AAwDF,+JAA+J;AAC/J,SAAgB,+BAA+B,CAC7C,YAAkH;IAElH,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,0CAAkC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACzC,MAAM,GAAG,GAAG,iDAAyC,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS;YAAE,qBAAqB,IAAI,GAAG,CAAC;QACjF,IAAI,MAAM,KAAK,SAAS;YAAE,mBAAmB,IAAI,GAAG,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,CAAC;AACxD,CAAC;AAED,sJAAsJ;AACtJ,SAAgB,2BAA2B,CAAC,qBAAyC,EAAE,UAA2B;IAChH,OAAO,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC,GAAG,8CAA2B,GAAG,UAAU,CAAC,KAAK,UAAU,CAAC;AAClG,CAAC;AAED,MAAM,mBAAmB,GAAiD,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAE7H,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE5I,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAEnH,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,UAAU,CAAC;AAEhJ,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,SAAiB,EAAqB,EAAE,CAC7E,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAErF,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAgD,EAAE;IAC1F,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAA2C,CAAC;QAAE,OAAO,KAAK,CAAC;IACnG,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,cAAc,EAAE,oDAA4C,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3I,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,mDAA2C,CAAC;QAAE,OAAO,KAAK,CAAC;IACxI,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9F,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;GAGG;AACH,SAAgB,mCAAmC,CAAC,KAAc;IAChE,IAAI,CAAC;QACH,OAAO,yCAAyC,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,yCAAyC,CAAC,KAAc;IAC/D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,aAAa,KAAK,gDAAwC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACjH,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3I,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAAE,OAAO,KAAK,CAAC;IACtG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAElG,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAEnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAAE,OAAO,KAAK,CAAC;IACjG,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,IAAI,CAAC,0CAAkC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1G,MAAM,OAAO,GAAG,+BAA+B,CAAC,YAA2F,CAAC,CAAC;IAC7I,OAAO,CACL,CAAC,KAAK,CAAC,qBAAqB,GAAG,8CAA2B,CAAC,KAAK,OAAO,CAAC,qBAAqB;QAC7F,CAAC,KAAK,CAAC,mBAAmB,GAAG,8CAA2B,CAAC,KAAK,OAAO,CAAC,mBAAmB,CAC1F,CAAC;AACJ,CAAC"}

package/dist/accounts/validation.d.ts

@@ -1,4 +1,23 @@
 import type { SubscriptionAccount } from './accounts';
+import type { AzureManualOnboardingBillingExportDiscoveryResult } from './azureManualOnboarding';
+/**
+ * Validation-only Azure service-principal input. Persistence metadata is
+ * intentionally excluded because a cloud account does not exist yet during onboarding.
+ */
+export interface CloudAccountValidationRequest {
+    companyId: string;
+    provider: 'Azure';
+    id: string;
+    name: string;
+    companyName?: string;
+    authMode?: 'servicePrincipal';
+    tenantId: string;
+    secret: string;
+    useWriteAccess?: boolean;
+    writeClientId?: string;
+    writeSecret?: string;
+    includeBillingExportDiscovery?: boolean;
+}
 export type SubscriptionValidationStatus = 'confirmed' | 'forbidden' | 'unauthorized' | 'throttled' | 'unavailable';
 export interface SubscriptionReadValidationResult {
     subscription: SubscriptionAccount;
@@ -39,6 +58,7 @@ export interface CloudAccountValidationResult {
     readAccess: CloudAccountReadAccessValidation;
     writeAccess?: CloudAccountWriteAccessValidation;
     capabilityChecks?: CloudAccountCapabilityValidationResult[];
+    billingExportDiscovery?: AzureManualOnboardingBillingExportDiscoveryResult;
 }
 export interface CloudAccountCapabilityValidationProgress {
     result: CloudAccountCapabilityValidationResult;
@@ -80,6 +100,10 @@ export type CloudAccountValidationStreamEvent = {
     event: 'writeAccessCompleted';
     message: string;
     writeAccess: CloudAccountWriteAccessValidation;
+} | {
+    event: 'billingExportDiscoveryCompleted';
+    message: string;
+    result: AzureManualOnboardingBillingExportDiscoveryResult;
 } | {
     event: 'completed';
     message: string;

package/dist/accounts/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/accounts/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,MAAM,4BAA4B,GAAG,WAAW,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,CAAC;AAEpH,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,mBAAmB,CAAC;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,4BAA4B,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,mBAAmB,EAAE,gCAAgC,EAAE,CAAC;CACzD;AAED,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,mBAAmB,EAAE,CAAC;CACtC;AAED,MAAM,MAAM,sCAAsC,GAC9C,WAAW,GACX,SAAS,GACT,eAAe,GACf,WAAW,GACX,SAAS,GACT,SAAS,CAAC;AAEd,MAAM,MAAM,qCAAqC,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,GAAG,OAAO,CAAC;AAErG,MAAM,WAAW,sCAAsC;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,qCAAqC,CAAC;IAC7C,MAAM,EAAE,sCAAsC,CAAC;IAC/C,QAAQ,EAAE,UAAU,GAAG,aAAa,GAAG,UAAU,CAAC;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,gCAAgC,CAAC;IAC7C,WAAW,CAAC,EAAE,iCAAiC,CAAC;IAChD,gBAAgB,CAAC,EAAE,sCAAsC,EAAE,CAAC;CAC7D;AAED,MAAM,WAAW,wCAAwC;IACvD,MAAM,EAAE,sCAAsC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oCAAoC;IACnD,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,iCAAiC,GACzC;IACE,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,KAAK,EAAE,yBAAyB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,gCAAgC,CAAC;IAC7C,wBAAwB,EAAE,MAAM,CAAC;IACjC,yBAAyB,EAAE,MAAM,CAAC;CACnC,GACD;IACE,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,oCAAoC,CAAC;CAC5C,GACD;IACE,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,sCAAsC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,KAAK,EAAE,oBAAoB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,iCAAiC,CAAC;CAChD,GACD;IACE,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,4BAA4B,CAAC;CACtC,GACD;IACE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/accounts/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,iDAAiD,EAAE,MAAM,yBAAyB,CAAC;AAEjG;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,MAAM,4BAA4B,GAAG,WAAW,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,CAAC;AAEpH,MAAM,WAAW,gCAAgC;IAC/C,YAAY,EAAE,mBAAmB,CAAC;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,4BAA4B,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,mBAAmB,EAAE,gCAAgC,EAAE,CAAC;CACzD;AAED,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,mBAAmB,EAAE,CAAC;CACtC;AAED,MAAM,MAAM,sCAAsC,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAErI,MAAM,MAAM,qCAAqC,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,GAAG,OAAO,CAAC;AAErG,MAAM,WAAW,sCAAsC;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,qCAAqC,CAAC;IAC7C,MAAM,EAAE,sCAAsC,CAAC;IAC/C,QAAQ,EAAE,UAAU,GAAG,aAAa,GAAG,UAAU,CAAC;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,gCAAgC,CAAC;IAC7C,WAAW,CAAC,EAAE,iCAAiC,CAAC;IAChD,gBAAgB,CAAC,EAAE,sCAAsC,EAAE,CAAC;IAC5D,sBAAsB,CAAC,EAAE,iDAAiD,CAAC;CAC5E;AAED,MAAM,WAAW,wCAAwC;IACvD,MAAM,EAAE,sCAAsC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oCAAoC;IACnD,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,iCAAiC,GACzC;IACE,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,KAAK,EAAE,yBAAyB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,gCAAgC,CAAC;IAC7C,wBAAwB,EAAE,MAAM,CAAC;IACjC,yBAAyB,EAAE,MAAM,CAAC;CACnC,GACD;IACE,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,oCAAoC,CAAC;CAC5C,GACD;IACE,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,sCAAsC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,KAAK,EAAE,oBAAoB,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;CACjB,GACD;IACE,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,iCAAiC,CAAC;CAChD,GACD;IACE,KAAK,EAAE,iCAAiC,CAAC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,iDAAiD,CAAC;CAC3D,GACD;IACE,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,4BAA4B,CAAC;CACtC,GACD;IACE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC"}

package/dist/accounts/writePermissions.d.ts

@@ -8,8 +8,22 @@ export declare enum WritePermission {
     /** Permission to enable storage inventory reports on storage accounts */
     StorageInventory = 2,// 2
     /** Permission to create scoped Azure Policy exemptions */
-    PolicyExemptions = 4
+    PolicyExemptions = 4,// 4
+    /** Permission to run approved resource scheduling capabilities */
+    ResourceScheduling = 8,// 8
+    /** Permission to delete idle or orphaned resources when a clean-up recommendation is implemented */
+    RemediationCleanup = 16,// 16
+    /** Permission to resize, reconfigure, deallocate, or start resources when a recommendation is implemented */
+    RemediationRightsize = 32,// 32
+    /** Permission to manage reservations and savings plans */
+    CommitmentsManage = 64
 }
+/**
+ * Union of every WritePermission bit defined in this package version.
+ * Consumers mask persisted values with this so bits added by a newer producer are ignored, not misread.
+ * Bits are only ever added; an existing bit's meaning never changes.
+ */
+export declare const KNOWN_WRITE_PERMISSION_MASK: number;
 /**
  * Metadata for a write permission
  * Contains display information, required roles, and documentation links
@@ -27,6 +41,8 @@ export interface WritePermissionMetadata {
     documentationUrl?: string;
     /** URL to script generator for creating custom roles */
     scriptGeneratorUrl?: string;
+    /** Identifies permissions whose provider grants come from an immutable multi-group manifest. */
+    permissionManifestKind?: 'resource-scheduling';
 }
 /**
  * Permission metadata array

package/dist/accounts/writePermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writePermissions.d.ts","sourceRoot":"","sources":["../../src/accounts/writePermissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,oBAAY,eAAe;IACzB,0DAA0D;IAC1D,sBAAsB,IAAS,CAAE,IAAI;IACrC,yEAAyE;IACzE,gBAAgB,IAAS,CAAE,IAAI;IAC/B,0DAA0D;IAC1D,gBAAgB,IAAS;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,EAAE,EAAE,eAAe,CAAC;IACpB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,uBAAuB,EAyB/D,CAAC"}
+{"version":3,"file":"writePermissions.d.ts","sourceRoot":"","sources":["../../src/accounts/writePermissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,oBAAY,eAAe;IACzB,0DAA0D;IAC1D,sBAAsB,IAAS,CAAE,IAAI;IACrC,yEAAyE;IACzE,gBAAgB,IAAS,CAAE,IAAI;IAC/B,0DAA0D;IAC1D,gBAAgB,IAAS,CAAE,IAAI;IAC/B,kEAAkE;IAClE,kBAAkB,IAAS,CAAE,IAAI;IACjC,oGAAoG;IACpG,kBAAkB,KAAS,CAAE,KAAK;IAClC,6GAA6G;IAC7G,oBAAoB,KAAS,CAAE,KAAK;IACpC,0DAA0D;IAC1D,iBAAiB,KAAS;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAOP,CAAC;AAEpC;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,EAAE,EAAE,eAAe,CAAC;IACpB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gGAAgG;IAChG,sBAAsB,CAAC,EAAE,qBAAqB,CAAC;CAChD;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,uBAAuB,EAoD/D,CAAC"}

package/dist/accounts/writePermissions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WRITE_PERMISSIONS_METADATA = exports.WritePermission = void 0;
+exports.WRITE_PERMISSIONS_METADATA = exports.KNOWN_WRITE_PERMISSION_MASK = exports.WritePermission = void 0;
 /**
  * Write Permission Bitmask Enum
  * Each permission gets a unique bit position for efficient storage
@@ -13,7 +13,27 @@ var WritePermission;
     WritePermission[WritePermission["StorageInventory"] = 2] = "StorageInventory";
     /** Permission to create scoped Azure Policy exemptions */
     WritePermission[WritePermission["PolicyExemptions"] = 4] = "PolicyExemptions";
+    /** Permission to run approved resource scheduling capabilities */
+    WritePermission[WritePermission["ResourceScheduling"] = 8] = "ResourceScheduling";
+    /** Permission to delete idle or orphaned resources when a clean-up recommendation is implemented */
+    WritePermission[WritePermission["RemediationCleanup"] = 16] = "RemediationCleanup";
+    /** Permission to resize, reconfigure, deallocate, or start resources when a recommendation is implemented */
+    WritePermission[WritePermission["RemediationRightsize"] = 32] = "RemediationRightsize";
+    /** Permission to manage reservations and savings plans */
+    WritePermission[WritePermission["CommitmentsManage"] = 64] = "CommitmentsManage";
 })(WritePermission || (exports.WritePermission = WritePermission = {}));
+/**
+ * Union of every WritePermission bit defined in this package version.
+ * Consumers mask persisted values with this so bits added by a newer producer are ignored, not misread.
+ * Bits are only ever added; an existing bit's meaning never changes.
+ */
+exports.KNOWN_WRITE_PERMISSION_MASK = WritePermission.DismissRecommendations |
+    WritePermission.StorageInventory |
+    WritePermission.PolicyExemptions |
+    WritePermission.ResourceScheduling |
+    WritePermission.RemediationCleanup |
+    WritePermission.RemediationRightsize |
+    WritePermission.CommitmentsManage;
 /**
  * Permission metadata array
  * Define all available write permissions with their metadata
@@ -43,5 +63,31 @@ exports.WRITE_PERMISSIONS_METADATA = [
         documentationUrl: 'https://docs.spotto.ai/docs/portal/write-permissions/policy-exemptions',
         scriptGeneratorUrl: '/scripts/policy-exemptions-role',
     },
+    {
+        id: WritePermission.ResourceScheduling,
+        displayName: 'Resource Scheduling',
+        description: 'Allows Spotto to run explicitly approved resource scheduling capabilities at their exact Azure scopes.',
+        requiredRoles: [],
+        permissionManifestKind: 'resource-scheduling',
+    },
+    {
+        id: WritePermission.RemediationCleanup,
+        displayName: 'Clean Up Unused Resources',
+        description: 'Allows Spotto to delete idle or orphaned resources (for example unattached disks, public IPs and network interfaces) when you implement a clean-up recommendation.',
+        requiredRoles: ['Custom role with the delete actions of the Spotto clean-up remediation catalog'],
+    },
+    {
+        id: WritePermission.RemediationRightsize,
+        displayName: 'Rightsize and Reconfigure Resources',
+        description: 'Allows Spotto to resize, reconfigure, deallocate, or start resources when you implement a rightsizing recommendation.',
+        requiredRoles: ['Custom role with the write, deallocate and start actions of the Spotto rightsizing remediation catalog'],
+    },
+    {
+        id: WritePermission.CommitmentsManage,
+        displayName: 'Manage Reservations and Savings Plans',
+        description: 'Allows Spotto to change reservation and savings plan scope and settings.',
+        requiredRoles: ['Reservations Contributor'],
+        documentationUrl: 'https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/view-reservations',
+    },
 ];
 //# sourceMappingURL=writePermissions.js.map

package/dist/accounts/writePermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"writePermissions.js","sourceRoot":"","sources":["../../src/accounts/writePermissions.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,IAAY,eAOX;AAPD,WAAY,eAAe;IACzB,0DAA0D;IAC1D,yFAA+B,CAAA;IAC/B,yEAAyE;IACzE,6EAAyB,CAAA;IACzB,0DAA0D;IAC1D,6EAAyB,CAAA;AAC3B,CAAC,EAPW,eAAe,+BAAf,eAAe,QAO1B;AAqBD;;;GAGG;AACU,QAAA,0BAA0B,GAA8B;IACnE;QACE,EAAE,EAAE,eAAe,CAAC,sBAAsB;QAC1C,WAAW,EAAE,uCAAuC;QACpD,WAAW,EAAE,wEAAwE;QACrF,aAAa,EAAE,CAAC,qCAAqC,CAAC;QACtD,gBAAgB,EAAE,6DAA6D;QAC/E,kBAAkB,EAAE,uBAAuB;KAC5C;IACD;QACE,EAAE,EAAE,eAAe,CAAC,gBAAgB;QACpC,WAAW,EAAE,kCAAkC;QAC/C,WAAW,EAAE,wEAAwE;QACrF,aAAa,EAAE,CAAC,6BAA6B,CAAC;QAC9C,gBAAgB,EAAE,sEAAsE;QACxF,kBAAkB,EAAE,uBAAuB;KAC5C;IACD;QACE,EAAE,EAAE,eAAe,CAAC,gBAAgB;QACpC,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,mGAAmG;QAChH,aAAa,EAAE,CAAC,qFAAqF,CAAC;QACtG,gBAAgB,EAAE,wEAAwE;QAC1F,kBAAkB,EAAE,iCAAiC;KACtD;CACF,CAAC"}
+{"version":3,"file":"writePermissions.js","sourceRoot":"","sources":["../../src/accounts/writePermissions.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,IAAY,eAeX;AAfD,WAAY,eAAe;IACzB,0DAA0D;IAC1D,yFAA+B,CAAA;IAC/B,yEAAyE;IACzE,6EAAyB,CAAA;IACzB,0DAA0D;IAC1D,6EAAyB,CAAA;IACzB,kEAAkE;IAClE,iFAA2B,CAAA;IAC3B,oGAAoG;IACpG,kFAA2B,CAAA;IAC3B,6GAA6G;IAC7G,sFAA6B,CAAA;IAC7B,0DAA0D;IAC1D,gFAA0B,CAAA;AAC5B,CAAC,EAfW,eAAe,+BAAf,eAAe,QAe1B;AAED;;;;GAIG;AACU,QAAA,2BAA2B,GACtC,eAAe,CAAC,sBAAsB;IACtC,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,kBAAkB;IAClC,eAAe,CAAC,kBAAkB;IAClC,eAAe,CAAC,oBAAoB;IACpC,eAAe,CAAC,iBAAiB,CAAC;AAuBpC;;;GAGG;AACU,QAAA,0BAA0B,GAA8B;IACnE;QACE,EAAE,EAAE,eAAe,CAAC,sBAAsB;QAC1C,WAAW,EAAE,uCAAuC;QACpD,WAAW,EAAE,wEAAwE;QACrF,aAAa,EAAE,CAAC,qCAAqC,CAAC;QACtD,gBAAgB,EAAE,6DAA6D;QAC/E,kBAAkB,EAAE,uBAAuB;KAC5C;IACD;QACE,EAAE,EAAE,eAAe,CAAC,gBAAgB;QACpC,WAAW,EAAE,kCAAkC;QAC/C,WAAW,EAAE,wEAAwE;QACrF,aAAa,EAAE,CAAC,6BAA6B,CAAC;QAC9C,gBAAgB,EAAE,sEAAsE;QACxF,kBAAkB,EAAE,uBAAuB;KAC5C;IACD;QACE,EAAE,EAAE,eAAe,CAAC,gBAAgB;QACpC,WAAW,EAAE,gCAAgC;QAC7C,WAAW,EAAE,mGAAmG;QAChH,aAAa,EAAE,CAAC,qFAAqF,CAAC;QACtG,gBAAgB,EAAE,wEAAwE;QAC1F,kBAAkB,EAAE,iCAAiC;KACtD;IACD;QACE,EAAE,EAAE,eAAe,CAAC,kBAAkB;QACtC,WAAW,EAAE,qBAAqB;QAClC,WAAW,EAAE,wGAAwG;QACrH,aAAa,EAAE,EAAE;QACjB,sBAAsB,EAAE,qBAAqB;KAC9C;IACD;QACE,EAAE,EAAE,eAAe,CAAC,kBAAkB;QACtC,WAAW,EAAE,2BAA2B;QACxC,WAAW,EACT,oKAAoK;QACtK,aAAa,EAAE,CAAC,gFAAgF,CAAC;KAClG;IACD;QACE,EAAE,EAAE,eAAe,CAAC,oBAAoB;QACxC,WAAW,EAAE,qCAAqC;QAClD,WAAW,EAAE,uHAAuH;QACpI,aAAa,EAAE,CAAC,wGAAwG,CAAC;KAC1H;IACD;QACE,EAAE,EAAE,eAAe,CAAC,iBAAiB;QACrC,WAAW,EAAE,uCAAuC;QACpD,WAAW,EAAE,0EAA0E;QACvF,aAAa,EAAE,CAAC,0BAA0B,CAAC;QAC3C,gBAAgB,EAAE,gGAAgG;KACnH;CACF,CAAC"}

package/dist/ai/conversationHistory.d.ts

@@ -0,0 +1,52 @@
+import type { AIChatGroundingSummary } from './grounding.js';
+import type { AIChatWorkspaceArtifact, AIChatWorkspaceArtifactSummary, AIChatWorkspaceArtifactViewIdentity } from './workspaceArtifacts.js';
+import type { AIChatCitation, AIChatEvidenceCoverage } from './index.js';
+/** Shared payload bounds for conversation-history artifact projection and replay. */
+export declare const AI_CHAT_HISTORY_ARTIFACT_LIMITS_V1: Readonly<{
+    readonly responseArtifactsPerConversation: 100;
+    readonly citationsPerResponse: 50;
+    readonly workspaceArtifactSummariesPerResponse: 5;
+}>;
+/** Capability-bound summary returned with a historical assistant response. */
+export type AIChatHistoryWorkspaceArtifactSummary = AIChatWorkspaceArtifactSummary & {
+    view: AIChatWorkspaceArtifactViewIdentity;
+};
+/** Safe, bounded metadata for one persisted assistant response. */
+export interface AIChatHistoryResponseArtifact {
+    turnId: string;
+    responseId: string;
+    citations: AIChatCitation[];
+    evidenceCoverage: AIChatEvidenceCoverage;
+    grounding?: AIChatGroundingSummary;
+    workspaceArtifacts?: AIChatHistoryWorkspaceArtifactSummary[];
+}
+/**
+ * Compatibility projection for the newest response while API and Portal consumers migrate to
+ * `responseArtifacts`. Unlike historical entries, it may contain complete inline artifacts.
+ */
+export interface AIChatHistoryLatestResponseArtifact {
+    turnId?: string;
+    responseId: string;
+    citations: AIChatCitation[];
+    evidenceCoverage: AIChatEvidenceCoverage;
+    grounding?: AIChatGroundingSummary;
+    workspaceArtifacts?: AIChatWorkspaceArtifact[];
+}
+/** Additive artifact fields carried by the conversation-history response. */
+export interface AIChatConversationHistoryArtifactProjection {
+    /** @deprecated Use `responseArtifacts`; retained during the API/Portal migration. */
+    latestResponseArtifact?: AIChatHistoryLatestResponseArtifact;
+    /**
+     * Oldest-to-newest entries for the retained response window. Entries must have unique turn and
+     * response identifiers and are capped by `responseArtifactsPerConversation`.
+     */
+    responseArtifacts?: AIChatHistoryResponseArtifact[];
+}
+/** Authorized lazy-read response for one complete historical workspace artifact. */
+export interface AIChatHistoryWorkspaceArtifactReadResponse {
+    conversationId: string;
+    turnId: string;
+    responseId: string;
+    artifact: AIChatWorkspaceArtifact;
+}
+//# sourceMappingURL=conversationHistory.d.ts.map

package/dist/ai/conversationHistory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversationHistory.d.ts","sourceRoot":"","sources":["../../src/ai/conversationHistory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,mCAAmC,EAAE,MAAM,yBAAyB,CAAC;AAC5I,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzE,qFAAqF;AACrF,eAAO,MAAM,kCAAkC;;;;EAIpC,CAAC;AAEZ,8EAA8E;AAC9E,MAAM,MAAM,qCAAqC,GAAG,8BAA8B,GAAG;IACnF,IAAI,EAAE,mCAAmC,CAAC;CAC3C,CAAC;AAEF,mEAAmE;AACnE,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,kBAAkB,CAAC,EAAE,qCAAqC,EAAE,CAAC;CAC9D;AAED;;;GAGG;AACH,MAAM,WAAW,mCAAmC;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,kBAAkB,CAAC,EAAE,uBAAuB,EAAE,CAAC;CAChD;AAED,6EAA6E;AAC7E,MAAM,WAAW,2CAA2C;IAC1D,qFAAqF;IACrF,sBAAsB,CAAC,EAAE,mCAAmC,CAAC;IAC7D;;;OAGG;IACH,iBAAiB,CAAC,EAAE,6BAA6B,EAAE,CAAC;CACrD;AAED,oFAAoF;AACpF,MAAM,WAAW,0CAA0C;IACzD,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,uBAAuB,CAAC;CACnC"}

package/dist/ai/conversationHistory.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AI_CHAT_HISTORY_ARTIFACT_LIMITS_V1 = void 0;
+/** Shared payload bounds for conversation-history artifact projection and replay. */
+exports.AI_CHAT_HISTORY_ARTIFACT_LIMITS_V1 = Object.freeze({
+    responseArtifactsPerConversation: 100,
+    citationsPerResponse: 50,
+    workspaceArtifactSummariesPerResponse: 5,
+});
+//# sourceMappingURL=conversationHistory.js.map

package/dist/ai/conversationHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conversationHistory.js","sourceRoot":"","sources":["../../src/ai/conversationHistory.ts"],"names":[],"mappings":";;;AAIA,qFAAqF;AACxE,QAAA,kCAAkC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9D,gCAAgC,EAAE,GAAG;IACrC,oBAAoB,EAAE,EAAE;IACxB,qCAAqC,EAAE,CAAC;CAChC,CAAC,CAAC"}

package/dist/ai/followUps.d.ts

@@ -0,0 +1,16 @@
+export declare const AI_CHAT_FOLLOW_UP_LIMITS_V1: Readonly<{
+    readonly suggestions: 3;
+    readonly identifierScalars: 64;
+    readonly textScalars: 160;
+}>;
+/**
+ * A follow-up question derived from the answer it accompanies (for example a drill-down on the top item).
+ * Selecting one sends `text` as the next question; it carries no hidden instructions or tool arguments.
+ */
+export interface AIChatFollowUpSuggestionV1 {
+    suggestionId: string;
+    text: string;
+}
+/** Strictly validates a bounded list of follow-up suggestions with unique ids and unique text. */
+export declare const isAIChatFollowUpSuggestions: (value: unknown) => value is AIChatFollowUpSuggestionV1[];
+//# sourceMappingURL=followUps.d.ts.map

package/dist/ai/followUps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"followUps.d.ts","sourceRoot":"","sources":["../../src/ai/followUps.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,2BAA2B;;;;EAI7B,CAAC;AAEZ;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAQD,kGAAkG;AAClG,eAAO,MAAM,2BAA2B,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,0BAA0B,EAKT,CAAC"}

package/dist/ai/followUps.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAIChatFollowUpSuggestions = exports.AI_CHAT_FOLLOW_UP_LIMITS_V1 = void 0;
+const internal_js_1 = require("../environment/internal.js");
+exports.AI_CHAT_FOLLOW_UP_LIMITS_V1 = Object.freeze({
+    suggestions: 3,
+    identifierScalars: 64,
+    textScalars: 160,
+});
+const isSuggestion = (value) => (0, internal_js_1.isRecord)(value) &&
+    (0, internal_js_1.hasExactKeys)(value, ['suggestionId', 'text']) &&
+    (0, internal_js_1.isBoundedString)(value.suggestionId, exports.AI_CHAT_FOLLOW_UP_LIMITS_V1.identifierScalars, { trimmed: true, controls: true }) &&
+    (0, internal_js_1.isBoundedString)(value.text, exports.AI_CHAT_FOLLOW_UP_LIMITS_V1.textScalars, { trimmed: true, controls: true });
+/** Strictly validates a bounded list of follow-up suggestions with unique ids and unique text. */
+const isAIChatFollowUpSuggestions = (value) => Array.isArray(value) &&
+    value.length <= exports.AI_CHAT_FOLLOW_UP_LIMITS_V1.suggestions &&
+    value.every(isSuggestion) &&
+    new Set(value.map(suggestion => suggestion.suggestionId)).size === value.length &&
+    new Set(value.map(suggestion => suggestion.text.toLowerCase())).size === value.length;
+exports.isAIChatFollowUpSuggestions = isAIChatFollowUpSuggestions;
+//# sourceMappingURL=followUps.js.map

package/dist/ai/followUps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"followUps.js","sourceRoot":"","sources":["../../src/ai/followUps.ts"],"names":[],"mappings":";;;AAAA,4DAAqF;AAExE,QAAA,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,WAAW,EAAE,CAAC;IACd,iBAAiB,EAAE,EAAE;IACrB,WAAW,EAAE,GAAG;CACR,CAAC,CAAC;AAWZ,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuC,EAAE,CAC3E,IAAA,sBAAQ,EAAC,KAAK,CAAC;IACf,IAAA,0BAAY,EAAC,KAAK,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAA,6BAAe,EAAC,KAAK,CAAC,YAAY,EAAE,mCAA2B,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrH,IAAA,6BAAe,EAAC,KAAK,CAAC,IAAI,EAAE,mCAA2B,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1G,kGAAkG;AAC3F,MAAM,2BAA2B,GAAG,CAAC,KAAc,EAAyC,EAAE,CACnG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;IACpB,KAAK,CAAC,MAAM,IAAI,mCAA2B,CAAC,WAAW;IACvD,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;IACzB,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;IAC/E,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAL3E,QAAA,2BAA2B,+BAKgD"}

package/dist/ai/grounding.d.ts

@@ -0,0 +1,78 @@
+import type { EnvironmentArtifactKindV1, EnvironmentCoverageStateV1 } from '../environment/contracts.js';
+export declare const AI_CHAT_GROUNDING_LIMITS_V1: Readonly<{
+    readonly claims: 128;
+    readonly citationsPerClaim: 32;
+    readonly identifierScalars: 128;
+    readonly figures: 128;
+    readonly figureTextScalars: 96;
+}>;
+export declare const AI_CHAT_GROUNDING_REASON_CODES_V1: readonly ["grounding.not-required", "grounding.claim-extraction-failed", "grounding.missing-citation", "grounding.source-unavailable", "grounding.source-stale", "grounding.generation-mismatch", "grounding.value-mismatch", "grounding.unsupported-claim", "grounding.figure-unreferenced", "grounding.reference-unresolved"];
+export type AIChatGroundingReasonCodeV1 = (typeof AI_CHAT_GROUNDING_REASON_CODES_V1)[number];
+/** `partial` is produced only by the `server-rendered-figures` method. */
+export type AIChatGroundingStatusV1 = 'verified' | 'partial' | 'unverified' | 'not-required';
+export type AIChatClaimVerificationStatusV1 = 'verified' | 'unverified';
+export type AIEnvironmentEvidenceCoverageStatusV1 = EnvironmentCoverageStateV1['status'];
+/**
+ * `deterministic-citation-and-value`: the model restated each value and declared claims that the server compared.
+ * `server-rendered-figures`: the model wrote figure references and the server rendered every verified figure from
+ * bound evidence, so `claims` is empty and `figures` carries the per-figure result.
+ */
+export type AIChatGroundingMethodV1 = 'deterministic-citation-and-value' | 'server-rendered-figures';
+export type AIChatGroundedFigureKindV1 = 'money' | 'percentage' | 'quantity' | 'date';
+export type AIChatGroundedFigureStatusV1 = 'verified' | 'unverified';
+/**
+ * HTML attribute the API puts on the element wrapping each figure in the answer. Its value is the figure's
+ * `figureId`, so clients anchor provenance without matching text.
+ */
+export declare const AI_CHAT_GROUNDED_FIGURE_ANCHOR_ATTRIBUTE_V1 = "data-spotto-figure";
+/** Client-safe environment evidence metadata with no scope, generation, storage, or runtime-handle identity. */
+export interface AIEnvironmentEvidenceMatch {
+    safeLabel: string;
+    portalRoute: string;
+    artifactKind: EnvironmentArtifactKindV1;
+    sourceCompletedAt: string;
+    coverageStatus: AIEnvironmentEvidenceCoverageStatusV1;
+    truncated: boolean;
+    citationIds: string[];
+}
+export interface AIChatClaimVerificationV1 {
+    claimId: string;
+    status: AIChatClaimVerificationStatusV1;
+    citationIds: string[];
+    reasonCode?: Exclude<AIChatGroundingReasonCodeV1, 'grounding.not-required' | AIChatFigureOnlyReasonCodeV1>;
+}
+type AIChatFigureOnlyReasonCodeV1 = 'grounding.figure-unreferenced' | 'grounding.reference-unresolved';
+/**
+ * One figure visible in the final answer. A verified figure was rendered by the server from the cited evidence;
+ * an unverified figure was typed by the model and was not checked.
+ */
+export interface AIChatGroundedFigureV1 {
+    figureId: string;
+    status: AIChatGroundedFigureStatusV1;
+    kind: AIChatGroundedFigureKindV1;
+    /** Exact visible text of the figure, for example `NZ$705.72 per month`. */
+    text: string;
+    /** At least one citation when verified; empty when unverified. */
+    citationIds: string[];
+    /** Required when unverified. */
+    reasonCode?: 'grounding.figure-unreferenced';
+}
+/** Deterministic grounding result. This is evidence verification, never model confidence. */
+export interface AIChatGroundingSummary {
+    status: AIChatGroundingStatusV1;
+    method: AIChatGroundingMethodV1;
+    totalClaimCount: number;
+    verifiedClaimCount: number;
+    claims: AIChatClaimVerificationV1[];
+    /** Present only, and always, with the `server-rendered-figures` method. */
+    figures?: AIChatGroundedFigureV1[];
+    reasonCode?: AIChatGroundingReasonCodeV1;
+}
+/** Strictly validates client-safe environment evidence metadata. */
+export declare const isAIEnvironmentEvidenceMatch: (value: unknown) => value is AIEnvironmentEvidenceMatch;
+/** Strictly validates one grounded figure. */
+export declare const isAIChatGroundedFigureV1: (value: unknown) => value is AIChatGroundedFigureV1;
+/** Strictly validates deterministic summary, claim-level and figure-level citation invariants. */
+export declare const isAIChatGroundingSummary: (value: unknown) => value is AIChatGroundingSummary;
+export {};
+//# sourceMappingURL=grounding.d.ts.map

package/dist/ai/grounding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grounding.d.ts","sourceRoot":"","sources":["../../src/ai/grounding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAIzG,eAAO,MAAM,2BAA2B;;;;;;EAM7B,CAAC;AAEZ,eAAO,MAAM,iCAAiC,iUAWpC,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,iCAAiC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC7F,0EAA0E;AAC1E,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAC7F,MAAM,MAAM,+BAA+B,GAAG,UAAU,GAAG,YAAY,CAAC;AACxE,MAAM,MAAM,qCAAqC,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;AAEzF;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,kCAAkC,GAAG,yBAAyB,CAAC;AAErG,MAAM,MAAM,0BAA0B,GAAG,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,UAAU,GAAG,YAAY,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,2CAA2C,uBAAuB,CAAC;AAEhF,gHAAgH;AAChH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,yBAAyB,CAAC;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,qCAAqC,CAAC;IACtD,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,+BAA+B,CAAC;IACxC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC,2BAA2B,EAAE,wBAAwB,GAAG,4BAA4B,CAAC,CAAC;CAC5G;AAED,KAAK,4BAA4B,GAAG,+BAA+B,GAAG,gCAAgC,CAAC;AAEvG;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,4BAA4B,CAAC;IACrC,IAAI,EAAE,0BAA0B,CAAC;IACjC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gCAAgC;IAChC,UAAU,CAAC,EAAE,+BAA+B,CAAC;CAC9C;AAED,6FAA6F;AAC7F,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,uBAAuB,CAAC;IAChC,MAAM,EAAE,uBAAuB,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACnC,UAAU,CAAC,EAAE,2BAA2B,CAAC;CAC1C;AAmBD,oEAAoE;AACpE,eAAO,MAAM,4BAA4B,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,0BAU/B,CAAC;AAiBzC,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,sBAoBlE,CAAC;AAgEF,kGAAkG;AAClG,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,sBAWlE,CAAC"}