@spottoai/types-package 1.0.2-dev1138.13 → 1.0.2-dev1138.14

package/dist/esm/aws/organizationCommitmentsValidation.js

@@ -0,0 +1,225 @@
+import { ProviderName } from '../common/provider.js';
+import { asRecord, assertExactKeys, assertValue, requiredEnum, requiredString } from '../common/validationHelpers.js';
+import { assertAccount } from './validationHelpers.js';
+const ORGANIZATION_ID = /^o-[a-z0-9]{10,32}$/u;
+const FORBIDDEN_ORGANIZATION_COMMITMENTS_KEYS = new Set([
+    'billingScopeId',
+    'blobPath',
+    'checkpoint',
+    'cloudAccountId',
+    'connectionString',
+    'credentialHealth',
+    'credentialId',
+    'credentialReference',
+    'externalId',
+    'managementGroupId',
+    'pricingQuote',
+    'quotePolicy',
+    'resourceGroupId',
+    'roleArn',
+    'saga',
+    'sasToken',
+    'secretArn',
+    'secretReference',
+    'storageCapacity',
+    'storagePath',
+    'subscription',
+    'subscriptionId',
+    'tenantId',
+    'unlockFinancialLedger',
+]);
+/** Validates the multi-account identity boundary of an AWS organization commitments view. */
+export function validateAwsOrganizationCommitmentsPlanningViewIdentity(value, expected) {
+    const view = asRecord(value, 'organizationCommitmentsPlanning');
+    const providerScope = asRecord(view.providerScope, 'organizationCommitmentsPlanning.providerScope');
+    assertExactKeys(providerScope, ['providerName', 'providerScopeId', 'scopeType', 'companyId', 'estateId', 'organizationId', 'managementAccountId'], 'organizationCommitmentsPlanning.providerScope');
+    assertValue(providerScope.providerName, ProviderName.Aws, 'organizationCommitmentsPlanning.providerScope.providerName');
+    assertValue(providerScope.scopeType, 'organization', 'organizationCommitmentsPlanning.providerScope.scopeType');
+    const companyId = requiredString(providerScope.companyId, 'organizationCommitmentsPlanning.providerScope.companyId');
+    const estateId = requiredString(providerScope.estateId, 'organizationCommitmentsPlanning.providerScope.estateId');
+    const organizationId = requiredOrganizationId(providerScope.organizationId, 'organizationCommitmentsPlanning.providerScope.organizationId');
+    assertValue(providerScope.providerScopeId, organizationId, 'organizationCommitmentsPlanning.providerScope.providerScopeId');
+    const managementAccountId = requiredAccountId(providerScope.managementAccountId, 'organizationCommitmentsPlanning.providerScope.managementAccountId');
+    assertValue(expected.companyId, companyId, 'expected.companyId');
+    assertValue(expected.estateId, estateId, 'expected.estateId');
+    assertValue(expected.organizationId, organizationId, 'expected.organizationId');
+    assertValue(expected.managementAccountId, managementAccountId, 'expected.managementAccountId');
+    assertValue(expected.manifestRevision, requiredString(view.manifestRevision, 'organizationCommitmentsPlanning.manifestRevision'), 'expected.manifestRevision');
+    const accountMembership = validateAccounts(view.accounts, managementAccountId);
+    validateExpectedMembers(expected.memberAccountIds, accountMembership.accountIds);
+    validateInventory(view.inventory, accountMembership.members);
+    validatePayerAggregates(view.payerAggregates, accountMembership.members, managementAccountId);
+    validatePurchaseRecommendations(view.purchaseRecommendations, accountMembership.members, managementAccountId);
+    validateAttribution(view.allocation, accountMembership.members, false, 'organizationCommitmentsPlanning.allocation');
+    validateAttribution(view.resourceAttribution, accountMembership.members, true, 'organizationCommitmentsPlanning.resourceAttribution');
+    validateBoundIdentities(view, accountMembership.members, organizationId, companyId, estateId, managementAccountId, 'organizationCommitmentsPlanning');
+}
+function validateAccounts(value, managementAccountId) {
+    if (!Array.isArray(value) || value.length === 0)
+        throw new Error('organizationCommitmentsPlanning.accounts must be a non-empty array.');
+    const accountIds = value.map((entry, index) => {
+        const field = `organizationCommitmentsPlanning.accounts[${index}]`;
+        const account = asRecord(entry, field);
+        assertExactKeys(account, ['accountId', 'displayName', 'role', 'inventoryStatus', 'lastSuccessfulRefreshAt'], field);
+        const accountId = requiredAccountId(account.accountId, `${field}.accountId`);
+        const role = requiredEnum(account.role, ['management', 'member'], `${field}.role`);
+        if ((accountId === managementAccountId) !== (role === 'management')) {
+            throw new Error(`${field}.role must identify the exact management account.`);
+        }
+        return accountId;
+    });
+    if (new Set(accountIds).size !== accountIds.length)
+        throw new Error('organizationCommitmentsPlanning.accounts must not contain duplicates.');
+    const sorted = [...accountIds].sort((left, right) => left.localeCompare(right));
+    if (JSON.stringify(sorted) !== JSON.stringify(accountIds))
+        throw new Error('organizationCommitmentsPlanning.accounts must be sorted by accountId.');
+    if (!accountIds.includes(managementAccountId))
+        throw new Error('organizationCommitmentsPlanning.accounts must contain the management account.');
+    return { accountIds, members: new Set(accountIds) };
+}
+function validateInventory(value, members) {
+    if (!Array.isArray(value))
+        throw new Error('organizationCommitmentsPlanning.inventory must be an array.');
+    value.forEach((entry, index) => {
+        const field = `organizationCommitmentsPlanning.inventory[${index}]`;
+        const item = asRecord(entry, field);
+        assertValue(item.sourceKind, 'aws-native', `${field}.sourceKind`);
+        assertValue(item.provider, ProviderName.Aws, `${field}.provider`);
+        requiredMember(item.ownerAccountId, members, `${field}.ownerAccountId`);
+        if (item.shape !== undefined)
+            validateAwsShape(item.shape, `${field}.shape`);
+    });
+}
+function validatePayerAggregates(value, members, managementAccountId) {
+    if (!Array.isArray(value))
+        throw new Error('organizationCommitmentsPlanning.payerAggregates must be an array.');
+    value.forEach((entry, index) => {
+        const field = `organizationCommitmentsPlanning.payerAggregates[${index}]`;
+        const aggregate = asRecord(entry, field);
+        const payerAccountId = requiredMember(aggregate.payerAccountId, members, `${field}.payerAccountId`);
+        assertValue(payerAccountId, managementAccountId, `${field}.payerAccountId`);
+        validateAwsSource(aggregate.source, `${field}.source`);
+    });
+}
+function validatePurchaseRecommendations(value, members, managementAccountId) {
+    if (value === undefined)
+        return;
+    if (!Array.isArray(value))
+        throw new Error('organizationCommitmentsPlanning.purchaseRecommendations must be an array.');
+    value.forEach((entry, index) => {
+        const field = `organizationCommitmentsPlanning.purchaseRecommendations[${index}]`;
+        const recommendation = asRecord(entry, field);
+        assertValue(recommendation.purchaseScope, 'payer', `${field}.purchaseScope`);
+        const payerAccountId = requiredMember(recommendation.payerAccountId, members, `${field}.payerAccountId`);
+        assertValue(payerAccountId, managementAccountId, `${field}.payerAccountId`);
+        if (recommendation.recommendedAccountId !== undefined) {
+            requiredMember(recommendation.recommendedAccountId, members, `${field}.recommendedAccountId`);
+        }
+        validateAwsSource(recommendation.source, `${field}.source`);
+        validateAwsShape(recommendation.targetShape, `${field}.targetShape`);
+    });
+}
+function validateAttribution(value, members, resource, field) {
+    const evidence = asRecord(value, field);
+    if (evidence.status === 'unavailable') {
+        assertExactKeys(evidence, ['status', 'reason'], field);
+        requiredEnum(evidence.reason, ['not-collected', 'not-proved', 'source-unavailable'], `${field}.reason`);
+        return;
+    }
+    assertValue(evidence.status, 'available', `${field}.status`);
+    assertExactKeys(evidence, ['status', 'source', 'records'], field);
+    validateAwsSource(evidence.source, `${field}.source`, true);
+    if (!Array.isArray(evidence.records) || evidence.records.length === 0) {
+        throw new Error(`${field}.records must be non-empty when attribution is available.`);
+    }
+    evidence.records.forEach((entry, index) => {
+        const record = asRecord(entry, `${field}.records[${index}]`);
+        if (resource) {
+            requiredMember(record.accountId, members, `${field}.records[${index}].accountId`);
+        }
+        else {
+            requiredMember(record.beneficiaryAccountId, members, `${field}.records[${index}].beneficiaryAccountId`);
+            if (record.ownerAccountId !== undefined)
+                requiredMember(record.ownerAccountId, members, `${field}.records[${index}].ownerAccountId`);
+        }
+    });
+}
+function validateAwsSource(value, field, allowDerived = false) {
+    const source = asRecord(value, field);
+    const allowed = allowDerived ? ['aws-native', 'spotto-derived'] : ['aws-native'];
+    requiredEnum(source.sourceKind, allowed, `${field}.sourceKind`);
+}
+function validateAwsShape(value, field) {
+    const shape = asRecord(value, field);
+    assertValue(shape.provider, 'aws', `${field}.provider`);
+}
+function validateBoundIdentities(value, members, organizationId, companyId, estateId, managementAccountId, field) {
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => validateBoundIdentities(entry, members, organizationId, companyId, estateId, managementAccountId, `${field}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== 'object') {
+        if (typeof value === 'string')
+            validateArnAccount(value, members, field);
+        return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        if (FORBIDDEN_ORGANIZATION_COMMITMENTS_KEYS.has(key)) {
+            throw new Error(`${field}.${key} is not allowed in an AWS organization commitments artifact.`);
+        }
+        if (key === 'accountId' || key === 'ownerAccountId' || key === 'beneficiaryAccountId' || key === 'payerAccountId') {
+            requiredMember(child, members, `${field}.${key}`);
+        }
+        if (key === 'organizationId')
+            assertValue(child, organizationId, `${field}.${key}`);
+        if (key === 'companyId')
+            assertValue(child, companyId, `${field}.${key}`);
+        if (key === 'estateId')
+            assertValue(child, estateId, `${field}.${key}`);
+        if (key === 'managementAccountId')
+            assertAccount(child, managementAccountId, `${field}.${key}`);
+        if (key === 'providerName')
+            assertValue(child, ProviderName.Aws, `${field}.${key}`);
+        if (key === 'provider')
+            assertValue(child, 'aws', `${field}.${key}`);
+        if (key === 'sourceKind' && child === 'azure-native') {
+            throw new Error(`${field}.${key} cannot contain Azure-native evidence.`);
+        }
+        validateBoundIdentities(child, members, organizationId, companyId, estateId, managementAccountId, `${field}.${key}`);
+    }
+}
+function validateArnAccount(value, members, field) {
+    if (!value.startsWith('arn:'))
+        return;
+    const arnAccountId = value.split(':', 6)[4];
+    if (arnAccountId && !members.has(arnAccountId))
+        throw new Error(`${field} contains an ARN outside the declared organization membership.`);
+}
+function requiredMember(value, members, field) {
+    const accountId = requiredAccountId(value, field);
+    if (!members.has(accountId))
+        throw new Error(`${field} must belong to the declared organization membership.`);
+    return accountId;
+}
+function requiredAccountId(value, field) {
+    const accountId = requiredString(value, field);
+    assertAccount(value, accountId, field);
+    return accountId;
+}
+function requiredOrganizationId(value, field) {
+    const organizationId = requiredString(value, field);
+    if (!ORGANIZATION_ID.test(organizationId))
+        throw new Error(`${field} must be a canonical AWS organization id.`);
+    return organizationId;
+}
+function validateExpectedMembers(expected, actual) {
+    const normalized = expected.map((accountId, index) => requiredAccountId(accountId, `expected.memberAccountIds[${index}]`));
+    if (new Set(normalized).size !== normalized.length)
+        throw new Error('expected.memberAccountIds must not contain duplicates.');
+    const sorted = [...normalized].sort((left, right) => left.localeCompare(right));
+    if (JSON.stringify(sorted) !== JSON.stringify(normalized))
+        throw new Error('expected.memberAccountIds must be sorted.');
+    if (JSON.stringify(normalized) !== JSON.stringify(actual)) {
+        throw new Error('expected.memberAccountIds must match the artifact membership exactly.');
+    }
+}

package/dist/esm/aws/portalOrganizationCommitmentsPlanningPublicArtifactValidation.js

@@ -0,0 +1,405 @@
+import { assertCommitmentsFreshnessDiagnostics } from '../azure/commitmentsPlanningValidation.js';
+import { AWS_ORGANIZATION_COMMITMENTS_ATTRIBUTION_UNAVAILABLE_REASONS, } from './organizationCommitments.js';
+import { validateAwsOrganizationCommitmentsPlanningViewIdentity, } from './organizationCommitmentsValidation.js';
+import { AWS_ORGANIZATION_COMMITMENTS_PLANNING_LOGICAL_NAME, AWS_ORGANIZATION_COMMITMENTS_PUBLIC_ARTIFACT_SCHEMA_VERSION, } from './portalOrganizationCommitmentsPlanningPublicArtifacts.js';
+import { AWS_PORTAL_PUBLIC_ARTIFACT_SCHEMA_VERSION } from './publicArtifacts.js';
+import { asRecord, assertExactKeys, assertValue, finiteNumber, isoTimestamp, requiredEnum, requiredString, validateGeneration, } from '../common/validationHelpers.js';
+import { assertAwsPublicJson } from './validationHelpers.js';
+const TOP_LEVEL_KEYS = [
+    'schemaVersion',
+    'portalSchemaVersion',
+    'provider',
+    'artifactType',
+    'artifactGeneration',
+    'logicalName',
+    'manifestRevision',
+    'version',
+    'generatedAt',
+    'month',
+    'providerScope',
+    'accounts',
+    'utilizationSummary',
+    'expirySummary',
+    'inventory',
+    'payerAggregates',
+    'sharingPosture',
+    'pricingContext',
+    'freshness',
+    'purchaseRecommendations',
+    'allocation',
+    'resourceAttribution',
+];
+/** Validates one untrusted organization Commitments Planning view without its Portal envelope. */
+export function validateAwsOrganizationCommitmentsPlanningView(value, expected) {
+    validateAwsOrganizationCommitmentsPlanningViewIdentity(value, expected);
+    validateBody(value);
+    assertAwsPublicJson(value, 'organizationCommitmentsPlanning');
+    return value;
+}
+/** Validates one untrusted immutable AWS organization Commitments Planning artifact. */
+export function validateAwsPortalOrganizationCommitmentsPlanningArtifact(value, expected) {
+    const artifact = asRecord(value, 'artifact');
+    assertExactKeys(artifact, TOP_LEVEL_KEYS, 'artifact');
+    assertValue(artifact.schemaVersion, AWS_ORGANIZATION_COMMITMENTS_PUBLIC_ARTIFACT_SCHEMA_VERSION, 'artifact.schemaVersion');
+    assertValue(artifact.portalSchemaVersion, AWS_PORTAL_PUBLIC_ARTIFACT_SCHEMA_VERSION, 'artifact.portalSchemaVersion');
+    assertValue(artifact.provider, 'aws', 'artifact.provider');
+    assertValue(artifact.artifactType, 'organization-commitments-planning', 'artifact.artifactType');
+    assertValue(artifact.logicalName, AWS_ORGANIZATION_COMMITMENTS_PLANNING_LOGICAL_NAME, 'artifact.logicalName');
+    requiredString(artifact.manifestRevision, 'artifact.manifestRevision');
+    assertValue(artifact.version, '1.0', 'artifact.version');
+    const generation = validateGeneration(artifact.artifactGeneration, 'artifact.artifactGeneration');
+    const generatedAt = isoTimestamp(artifact.generatedAt, 'artifact.generatedAt');
+    if (Date.parse(generatedAt) > Date.parse(generation.generatedAt)) {
+        throw new Error('artifact.generatedAt must not be newer than the Portal generation.');
+    }
+    if (artifact.month !== undefined)
+        requiredString(artifact.month, 'artifact.month');
+    validateAwsOrganizationCommitmentsPlanningView(artifact, expected);
+    assertAwsPublicJson(artifact, 'artifact');
+    return value;
+}
+function validateBody(view) {
+    records(view.accounts, 'artifact.accounts', validateAccount);
+    validateUtilizationSummary(view.utilizationSummary, 'artifact.utilizationSummary');
+    exact(view.expirySummary, ['expired', 'expiring30d', 'expiring60d', 'expiring90d', 'expiring180d'], 'artifact.expirySummary');
+    records(view.inventory, 'artifact.inventory', validateInventory);
+    records(view.payerAggregates, 'artifact.payerAggregates', validatePayerAggregate);
+    validateSharingPosture(view.sharingPosture, 'artifact.sharingPosture');
+    validatePricingContext(view.pricingContext, 'artifact.pricingContext');
+    optionalRecord(view.freshness, 'artifact.freshness', validateFreshness);
+    optionalRecords(view.purchaseRecommendations, 'artifact.purchaseRecommendations', validatePurchaseRecommendation);
+    validateAttribution(view.allocation, 'artifact.allocation', validateAllocationRecord);
+    validateAttribution(view.resourceAttribution, 'artifact.resourceAttribution', validateResourceAttributionRecord);
+}
+function validateSharingPosture(value, field) {
+    const posture = exact(value, ['status', 'reason'], field);
+    assertValue(posture.status, 'unknown', `${field}.status`);
+    assertValue(posture.reason, 'not-collected', `${field}.reason`);
+}
+function validateAccount(value, field) {
+    const account = exact(value, ['accountId', 'displayName', 'role', 'inventoryStatus', 'lastSuccessfulRefreshAt'], field);
+    requiredString(account.accountId, `${field}.accountId`);
+    optionalString(account.displayName, `${field}.displayName`);
+    requiredEnum(account.role, ['management', 'member'], `${field}.role`);
+    requiredEnum(account.inventoryStatus, ['current', 'stale', 'partial', 'unavailable'], `${field}.inventoryStatus`);
+    optionalTimestamp(account.lastSuccessfulRefreshAt, `${field}.lastSuccessfulRefreshAt`);
+}
+function validateUtilizationSummary(value, field) {
+    const summary = exact(value, ['total', 'withData', 'sevenDayAverage', 'thirtyDayAverage', 'sevenDayAggregates', 'thirtyDayAggregates', 'byBenefitType'], field);
+    nonNegative(summary.total, `${field}.total`);
+    nonNegative(summary.withData, `${field}.withData`);
+    optionalNumber(summary.sevenDayAverage, `${field}.sevenDayAverage`);
+    optionalNumber(summary.thirtyDayAverage, `${field}.thirtyDayAverage`);
+    optionalRecords(summary.sevenDayAggregates, `${field}.sevenDayAggregates`, validateWeightedAggregate);
+    optionalRecords(summary.thirtyDayAggregates, `${field}.thirtyDayAggregates`, validateWeightedAggregate);
+    records(summary.byBenefitType, `${field}.byBenefitType`, (entry, itemField) => {
+        const item = exact(entry, ['benefitType', 'total', 'withData', 'sevenDayAverage', 'thirtyDayAverage', 'sevenDayAggregates', 'thirtyDayAggregates'], itemField);
+        requiredEnum(item.benefitType, ['reservation', 'savings-plan'], `${itemField}.benefitType`);
+        nonNegative(item.total, `${itemField}.total`);
+        nonNegative(item.withData, `${itemField}.withData`);
+        optionalNumber(item.sevenDayAverage, `${itemField}.sevenDayAverage`);
+        optionalNumber(item.thirtyDayAverage, `${itemField}.thirtyDayAverage`);
+        optionalRecords(item.sevenDayAggregates, `${itemField}.sevenDayAggregates`, validateWeightedAggregate);
+        optionalRecords(item.thirtyDayAggregates, `${itemField}.thirtyDayAggregates`, validateWeightedAggregate);
+    });
+}
+function validateWeightedAggregate(value, field) {
+    const aggregate = exact(value, ['used', 'reserved', 'percentage', 'sampleCount', 'unit', 'currency'], field);
+    finiteNumber(aggregate.used, `${field}.used`);
+    finiteNumber(aggregate.reserved, `${field}.reserved`);
+    optionalNumber(aggregate.percentage, `${field}.percentage`);
+    if (aggregate.sampleCount !== undefined)
+        nonNegative(aggregate.sampleCount, `${field}.sampleCount`);
+    requiredEnum(aggregate.unit, ['hours', 'quantity', 'currency'], `${field}.unit`);
+    optionalString(aggregate.currency, `${field}.currency`);
+}
+function validateInventory(value, field) {
+    const item = exact(value, [
+        'id',
+        'benefitType',
+        'commitmentFamily',
+        'sourceKind',
+        'sourceId',
+        'provider',
+        'ownerAccountId',
+        'shape',
+        'scope',
+        'type',
+        'displayName',
+        'status',
+        'purchaseDate',
+        'expiryDate',
+        'daysToExpiry',
+        'commitmentAmount',
+        'commitmentCurrencyCode',
+        'commitmentGrain',
+        'commitmentUnit',
+        'skuName',
+        'location',
+        'term',
+        'termMonths',
+        'billingPlan',
+        'utilization',
+    ], field);
+    requiredString(item.id, `${field}.id`);
+    requiredEnum(item.benefitType, ['reservation', 'savings-plan'], `${field}.benefitType`);
+    optionalString(item.commitmentFamily, `${field}.commitmentFamily`);
+    assertValue(item.sourceKind, 'aws-native', `${field}.sourceKind`);
+    optionalString(item.sourceId, `${field}.sourceId`);
+    assertValue(item.provider, 'aws', `${field}.provider`);
+    requiredString(item.ownerAccountId, `${field}.ownerAccountId`);
+    optionalRecord(item.shape, `${field}.shape`, validateShape);
+    requiredEnum(item.scope, ['Shared', 'Single', 'ManagementGroup', 'Unknown'], `${field}.scope`);
+    requiredString(item.type, `${field}.type`);
+    optionalString(item.displayName, `${field}.displayName`);
+    requiredString(item.status, `${field}.status`);
+    optionalString(item.purchaseDate, `${field}.purchaseDate`);
+    optionalString(item.expiryDate, `${field}.expiryDate`);
+    optionalNumber(item.daysToExpiry, `${field}.daysToExpiry`);
+    optionalNumber(item.commitmentAmount, `${field}.commitmentAmount`);
+    optionalString(item.commitmentCurrencyCode, `${field}.commitmentCurrencyCode`);
+    optionalString(item.commitmentGrain, `${field}.commitmentGrain`);
+    optionalString(item.commitmentUnit, `${field}.commitmentUnit`);
+    optionalString(item.skuName, `${field}.skuName`);
+    optionalString(item.location, `${field}.location`);
+    optionalString(item.term, `${field}.term`);
+    optionalNumber(item.termMonths, `${field}.termMonths`);
+    optionalString(item.billingPlan, `${field}.billingPlan`);
+    optionalRecord(item.utilization, `${field}.utilization`, validateUtilization);
+}
+function validatePayerAggregate(value, field) {
+    const aggregate = exact(value, [
+        'benefitType',
+        'commitmentFamily',
+        'payerAccountId',
+        'windowStart',
+        'windowEnd',
+        'eligibleCost',
+        'coveredCost',
+        'uncoveredCost',
+        'coveragePercent',
+        'utilization',
+        'source',
+    ], field);
+    requiredEnum(aggregate.benefitType, ['reservation', 'savings-plan'], `${field}.benefitType`);
+    requiredString(aggregate.commitmentFamily, `${field}.commitmentFamily`);
+    requiredString(aggregate.payerAccountId, `${field}.payerAccountId`);
+    requiredString(aggregate.windowStart, `${field}.windowStart`);
+    requiredString(aggregate.windowEnd, `${field}.windowEnd`);
+    optionalRecord(aggregate.eligibleCost, `${field}.eligibleCost`, validateMoney);
+    optionalRecord(aggregate.coveredCost, `${field}.coveredCost`, validateMoney);
+    optionalRecord(aggregate.uncoveredCost, `${field}.uncoveredCost`, validateMoney);
+    optionalNumber(aggregate.coveragePercent, `${field}.coveragePercent`);
+    optionalRecord(aggregate.utilization, `${field}.utilization`, validateUtilization);
+    validateSource(aggregate.source, `${field}.source`, false);
+}
+function validatePurchaseRecommendation(value, field) {
+    const recommendation = exact(value, [
+        'id',
+        'groupKey',
+        'commitmentFamily',
+        'action',
+        'purchaseScope',
+        'payerAccountId',
+        'recommendedAccountId',
+        'source',
+        'targetShape',
+        'title',
+        'description',
+        'confidence',
+        'riskLevel',
+        'termMonths',
+        'quantity',
+        'estimatedAnnualSavings',
+        'estimatedAnnualCost',
+        'estimatedTermSavings',
+        'estimatedTermCost',
+        'notes',
+    ], field);
+    requiredString(recommendation.id, `${field}.id`);
+    requiredString(recommendation.groupKey, `${field}.groupKey`);
+    requiredString(recommendation.commitmentFamily, `${field}.commitmentFamily`);
+    requiredEnum(recommendation.action, ['buy', 'unlock', 'savings-plan', 'none'], `${field}.action`);
+    assertValue(recommendation.purchaseScope, 'payer', `${field}.purchaseScope`);
+    requiredString(recommendation.payerAccountId, `${field}.payerAccountId`);
+    optionalString(recommendation.recommendedAccountId, `${field}.recommendedAccountId`);
+    validateSource(recommendation.source, `${field}.source`, false);
+    validateShape(recommendation.targetShape, `${field}.targetShape`);
+    optionalString(recommendation.title, `${field}.title`);
+    optionalString(recommendation.description, `${field}.description`);
+    optionalString(recommendation.confidence, `${field}.confidence`);
+    optionalString(recommendation.riskLevel, `${field}.riskLevel`);
+    optionalNumber(recommendation.termMonths, `${field}.termMonths`);
+    optionalNumber(recommendation.quantity, `${field}.quantity`);
+    optionalRecord(recommendation.estimatedAnnualSavings, `${field}.estimatedAnnualSavings`, validateMoney);
+    optionalRecord(recommendation.estimatedAnnualCost, `${field}.estimatedAnnualCost`, validateMoney);
+    optionalRecord(recommendation.estimatedTermSavings, `${field}.estimatedTermSavings`, validateMoney);
+    optionalRecord(recommendation.estimatedTermCost, `${field}.estimatedTermCost`, validateMoney);
+    optionalStrings(recommendation.notes, `${field}.notes`);
+}
+function validateAttribution(value, field, validateRecord) {
+    const evidence = asRecord(value, field);
+    if (evidence.status === 'unavailable') {
+        assertExactKeys(evidence, ['status', 'reason'], field);
+        requiredEnum(evidence.reason, AWS_ORGANIZATION_COMMITMENTS_ATTRIBUTION_UNAVAILABLE_REASONS, `${field}.reason`);
+        return;
+    }
+    assertValue(evidence.status, 'available', `${field}.status`);
+    assertExactKeys(evidence, ['status', 'source', 'records'], field);
+    validateSource(evidence.source, `${field}.source`, true);
+    records(evidence.records, `${field}.records`, validateRecord, true);
+}
+function validateAllocationRecord(value, field) {
+    const record = exact(value, [
+        'beneficiaryAccountId',
+        'ownerAccountId',
+        'commitmentId',
+        'benefitType',
+        'commitmentFamily',
+        'windowStart',
+        'windowEnd',
+        'eligibleCost',
+        'coveredCost',
+        'uncoveredCost',
+    ], field);
+    requiredString(record.beneficiaryAccountId, `${field}.beneficiaryAccountId`);
+    optionalString(record.ownerAccountId, `${field}.ownerAccountId`);
+    optionalString(record.commitmentId, `${field}.commitmentId`);
+    requiredEnum(record.benefitType, ['reservation', 'savings-plan'], `${field}.benefitType`);
+    requiredString(record.commitmentFamily, `${field}.commitmentFamily`);
+    requiredString(record.windowStart, `${field}.windowStart`);
+    requiredString(record.windowEnd, `${field}.windowEnd`);
+    optionalRecord(record.eligibleCost, `${field}.eligibleCost`, validateMoney);
+    optionalRecord(record.coveredCost, `${field}.coveredCost`, validateMoney);
+    optionalRecord(record.uncoveredCost, `${field}.uncoveredCost`, validateMoney);
+}
+function validateResourceAttributionRecord(value, field) {
+    const record = exact(value, ['accountId', 'resourceId', 'resourceName', 'resourceType', 'benefitIds', 'windowStart', 'windowEnd', 'coveredCost'], field);
+    requiredString(record.accountId, `${field}.accountId`);
+    requiredString(record.resourceId, `${field}.resourceId`);
+    optionalString(record.resourceName, `${field}.resourceName`);
+    optionalString(record.resourceType, `${field}.resourceType`);
+    strings(record.benefitIds, `${field}.benefitIds`);
+    requiredString(record.windowStart, `${field}.windowStart`);
+    requiredString(record.windowEnd, `${field}.windowEnd`);
+    optionalRecord(record.coveredCost, `${field}.coveredCost`, validateMoney);
+}
+function validateShape(value, field) {
+    const shape = exact(value, [
+        'provider',
+        'resourceType',
+        'commitmentFamily',
+        'skuName',
+        'normalizedSkuName',
+        'location',
+        'region',
+        'availabilityZone',
+        'platform',
+        'reservationProductName',
+        'reservedResourceType',
+        'meterCategory',
+        'meterSubCategory',
+        'meterName',
+        'unit',
+        'attributes',
+    ], field);
+    assertValue(shape.provider, 'aws', `${field}.provider`);
+    if (shape.attributes !== undefined)
+        asRecord(shape.attributes, `${field}.attributes`);
+}
+function validateSource(value, field, allowDerived) {
+    const source = exact(value, ['sourceKind', 'sourceId', 'sourceName', 'generatedAt', 'observedAt', 'notes'], field);
+    requiredEnum(source.sourceKind, allowDerived ? ['aws-native', 'spotto-derived'] : ['aws-native'], `${field}.sourceKind`);
+    optionalString(source.sourceId, `${field}.sourceId`);
+    optionalString(source.sourceName, `${field}.sourceName`);
+    optionalTimestamp(source.generatedAt, `${field}.generatedAt`);
+    optionalTimestamp(source.observedAt, `${field}.observedAt`);
+    optionalStrings(source.notes, `${field}.notes`);
+}
+function validateMoney(value, field) {
+    const money = exact(value, ['amount', 'currency', 'source', 'windowStart', 'windowEnd', 'flags'], field);
+    finiteNumber(money.amount, `${field}.amount`);
+    requiredString(money.currency, `${field}.currency`);
+    optionalString(money.source, `${field}.source`);
+    optionalString(money.windowStart, `${field}.windowStart`);
+    optionalString(money.windowEnd, `${field}.windowEnd`);
+    optionalStrings(money.flags, `${field}.flags`);
+}
+function validateUtilization(value, field) {
+    const utilization = exact(value, ['trend', 'oneDay', 'sevenDay', 'thirtyDay', 'source'], field);
+    optionalString(utilization.trend, `${field}.trend`);
+    optionalNumber(utilization.oneDay, `${field}.oneDay`);
+    optionalNumber(utilization.sevenDay, `${field}.sevenDay`);
+    optionalNumber(utilization.thirtyDay, `${field}.thirtyDay`);
+    optionalString(utilization.source, `${field}.source`);
+}
+function validatePricingContext(value, field) {
+    const pricing = exact(value, ['source', 'currency', 'assumptions', 'confidenceNotes', 'calculatorDeepLink'], field);
+    requiredEnum(pricing.source, ['retail', 'negotiated', 'unknown', 'recommendation-apis'], `${field}.source`);
+    optionalString(pricing.currency, `${field}.currency`);
+    optionalStrings(pricing.assumptions, `${field}.assumptions`);
+    optionalString(pricing.confidenceNotes, `${field}.confidenceNotes`);
+    optionalString(pricing.calculatorDeepLink, `${field}.calculatorDeepLink`);
+}
+function validateFreshness(value, field) {
+    const freshness = exact(value, ['status', 'generatedAt', 'entries', 'warnings'], field);
+    requiredEnum(freshness.status, ['current', 'stale', 'partial', 'unavailable'], `${field}.status`);
+    isoTimestamp(freshness.generatedAt, `${field}.generatedAt`);
+    records(freshness.entries, `${field}.entries`, (entry, itemField) => {
+        const item = exact(entry, ['section', 'status', 'generatedAt', 'observedAt', 'lastSuccessfulSyncAt', 'ageHours', 'reasonCode', 'reason', 'sourceKind'], itemField);
+        requiredString(item.section, `${itemField}.section`);
+        requiredEnum(item.status, ['current', 'stale', 'partial', 'unavailable'], `${itemField}.status`);
+        optionalTimestamp(item.generatedAt, `${itemField}.generatedAt`);
+        optionalTimestamp(item.observedAt, `${itemField}.observedAt`);
+        optionalTimestamp(item.lastSuccessfulSyncAt, `${itemField}.lastSuccessfulSyncAt`);
+        optionalString(item.reason, `${itemField}.reason`);
+        optionalString(item.sourceKind, `${itemField}.sourceKind`);
+        assertCommitmentsFreshnessDiagnostics(item, itemField);
+    });
+    optionalStrings(freshness.warnings, `${field}.warnings`);
+}
+function exact(value, allowed, field) {
+    const record = asRecord(value, field);
+    assertExactKeys(record, allowed, field);
+    return record;
+}
+function records(value, field, validate, nonEmpty = false) {
+    if (!Array.isArray(value) || (nonEmpty && value.length === 0)) {
+        throw new Error(`${field} must be ${nonEmpty ? 'a non-empty' : 'an'} array.`);
+    }
+    value.forEach((entry, index) => validate(entry, `${field}[${index}]`));
+}
+function optionalRecords(value, field, validate) {
+    if (value !== undefined)
+        records(value, field, validate);
+}
+function optionalRecord(value, field, validate) {
+    if (value !== undefined)
+        validate(value, field);
+}
+function strings(value, field) {
+    if (!Array.isArray(value))
+        throw new Error(`${field} must be an array.`);
+    value.forEach((entry, index) => requiredString(entry, `${field}[${index}]`));
+}
+function optionalStrings(value, field) {
+    if (value !== undefined)
+        strings(value, field);
+}
+function optionalString(value, field) {
+    if (value !== undefined)
+        requiredString(value, field);
+}
+function optionalTimestamp(value, field) {
+    if (value !== undefined)
+        isoTimestamp(value, field);
+}
+function optionalNumber(value, field) {
+    if (value !== undefined)
+        finiteNumber(value, field);
+}
+function nonNegative(value, field) {
+    const number = finiteNumber(value, field);
+    if (number < 0)
+        throw new Error(`${field} must not be negative.`);
+}

package/dist/esm/aws/portalOrganizationCommitmentsPlanningPublicArtifacts.js

@@ -0,0 +1,2 @@
+export const AWS_ORGANIZATION_COMMITMENTS_PUBLIC_ARTIFACT_SCHEMA_VERSION = 1;
+export const AWS_ORGANIZATION_COMMITMENTS_PLANNING_LOGICAL_NAME = 'organization-commitments-planning.json.gz';

package/dist/esm/aws/publicArtifacts.js

@@ -1,4 +1,6 @@
 export const AWS_PUBLIC_ARTIFACT_SCHEMA_VERSION = 1;
+/** Portal envelope version shared by the AWS Portal artifacts. */
+export const AWS_PORTAL_PUBLIC_ARTIFACT_SCHEMA_VERSION = 1;
 export const AWS_PUBLIC_ARTIFACT_TYPES = [
     'resource-collection',
     'resource-collection-history',

package/dist/esm/aws/relationships.js

@@ -1 +1,4 @@
-export { validateAwsPortalRelationshipArtifact } from './portalRelationshipPublicArtifactValidation.js';
+/** Browser-safe entry for the AWS resource graph contract, its validator, and the provider-neutral graph vocabulary. */
+export * from './resourceGraph.js';
+export * from '../common/resourceGraph.js';
+export * from '../common/resourceIdentity.js';

package/dist/esm/aws/requests.js

@@ -3,9 +3,11 @@ export const AWS_COMMAND_SCHEMA_VERSION = 1;
 /** Canonical provider wire value for AWS commands. */
 export const AWS_COMMAND_PROVIDER = 'aws';
 /** Entities handled by AWS estate orchestration. */
-export const AWS_COMMAND_ENTITIES = ['estate', 'account', 'billing-source'];
+export const AWS_COMMAND_ENTITIES = ['estate', 'account', 'billing-source', 'organization-commitments', 'scheduler'];
 /** Actions supported across AWS estate orchestration commands. */
-export const AWS_COMMAND_ACTIONS = ['reconcile', 'refresh', 'delete'];
+export const AWS_COMMAND_ACTIONS = ['reconcile', 'refresh', 'delete', 'tick'];
+/** Scheduled AWS scan cadences emitted by the enqueue-only API scheduler. */
+export const AWS_SCHEDULED_REFRESH_SCAN_KINDS = ['full', 'components'];
 /** Credential-shaped keys forbidden from shared AWS configuration and commands. */
 export const AWS_FORBIDDEN_CREDENTIAL_FIELDS = [
     'accessKeyId',