@spottoai/types-package 1.0.2-dev1138.13 → 1.0.2-dev1138.14

package/dist/esm/aws/resourceGraph.js

@@ -0,0 +1,63 @@
+import { validateResourceGraphArtifact, } from '../common/resourceGraphValidation.js';
+import { AWS_ACCOUNT_ID_PATTERN, AWS_REGION_PATTERN, isAwsCredentialKey, isForbiddenAwsPublicKey } from './validationHelpers.js';
+/** CloudFormation-style resource type, for example `AWS::EC2::Instance`. */
+export const AWS_RESOURCE_TYPE_PATTERN = /^AWS::[A-Za-z0-9]+::[A-Za-z0-9]+$/;
+/** Region value for account-global resources such as IAM. */
+export const AWS_GLOBAL_REGION = 'global';
+const ARN_PATTERN = /^arn:(aws(?:-[a-z0-9-]+)?):[^:]+:([^:]*):([^:]*):.+$/;
+const AVAILABILITY_ZONE_KEY_PATTERN = /(?:^a|A)vailabilityZone(?:Name)?s?$/;
+const AWS_RESOURCE_GRAPH_RULES = {
+    provider: 'aws',
+    isAccountId: value => AWS_ACCOUNT_ID_PATTERN.test(value),
+    isRegion: value => value === AWS_GLOBAL_REGION || AWS_REGION_PATTERN.test(value),
+    isResourceType: value => AWS_RESOURCE_TYPE_PATTERN.test(value),
+    validateNativeId: (nativeId, scope, field) => {
+        if (nativeId.startsWith('arn:'))
+            validateScopedArn(nativeId, scope, field, false);
+    },
+    validateZone: validateAvailabilityZone,
+    validateAttribute: validateAttributeFormat,
+    isForbiddenKey: (key, inAttributes) => (inAttributes ? isAwsCredentialKey(key) : isForbiddenAwsPublicKey(key)),
+};
+/**
+ * Validates one untrusted AWS resource graph. Adds AWS identifier formats to
+ * the generic structural checks; any discovery family is accepted.
+ */
+export function validateAwsResourceGraphArtifact(value) {
+    return validateResourceGraphArtifact(value, AWS_RESOURCE_GRAPH_RULES);
+}
+/**
+ * An ARN must stay inside its node's account and Region. Empty ARN segments
+ * (S3, IAM) are allowed; attribute references may also name AWS-owned (`aws`) resources.
+ */
+function validateScopedArn(value, scope, field, allowAwsOwned) {
+    const match = ARN_PATTERN.exec(value);
+    if (!match)
+        throw new Error(`${field} must be a canonical AWS ARN.`);
+    const [, , arnRegion, arnAccountId] = match;
+    const expectedRegion = scope.region === AWS_GLOBAL_REGION ? '' : scope.region;
+    if (arnRegion !== '' && arnRegion !== expectedRegion)
+        throw new Error(`${field} ARN Region must match its node Region.`);
+    if (arnAccountId !== '' && arnAccountId !== scope.accountId && !(allowAwsOwned && arnAccountId === 'aws'))
+        throw new Error(`${field} ARN account must match the artifact account.`);
+}
+function validateAvailabilityZone(value, region, field) {
+    if (region === AWS_GLOBAL_REGION || value === region || !value.startsWith(region))
+        throw new Error(`${field} must belong to its node Region.`);
+}
+function validateAttributeFormat(key, value, scope, field) {
+    if (key.endsWith('Arn')) {
+        if (typeof value !== 'string')
+            throw new Error(`${field} must be an ARN string.`);
+        validateScopedArn(value, scope, field, true);
+    }
+    if (AVAILABILITY_ZONE_KEY_PATTERN.test(key)) {
+        const zones = Array.isArray(value) ? value : [value];
+        zones.forEach((zone, index) => {
+            const zoneField = Array.isArray(value) ? `${field}[${index}]` : field;
+            if (typeof zone !== 'string')
+                throw new Error(`${zoneField} must be an Availability Zone name.`);
+            validateAvailabilityZone(zone, scope.region ?? AWS_GLOBAL_REGION, zoneField);
+        });
+    }
+}

package/dist/esm/aws/validationHelpers.js

@@ -0,0 +1,46 @@
+import { assertPlainJson, assertValue } from '../common/validationHelpers.js';
+import { AWS_FORBIDDEN_CREDENTIAL_FIELDS } from './requests.js';
+export const AWS_ACCOUNT_ID_PATTERN = /^\d{12}$/;
+export const AWS_REGION_PATTERN = /^[a-z]{2}(?:-gov)?-[a-z0-9-]+-\d+$/;
+/** Credential material and setup secrets; rejected at every depth of a public artifact. */
+const CREDENTIAL_KEYS = new Set([...AWS_FORBIDDEN_CREDENTIAL_FIELDS, 'externalId', 'secretReference', 'credentialReference'].map(key => key.toLowerCase()));
+/** Setup locators and engine-operational markers that never belong on a public envelope. */
+const OPERATIONAL_KEYS = new Set([
+    'roleArn',
+    'secretArn',
+    'storagePath',
+    'sourcePath',
+    'path',
+    'blobPath',
+    'containerPath',
+    'chunk',
+    'chunks',
+    'lease',
+    'retries',
+    'retry',
+    'refreshState',
+    'lastRefreshExecutionRequestId',
+    'lastRefreshExecutionRequestedAt',
+    'prompt',
+    'promptInput',
+    'sourceBytes',
+    'maxSourceBytes',
+    'bedrockRegion',
+    'guardrailId',
+    'guardrailVersion',
+    'etag',
+    'eTag',
+    'retiredAt',
+].map(key => key.toLowerCase()));
+const OPERATIONAL_KEY_PATTERN = /^(?:source|storage|blob|container)(?:path|uri|url|key)$|^s3(?:bucket|key|uri|url)$/i;
+export const isAwsCredentialKey = (key) => CREDENTIAL_KEYS.has(key.toLowerCase());
+export const isForbiddenAwsPublicKey = (key) => isAwsCredentialKey(key) || OPERATIONAL_KEYS.has(key.toLowerCase()) || OPERATIONAL_KEY_PATTERN.test(key);
+/** Rejects non-JSON values plus credential, physical-path, and operational-marker keys recursively. */
+export function assertAwsPublicJson(value, field) {
+    assertPlainJson(value, field, isForbiddenAwsPublicKey);
+}
+export function assertAccount(value, accountId, field) {
+    assertValue(value, accountId, field);
+    if (!AWS_ACCOUNT_ID_PATTERN.test(accountId))
+        throw new Error(`${field} must be a 12-digit AWS account id.`);
+}

package/dist/esm/azure/activityLogAnalysis.js

@@ -0,0 +1,64 @@
+export const ACTIVITY_LOG_TAXONOMY_VERSION = 'v1';
+export const ACTIVITY_LOG_ANALYSIS_VERSION = 'v1';
+export const CONFORMED_ACTIVITY_ANALYSIS_SCHEMA_VERSION = 1;
+export const PORTAL_ACTIVITY_ANALYSIS_RESPONSE_SCHEMA_VERSION = 1;
+export const CONFORMED_ACTIVITY_ANALYSIS_LIMITS_V1 = Object.freeze({
+    sourceShardFingerprintCodeUnits: 512 * 1024,
+});
+export const PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1 = Object.freeze({
+    tagAssignmentsPerEvent: 32,
+    facetTagRows: 64,
+    facetOperationRows: 4096,
+    facetProviderRows: 512,
+    facetResourceTypeRows: 4096,
+    facetResultRows: 256,
+    facetOperationEffectRows: 8,
+    facetExecutionOriginRows: 8,
+    activitySeries: 10000,
+    resourceSummaries: 10000,
+    operationSummaries: 4096,
+    securitySensitive: 4096,
+    powerPatterns: 4096,
+    operationCountsPerItem: 256,
+    resultCountsPerItem: 256,
+    tagCountsPerItem: 64,
+    executionOriginCountsPerItem: 8,
+    evidenceIdsPerItem: 20,
+    reasonCodesPerItem: 32,
+    resourceIdCodeUnits: 2048,
+    operationCodeUnits: 512,
+    providerCodeUnits: 256,
+    resourceTypeCodeUnits: 512,
+    resourceNameCodeUnits: 512,
+    reasonCodeUnits: 128,
+    responseUtf8Bytes: 33554432,
+});
+export const ACTIVITY_LOG_TAG_IDS = [
+    'actor.manual',
+    'actor.workload-automation',
+    'actor.azure-platform',
+    'actor.unknown',
+    'change.material',
+    'intent.credential-access',
+    'intent.remote-execution',
+    'intent.power-control',
+    'security.sensitive-operation',
+    'security.credential-access',
+    'security.remote-execution',
+    'security.privileged-access-change',
+    'security.security-boundary-change',
+    'security.protection-control-change',
+    'security.destructive-action',
+    'scheduler.power-operation',
+];
+const CANONICAL_MONTH = /^\d{4}-(0[1-9]|1[0-2])$/;
+const CONFORMED_ACTIVITY_ANALYSIS_NAME = /^activity-logs\/activity_analysis-(\d{4}-(?:0[1-9]|1[0-2]))\.json$/;
+export function buildConformedActivityAnalysisLogicalName(month) {
+    if (!CANONICAL_MONTH.test(month)) {
+        throw new Error('Activity Analysis month must use canonical YYYY-MM format.');
+    }
+    return `activity-logs/activity_analysis-${month}.json`;
+}
+export function parseConformedActivityAnalysisLogicalName(logicalName) {
+    return CONFORMED_ACTIVITY_ANALYSIS_NAME.exec(logicalName)?.[1];
+}

package/dist/esm/azure/activityLogAnalysisPublicValidation.js

@@ -0,0 +1,360 @@
+import { PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1, PORTAL_ACTIVITY_ANALYSIS_RESPONSE_SCHEMA_VERSION, } from './activityLogAnalysis.js';
+import { CONFIDENCES, EFFECTS, LIMITATIONS, MONTH, ORIGINS, POWER_SUFFICIENCY, TAG_IDS, countRowsTotal, hasExactKeys, hasValidTimes, isChronologicalCountRows, isCount, isCountRows, isDate, isEvidenceIds, isGroupIds, isPortalActivityAnalysisGroupId, isPortalActivityEvidenceId, isPortalActivityLogClassification, isPositiveCount, isReasons, isRecord, isScope, isSortedUniqueStrings, isText, isTimestamp, isTags, utf8ByteLength, } from './activityLogAnalysisPublicValidationHelpers.js';
+export { isPortalActivityAnalysisGroupId, isPortalActivityEvidenceId, isPortalActivityLogClassification };
+const isSeries = (value, subscriptionId, resourceId, requestedMonths) => {
+    if (!hasExactKeys(value, [
+        'seriesId',
+        'scope',
+        'operation',
+        'result',
+        'executionOrigin',
+        'operationEffect',
+        'tagIds',
+        'eventCount',
+        'firstTimestamp',
+        'lastTimestamp',
+        'monthCounts',
+        'dailyCounts',
+        'utcWeekdayHourDistribution',
+        'confidence',
+        'evidenceIds',
+        'evidenceTruncated',
+    ]) ||
+        !isPortalActivityAnalysisGroupId(value.seriesId) ||
+        !isScope(value.scope, subscriptionId, resourceId) ||
+        !isText(value.operation, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.operationCodeUnits) ||
+        !isText(value.result, 256) ||
+        typeof value.executionOrigin !== 'string' ||
+        !ORIGINS.has(value.executionOrigin) ||
+        typeof value.operationEffect !== 'string' ||
+        !EFFECTS.has(value.operationEffect) ||
+        !isTags(value.tagIds) ||
+        !isPositiveCount(value.eventCount) ||
+        !hasValidTimes(value) ||
+        !isChronologicalCountRows(value.monthCounts, month => MONTH.test(month) && requestedMonths.has(month)) ||
+        !Array.isArray(value.dailyCounts) ||
+        !Array.isArray(value.utcWeekdayHourDistribution) ||
+        typeof value.confidence !== 'string' ||
+        !CONFIDENCES.has(value.confidence) ||
+        !isEvidenceIds(value.evidenceIds) ||
+        typeof value.evidenceTruncated !== 'boolean')
+        return false;
+    let dailyTotal = 0;
+    for (let index = 0; index < value.dailyCounts.length; index += 1) {
+        const row = value.dailyCounts[index];
+        if (!hasExactKeys(row, ['date', 'count']) ||
+            !isDate(row.date) ||
+            !isPositiveCount(row.count) ||
+            (index > 0 && value.dailyCounts[index - 1].date >= row.date))
+            return false;
+        if (!requestedMonths.has(row.date.slice(0, 7)))
+            return false;
+        dailyTotal += row.count;
+    }
+    let timeTotal = 0;
+    let previousBucket = -1;
+    for (const row of value.utcWeekdayHourDistribution) {
+        if (!hasExactKeys(row, ['weekday', 'hour', 'count']) ||
+            !isCount(row.weekday) ||
+            row.weekday > 6 ||
+            !isCount(row.hour) ||
+            row.hour > 23 ||
+            !isPositiveCount(row.count))
+            return false;
+        const bucket = row.weekday * 24 + row.hour;
+        if (bucket <= previousBucket)
+            return false;
+        previousBucket = bucket;
+        timeTotal += row.count;
+    }
+    return countRowsTotal(value.monthCounts) === value.eventCount && dailyTotal === value.eventCount && timeTotal === value.eventCount;
+};
+const isResource = (value, subscriptionId, resourceId) => {
+    if (!hasExactKeys(value, [
+        'scope',
+        'eventCount',
+        'firstTimestamp',
+        'lastTimestamp',
+        'operationCounts',
+        'resultCounts',
+        'tagCounts',
+        'executionOriginCounts',
+        'relatedGroupIds',
+        'confidence',
+    ]) ||
+        !isScope(value.scope, subscriptionId, resourceId) ||
+        value.scope.level !== 'resource' ||
+        !isPositiveCount(value.eventCount) ||
+        !hasValidTimes(value) ||
+        !isCountRows(value.operationCounts, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.operationCountsPerItem, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.operationCodeUnits) ||
+        !isCountRows(value.resultCounts, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resultCountsPerItem, 256) ||
+        !isCountRows(value.tagCounts, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.tagCountsPerItem, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.reasonCodeUnits, TAG_IDS) ||
+        !isCountRows(value.executionOriginCounts, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.executionOriginCountsPerItem, 32, ORIGINS) ||
+        !isGroupIds(value.relatedGroupIds) ||
+        typeof value.confidence !== 'string' ||
+        !CONFIDENCES.has(value.confidence))
+        return false;
+    return (countRowsTotal(value.operationCounts) === value.eventCount &&
+        countRowsTotal(value.resultCounts) === value.eventCount &&
+        countRowsTotal(value.executionOriginCounts) === value.eventCount);
+};
+const DERIVED_BASE_KEYS = [
+    'scope',
+    'eventCount',
+    'firstTimestamp',
+    'lastTimestamp',
+    'confidence',
+    'tagIds',
+    'reasons',
+    'evidenceIds',
+    'evidenceTruncated',
+];
+const isDerivedBase = (value, subscriptionId, resourceId) => isScope(value.scope, subscriptionId, resourceId) &&
+    isPositiveCount(value.eventCount) &&
+    hasValidTimes(value) &&
+    typeof value.confidence === 'string' &&
+    CONFIDENCES.has(value.confidence) &&
+    isTags(value.tagIds) &&
+    isReasons(value.reasons) &&
+    isEvidenceIds(value.evidenceIds) &&
+    typeof value.evidenceTruncated === 'boolean';
+const isDerived = (value, subscriptionId, resourceId) => {
+    if (!isRecord(value) || typeof value.derivedType !== 'string')
+        return false;
+    if (value.derivedType === 'operationSummary') {
+        return (hasExactKeys(value, ['groupId', 'derivedType', ...DERIVED_BASE_KEYS, 'operation', 'operationEffect', 'executionOrigin', 'distinctResourceCount', 'resultCounts'], ['provider', 'resourceType']) &&
+            isPortalActivityAnalysisGroupId(value.groupId) &&
+            isDerivedBase(value, subscriptionId, resourceId) &&
+            isText(value.operation, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.operationCodeUnits) &&
+            (value.provider === undefined || isText(value.provider, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.providerCodeUnits)) &&
+            (value.resourceType === undefined || isText(value.resourceType, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resourceTypeCodeUnits)) &&
+            typeof value.operationEffect === 'string' &&
+            EFFECTS.has(value.operationEffect) &&
+            typeof value.executionOrigin === 'string' &&
+            ORIGINS.has(value.executionOrigin) &&
+            isCount(value.distinctResourceCount) &&
+            value.distinctResourceCount <= value.eventCount &&
+            isCountRows(value.resultCounts, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resultCountsPerItem, 256) &&
+            countRowsTotal(value.resultCounts) === value.eventCount);
+    }
+    if (value.derivedType === 'securitySensitiveActivity') {
+        return (hasExactKeys(value, ['groupId', 'derivedType', ...DERIVED_BASE_KEYS, 'capabilityTag', 'operation', 'executionOrigin', 'resultCounts']) &&
+            isPortalActivityAnalysisGroupId(value.groupId) &&
+            isDerivedBase(value, subscriptionId, resourceId) &&
+            typeof value.capabilityTag === 'string' &&
+            value.capabilityTag.startsWith('security.') &&
+            value.capabilityTag !== 'security.sensitive-operation' &&
+            TAG_IDS.has(value.capabilityTag) &&
+            value.tagIds.includes(value.capabilityTag) &&
+            isText(value.operation, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.operationCodeUnits) &&
+            typeof value.executionOrigin === 'string' &&
+            ORIGINS.has(value.executionOrigin) &&
+            isCountRows(value.resultCounts, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resultCountsPerItem, 256) &&
+            countRowsTotal(value.resultCounts) === value.eventCount);
+    }
+    return isPowerPattern(value, subscriptionId, resourceId);
+};
+const isPowerPattern = (value, subscriptionId, resourceId) => {
+    if (!hasExactKeys(value, [
+        'patternId',
+        'derivedType',
+        ...DERIVED_BASE_KEYS,
+        'startCount',
+        'stopCount',
+        'opposingPairCount',
+        'utcActiveDayCount',
+        'utcHourDistribution',
+        'executionOriginCounts',
+        'resultCounts',
+        'dataSufficiency',
+    ]) ||
+        value.derivedType !== 'powerPatternEvidence' ||
+        !isPortalActivityAnalysisGroupId(value.patternId) ||
+        !isDerivedBase(value, subscriptionId, resourceId) ||
+        value.scope.level !== 'resource' ||
+        !isCount(value.startCount) ||
+        !isCount(value.stopCount) ||
+        value.startCount + value.stopCount !== value.eventCount ||
+        !isCount(value.opposingPairCount) ||
+        value.opposingPairCount !== Math.min(value.startCount, value.stopCount) ||
+        !isPositiveCount(value.utcActiveDayCount) ||
+        value.utcActiveDayCount > value.eventCount ||
+        !Array.isArray(value.utcHourDistribution) ||
+        !isCountRows(value.executionOriginCounts, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.executionOriginCountsPerItem, 32, ORIGINS) ||
+        !isCountRows(value.resultCounts, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resultCountsPerItem, 256) ||
+        typeof value.dataSufficiency !== 'string' ||
+        !POWER_SUFFICIENCY.has(value.dataSufficiency))
+        return false;
+    let total = 0;
+    let previousHour = -1;
+    for (const row of value.utcHourDistribution) {
+        if (!hasExactKeys(row, ['hour', 'count']) || !isCount(row.hour) || row.hour > 23 || row.hour <= previousHour || !isPositiveCount(row.count))
+            return false;
+        previousHour = row.hour;
+        total += row.count;
+    }
+    return (total === value.eventCount &&
+        countRowsTotal(value.executionOriginCounts) === value.eventCount &&
+        countRowsTotal(value.resultCounts) === value.eventCount);
+};
+const isCollection = (value, maximum, validator) => hasExactKeys(value, ['totalCount', 'returnedCount', 'truncated', 'items']) &&
+    isCount(value.totalCount) &&
+    isCount(value.returnedCount) &&
+    typeof value.truncated === 'boolean' &&
+    Array.isArray(value.items) &&
+    value.items.length <= maximum &&
+    value.returnedCount === value.items.length &&
+    value.totalCount >= value.returnedCount &&
+    value.truncated === value.totalCount > value.returnedCount &&
+    value.items.every(validator);
+const isRanked = (items, key) => items.every((item, index) => {
+    if (index === 0)
+        return true;
+    const previous = items[index - 1];
+    return (previous.eventCount > item.eventCount ||
+        (previous.eventCount === item.eventCount &&
+            (previous.lastTimestamp > item.lastTimestamp || (previous.lastTimestamp === item.lastTimestamp && key(previous) < key(item)))));
+});
+const isFacets = (value) => {
+    if (!hasExactKeys(value, ['tags', 'operations', 'providers', 'resourceTypes', 'results', 'operationEffects', 'executionOrigins']))
+        return false;
+    const facet = (candidate, maximum, textMaximum, allowed) => isCollection(candidate, maximum, (row) => isCountRows([row], 1, textMaximum, allowed));
+    return (facet(value.tags, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.facetTagRows, 128, TAG_IDS) &&
+        facet(value.operations, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.facetOperationRows, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.operationCodeUnits) &&
+        facet(value.providers, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.facetProviderRows, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.providerCodeUnits) &&
+        facet(value.resourceTypes, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.facetResourceTypeRows, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resourceTypeCodeUnits) &&
+        facet(value.results, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.facetResultRows, 256) &&
+        facet(value.operationEffects, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.facetOperationEffectRows, 32, EFFECTS) &&
+        facet(value.executionOrigins, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.facetExecutionOriginRows, 32, ORIGINS) &&
+        Object.values(value).every(collection => {
+            const items = collection.items;
+            return (new Set(items.map(row => row.value)).size === items.length &&
+                items.every((row, index) => index === 0 || items[index - 1].count > row.count || (items[index - 1].count === row.count && items[index - 1].value < row.value)));
+        }));
+};
+const isMonthList = (value) => isSortedUniqueStrings(value, 1200, month => MONTH.test(month));
+const containsOnly = (values, parent) => values.every(value => parent.has(value));
+const areDisjoint = (left, right) => left.every(value => !right.includes(value));
+const isContiguousRange = (months, from, to) => {
+    if (months.length === 0 || months[0] !== from || months[months.length - 1] !== to)
+        return false;
+    for (let index = 1; index < months.length; index += 1) {
+        const [year, month] = months[index - 1].split('-').map(Number);
+        const next = new Date(Date.UTC(year, month, 1)).toISOString().slice(0, 7);
+        if (months[index] !== next)
+            return false;
+    }
+    return true;
+};
+/** Validates the exact, bounded, consumer-safe V1 Activity Analysis response. */
+export const isPortalActivityAnalysisResponse = (value) => {
+    if (!hasExactKeys(value, [
+        'schemaVersion',
+        'generatedAt',
+        'subscriptionId',
+        'fromMonth',
+        'toMonth',
+        'requestedMonths',
+        'availableMonths',
+        'missingMonths',
+        'partialMonths',
+        'staleMonths',
+        'freshnessUnknownMonths',
+        'analysisVersions',
+        'taxonomyVersions',
+        'facets',
+        'activitySeries',
+        'resources',
+        'operationSummaries',
+        'securitySensitive',
+        'powerPatterns',
+        'limitations',
+    ], ['resourceId']) ||
+        value.schemaVersion !== PORTAL_ACTIVITY_ANALYSIS_RESPONSE_SCHEMA_VERSION ||
+        !isTimestamp(value.generatedAt) ||
+        !isText(value.subscriptionId, 2048) ||
+        typeof value.fromMonth !== 'string' ||
+        !MONTH.test(value.fromMonth) ||
+        typeof value.toMonth !== 'string' ||
+        !MONTH.test(value.toMonth) ||
+        !isMonthList(value.requestedMonths) ||
+        !isContiguousRange(value.requestedMonths, value.fromMonth, value.toMonth) ||
+        !isMonthList(value.availableMonths) ||
+        !isMonthList(value.missingMonths) ||
+        !isMonthList(value.partialMonths) ||
+        !isMonthList(value.staleMonths) ||
+        !isMonthList(value.freshnessUnknownMonths) ||
+        !isSortedUniqueStrings(value.analysisVersions, 32, item => isText(item, 64)) ||
+        !isSortedUniqueStrings(value.taxonomyVersions, 32, item => isText(item, 64)) ||
+        (value.resourceId !== undefined && !isText(value.resourceId, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resourceIdCodeUnits)) ||
+        !isFacets(value.facets))
+        return false;
+    const requested = new Set(value.requestedMonths);
+    const available = new Set(value.availableMonths);
+    if (!containsOnly(value.availableMonths, requested) ||
+        !containsOnly(value.missingMonths, requested) ||
+        !areDisjoint(value.availableMonths, value.missingMonths) ||
+        value.availableMonths.length + value.missingMonths.length !== value.requestedMonths.length ||
+        !containsOnly(value.partialMonths, available) ||
+        !containsOnly(value.staleMonths, available) ||
+        !containsOnly(value.freshnessUnknownMonths, available) ||
+        !areDisjoint(value.staleMonths, value.freshnessUnknownMonths))
+        return false;
+    const subscriptionId = value.subscriptionId;
+    const resourceId = value.resourceId;
+    if (!isCollection(value.activitySeries, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.activitySeries, (item) => isSeries(item, subscriptionId, resourceId, available)) ||
+        !isCollection(value.resources, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resourceSummaries, (item) => isResource(item, subscriptionId, resourceId)) ||
+        !isCollection(value.operationSummaries, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.operationSummaries, (item) => isDerived(item, subscriptionId, resourceId) && item.derivedType === 'operationSummary') ||
+        !isCollection(value.securitySensitive, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.securitySensitive, (item) => isDerived(item, subscriptionId, resourceId) && item.derivedType === 'securitySensitiveActivity') ||
+        !isCollection(value.powerPatterns, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.powerPatterns, (item) => isDerived(item, subscriptionId, resourceId) && item.derivedType === 'powerPatternEvidence'))
+        return false;
+    if (!isRanked(value.activitySeries.items, item => item.seriesId) ||
+        !isRanked(value.resources.items, item => item.scope.resourceId) ||
+        !isRanked(value.operationSummaries.items, item => item.groupId) ||
+        !isRanked(value.securitySensitive.items, item => item.groupId) ||
+        !isRanked(value.powerPatterns.items, item => item.patternId))
+        return false;
+    const publicIds = [
+        ...value.activitySeries.items.map(item => item.seriesId),
+        ...value.operationSummaries.items.map(item => item.groupId),
+        ...value.securitySensitive.items.map(item => item.groupId),
+        ...value.powerPatterns.items.map(item => item.patternId),
+    ];
+    if (new Set(publicIds).size !== publicIds.length)
+        return false;
+    if (!isSortedUniqueStrings(value.limitations, LIMITATIONS.size, item => LIMITATIONS.has(item)))
+        return false;
+    const limitations = new Set(value.limitations);
+    const facetTruncated = Object.values(value.facets).some(collection => collection.truncated);
+    const responseTruncated = facetTruncated ||
+        value.activitySeries.truncated ||
+        value.resources.truncated ||
+        value.operationSummaries.truncated ||
+        value.securitySensitive.truncated ||
+        value.powerPatterns.truncated ||
+        limitations.has('nested-values-truncated');
+    if (limitations.has('response-truncated') !== responseTruncated ||
+        limitations.has('facet-values-truncated') !== facetTruncated ||
+        limitations.has('resource-summaries-truncated') !== value.resources.truncated ||
+        limitations.has('operation-summaries-truncated') !== value.operationSummaries.truncated ||
+        limitations.has('security-sensitive-truncated') !== value.securitySensitive.truncated ||
+        limitations.has('power-patterns-truncated') !== value.powerPatterns.truncated ||
+        limitations.has('month-missing') !== value.missingMonths.length > 0 ||
+        limitations.has('month-partial') !== value.partialMonths.length > 0 ||
+        limitations.has('month-stale') !== value.staleMonths.length > 0 ||
+        limitations.has('month-freshness-unknown') !== value.freshnessUnknownMonths.length > 0 ||
+        limitations.has('mixed-analysis-versions') !== value.analysisVersions.length > 1 ||
+        limitations.has('mixed-taxonomy-versions') !== value.taxonomyVersions.length > 1)
+        return false;
+    try {
+        return utf8ByteLength(JSON.stringify(value)) <= PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.responseUtf8Bytes;
+    }
+    catch {
+        return false;
+    }
+};
+/** Throws when a value is not the exact public V1 Activity Analysis response. */
+export function assertPortalActivityAnalysisResponse(value) {
+    if (!isPortalActivityAnalysisResponse(value))
+        throw new Error('Invalid Portal Activity Analysis response.');
+}