@spottoai/types-package 1.0.2-dev1138.13 → 1.0.2-dev1138.14

package/dist/esm/azure/activityLogAnalysisPublicValidationHelpers.js

@@ -0,0 +1,172 @@
+import { ACTIVITY_LOG_TAG_IDS, ACTIVITY_LOG_TAXONOMY_VERSION, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1, } from './activityLogAnalysis.js';
+export const MONTH = /^\d{4}-(0[1-9]|1[0-2])$/;
+const TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+const EVIDENCE_ID = /^aev1_[a-f0-9]{64}$/;
+const GROUP_ID = /^aag1_[a-f0-9]{64}$/;
+export const TAG_IDS = new Set(ACTIVITY_LOG_TAG_IDS);
+export const ORIGINS = new Set(['manual', 'workloadAutomation', 'azurePlatform', 'unknown']);
+export const EFFECTS = new Set(['write', 'delete', 'action', 'read', 'other']);
+export const CONFIDENCES = new Set(['high', 'medium', 'low']);
+export const POWER_SUFFICIENCY = new Set(['oneSided', 'oneOff', 'sameDayRepeat', 'repeated']);
+export const LIMITATIONS = new Set([
+    'source-coverage-partial',
+    'unclassified-events',
+    'facet-values-truncated',
+    'resource-summaries-truncated',
+    'operation-summaries-truncated',
+    'security-sensitive-truncated',
+    'power-patterns-truncated',
+    'artifact-size-budget',
+    'month-missing',
+    'month-partial',
+    'month-stale',
+    'month-freshness-unknown',
+    'nested-values-truncated',
+    'mixed-analysis-versions',
+    'mixed-taxonomy-versions',
+    'response-truncated',
+]);
+const SCOPE_LEVELS = new Set(['subscription', 'resourceGroup', 'resource', 'unknown']);
+const RESERVED_KEYS = new Set(['__proto__', 'prototype', 'constructor']);
+export const isRecord = (value) => {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+};
+export const hasExactKeys = (value, required, optional = []) => {
+    if (!isRecord(value))
+        return false;
+    const allowed = new Set([...required, ...optional]);
+    const keys = Object.keys(value);
+    return required.every(key => Object.prototype.hasOwnProperty.call(value, key)) && keys.every(key => allowed.has(key) && !RESERVED_KEYS.has(key));
+};
+export const isText = (value, maximum) => typeof value === 'string' && value.length > 0 && value.length <= maximum && value.trim() === value;
+export const isCount = (value) => Number.isSafeInteger(value) && value >= 0;
+export const isPositiveCount = (value) => isCount(value) && value > 0;
+export const isTimestamp = (value) => {
+    if (typeof value !== 'string' || !TIMESTAMP.test(value))
+        return false;
+    const milliseconds = Date.parse(value);
+    return Number.isFinite(milliseconds) && new Date(milliseconds).toISOString() === value;
+};
+export const isDate = (value) => {
+    if (typeof value !== 'string' || !/^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/.test(value))
+        return false;
+    return new Date(`${value}T00:00:00.000Z`).toISOString().slice(0, 10) === value;
+};
+export const isSortedUniqueStrings = (value, maximum, predicate) => Array.isArray(value) &&
+    value.length <= maximum &&
+    value.every((item, index) => typeof item === 'string' && predicate(item) && (index === 0 || value[index - 1] < item));
+export const countRowsTotal = (rows) => {
+    let total = 0;
+    for (const row of rows) {
+        total += row.count;
+        if (!Number.isSafeInteger(total))
+            return undefined;
+    }
+    return total;
+};
+export const isCountRows = (value, maximum, valueMaximum, allowed) => {
+    if (!Array.isArray(value) || value.length > maximum)
+        return false;
+    for (let index = 0; index < value.length; index += 1) {
+        const row = value[index];
+        if (!hasExactKeys(row, ['value', 'count']) || !isText(row.value, valueMaximum) || !isPositiveCount(row.count))
+            return false;
+        if (allowed && !allowed.has(row.value))
+            return false;
+        const previous = value[index - 1];
+        if (previous && (previous.count < row.count || (previous.count === row.count && previous.value >= row.value)))
+            return false;
+    }
+    return true;
+};
+export const isChronologicalCountRows = (value, predicate) => Array.isArray(value) &&
+    value.every((row, index) => hasExactKeys(row, ['value', 'count']) &&
+        typeof row.value === 'string' &&
+        predicate(row.value) &&
+        isPositiveCount(row.count) &&
+        (index === 0 || value[index - 1].value < row.value));
+export const isScope = (value, subscriptionId, resourceId) => {
+    if (!hasExactKeys(value, ['subscriptionId', 'level'], ['resourceId', 'resourceGroup', 'provider', 'resourceType', 'resourceName']) ||
+        value.subscriptionId !== subscriptionId ||
+        typeof value.level !== 'string' ||
+        !SCOPE_LEVELS.has(value.level))
+        return false;
+    if (value.resourceId !== undefined && !isText(value.resourceId, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resourceIdCodeUnits))
+        return false;
+    if (value.resourceGroup !== undefined && !isText(value.resourceGroup, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resourceNameCodeUnits))
+        return false;
+    if (value.provider !== undefined && !isText(value.provider, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.providerCodeUnits))
+        return false;
+    if (value.resourceType !== undefined && !isText(value.resourceType, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resourceTypeCodeUnits))
+        return false;
+    if (value.resourceName !== undefined && !isText(value.resourceName, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.resourceNameCodeUnits))
+        return false;
+    if (value.level === 'resource' && typeof value.resourceId !== 'string')
+        return false;
+    if (value.level === 'resource') {
+        const scopedSubscriptionId = /^\/subscriptions\/([^/]+)\//i.exec(value.resourceId)?.[1];
+        if (!scopedSubscriptionId || scopedSubscriptionId.toLowerCase() !== subscriptionId.toLowerCase())
+            return false;
+    }
+    if (value.level === 'resourceGroup' && typeof value.resourceGroup !== 'string')
+        return false;
+    if (value.level === 'subscription' && (value.resourceId !== undefined || value.resourceGroup !== undefined))
+        return false;
+    return resourceId === undefined || value.resourceId === resourceId;
+};
+/** Validates the exact additive classification carried by one Portal Activity Log entry. */
+export const isPortalActivityLogClassification = (value) => {
+    if (!hasExactKeys(value, ['taxonomyVersion', 'executionOrigin', 'operationEffect', 'scope', 'tags']) ||
+        value.taxonomyVersion !== ACTIVITY_LOG_TAXONOMY_VERSION ||
+        typeof value.executionOrigin !== 'string' ||
+        !ORIGINS.has(value.executionOrigin) ||
+        typeof value.operationEffect !== 'string' ||
+        !EFFECTS.has(value.operationEffect) ||
+        !isRecord(value.scope) ||
+        typeof value.scope.subscriptionId !== 'string' ||
+        !isScope(value.scope, value.scope.subscriptionId) ||
+        !Array.isArray(value.tags) ||
+        value.tags.length > PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.tagAssignmentsPerEvent)
+        return false;
+    const tags = value.tags;
+    return tags.every((tag, index) => {
+        if (!hasExactKeys(tag, ['tagId', 'dimension', 'confidence']) ||
+            typeof tag.tagId !== 'string' ||
+            !TAG_IDS.has(tag.tagId) ||
+            tag.dimension !== tag.tagId.slice(0, tag.tagId.indexOf('.')) ||
+            typeof tag.confidence !== 'string' ||
+            !CONFIDENCES.has(tag.confidence))
+            return false;
+        return index === 0 || tags[index - 1].tagId < tag.tagId;
+    });
+};
+/** Validates the opaque V1 public Activity Log evidence ID syntax. */
+export const isPortalActivityEvidenceId = (value) => typeof value === 'string' && EVIDENCE_ID.test(value);
+/** Validates the opaque V1 public Activity Analysis group ID syntax. */
+export const isPortalActivityAnalysisGroupId = (value) => typeof value === 'string' && GROUP_ID.test(value);
+export const isEvidenceIds = (value) => Array.isArray(value) &&
+    value.length <= PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.evidenceIdsPerItem &&
+    value.every(isPortalActivityEvidenceId) &&
+    new Set(value).size === value.length;
+export const isGroupIds = (value) => isSortedUniqueStrings(value, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.evidenceIdsPerItem, isPortalActivityAnalysisGroupId);
+export const isTags = (value) => isSortedUniqueStrings(value, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.tagCountsPerItem, tag => TAG_IDS.has(tag));
+export const isReasons = (value) => isSortedUniqueStrings(value, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.reasonCodesPerItem, reason => {
+    if (!isText(reason, PORTAL_ACTIVITY_ANALYSIS_LIMITS_V1.reasonCodeUnits))
+        return false;
+    return (reason === 'derived.operation-summary' ||
+        reason === 'derived.security-sensitive-activity' ||
+        reason === 'derived.power-pattern-evidence' ||
+        (reason.startsWith('tag.') && TAG_IDS.has(reason.slice(4))));
+});
+export const hasValidTimes = (value) => isTimestamp(value.firstTimestamp) && isTimestamp(value.lastTimestamp) && value.firstTimestamp <= value.lastTimestamp;
+export const utf8ByteLength = (value) => {
+    let bytes = 0;
+    for (const character of value) {
+        const codePoint = character.codePointAt(0);
+        bytes += codePoint <= 0x7f ? 1 : codePoint <= 0x7ff ? 2 : codePoint <= 0xffff ? 3 : 4;
+    }
+    return bytes;
+};

package/dist/esm/azure/activityLogAnalysisValidation.js

@@ -0,0 +1,365 @@
+import { ACTIVITY_LOG_ANALYSIS_VERSION, ACTIVITY_LOG_TAG_IDS, ACTIVITY_LOG_TAXONOMY_VERSION, CONFORMED_ACTIVITY_ANALYSIS_LIMITS_V1, CONFORMED_ACTIVITY_ANALYSIS_SCHEMA_VERSION, } from './activityLogAnalysis.js';
+const MONTH = /^\d{4}-(0[1-9]|1[0-2])$/;
+const DATE = /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])$/;
+const TAG_IDS = new Set(ACTIVITY_LOG_TAG_IDS);
+const ORIGINS = new Set(['manual', 'workloadAutomation', 'azurePlatform', 'unknown']);
+const EFFECTS = new Set(['write', 'delete', 'action', 'read', 'other']);
+const CONFIDENCES = new Set(['high', 'medium', 'low']);
+const SCOPE_LEVELS = new Set(['subscription', 'resourceGroup', 'resource', 'unknown']);
+const RESERVED_KEYS = new Set(['__proto__', 'prototype', 'constructor']);
+function isRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function hasExactKeys(value, required, optional = []) {
+    if (!isRecord(value))
+        return false;
+    const keys = Object.keys(value);
+    const allowed = new Set([...required, ...optional]);
+    return required.every(key => Object.prototype.hasOwnProperty.call(value, key)) && keys.every(key => allowed.has(key));
+}
+function isText(value, maximum = 2048) {
+    return typeof value === 'string' && value.length > 0 && value.length <= maximum;
+}
+function isCount(value) {
+    return Number.isSafeInteger(value) && value >= 0;
+}
+function isIsoTimestamp(value) {
+    if (!isText(value, 64))
+        return false;
+    const parsed = new Date(value);
+    return !Number.isNaN(parsed.valueOf()) && parsed.toISOString() === value;
+}
+function isUniqueTextArray(value, maximum = 100000, predicate = () => true) {
+    return (Array.isArray(value) && value.length <= maximum && value.every(item => isText(item) && predicate(item)) && new Set(value).size === value.length);
+}
+function isSortedUniqueTextArray(value, maximum, predicate) {
+    return isUniqueTextArray(value, maximum, predicate) && value.every((item, index) => index === 0 || value[index - 1].localeCompare(item) < 0);
+}
+function isScope(value) {
+    if (!hasExactKeys(value, ['subscriptionId', 'level'], ['resourceId', 'resourceGroup', 'provider', 'resourceType', 'resourceName']) ||
+        !isText(value.subscriptionId) ||
+        typeof value.level !== 'string' ||
+        !SCOPE_LEVELS.has(value.level)) {
+        return false;
+    }
+    for (const key of ['resourceId', 'resourceGroup', 'provider', 'resourceType', 'resourceName']) {
+        if (value[key] !== undefined && !isText(value[key]))
+            return false;
+    }
+    if (value.level === 'resource' && !isText(value.resourceId))
+        return false;
+    if (value.level === 'resource') {
+        const scopedSubscriptionId = /^\/subscriptions\/([^/]+)\//i.exec(value.resourceId)?.[1];
+        if (!scopedSubscriptionId || scopedSubscriptionId.toLowerCase() !== value.subscriptionId.toLowerCase())
+            return false;
+    }
+    if (value.level === 'subscription' && value.resourceId !== undefined)
+        return false;
+    return true;
+}
+function isCountRows(value, allowed) {
+    if (!Array.isArray(value) || value.length > 100000)
+        return false;
+    let previous;
+    for (const row of value) {
+        if (!hasExactKeys(row, ['value', 'count']) || !isText(row.value) || !isCount(row.count) || row.count === 0)
+            return false;
+        if (allowed && !allowed.has(row.value))
+            return false;
+        if (previous !== undefined && previous.localeCompare(row.value) >= 0)
+            return false;
+        previous = row.value;
+    }
+    return true;
+}
+function countRowsTotal(value) {
+    return value.reduce((total, row) => total + row.count, 0);
+}
+function isFacets(value, retainedEventCount) {
+    if (!hasExactKeys(value, ['tags', 'operations', 'providers', 'resourceTypes', 'results', 'operationEffects', 'executionOrigins']) ||
+        !isCountRows(value.tags, TAG_IDS) ||
+        !isCountRows(value.operations) ||
+        !isCountRows(value.providers) ||
+        !isCountRows(value.resourceTypes) ||
+        !isCountRows(value.results) ||
+        !isCountRows(value.operationEffects, EFFECTS) ||
+        !isCountRows(value.executionOrigins, ORIGINS)) {
+        return false;
+    }
+    return [value.operations, value.results, value.operationEffects, value.executionOrigins].every(rows => countRowsTotal(rows) === retainedEventCount);
+}
+function isSeries(value, subscriptionId, month) {
+    if (!hasExactKeys(value, [
+        'id',
+        'analysisVersion',
+        'taxonomyVersion',
+        'subscriptionId',
+        'month',
+        'scope',
+        'operation',
+        'result',
+        'executionOrigin',
+        'operationEffect',
+        'tagIds',
+        'eventCount',
+        'firstTimestamp',
+        'lastTimestamp',
+        'dailyCounts',
+        'utcWeekdayHourDistribution',
+        'distinctActorCount',
+        'confidence',
+        'evidenceEventKeys',
+        'evidenceTruncated',
+    ]) ||
+        !isText(value.id) ||
+        value.analysisVersion !== ACTIVITY_LOG_ANALYSIS_VERSION ||
+        value.taxonomyVersion !== ACTIVITY_LOG_TAXONOMY_VERSION ||
+        value.subscriptionId !== subscriptionId ||
+        value.month !== month ||
+        !isScope(value.scope) ||
+        value.scope.subscriptionId !== subscriptionId ||
+        !isText(value.operation, 512) ||
+        !isText(value.result, 256) ||
+        typeof value.executionOrigin !== 'string' ||
+        !ORIGINS.has(value.executionOrigin) ||
+        typeof value.operationEffect !== 'string' ||
+        !EFFECTS.has(value.operationEffect) ||
+        !isSortedUniqueTextArray(value.tagIds, 32, tag => TAG_IDS.has(tag)) ||
+        !isCount(value.eventCount) ||
+        value.eventCount === 0 ||
+        !isIsoTimestamp(value.firstTimestamp) ||
+        !isIsoTimestamp(value.lastTimestamp) ||
+        value.firstTimestamp > value.lastTimestamp ||
+        !isCount(value.distinctActorCount) ||
+        value.distinctActorCount > value.eventCount ||
+        typeof value.confidence !== 'string' ||
+        !CONFIDENCES.has(value.confidence) ||
+        !isUniqueTextArray(value.evidenceEventKeys, 20) ||
+        typeof value.evidenceTruncated !== 'boolean')
+        return false;
+    if (!Array.isArray(value.dailyCounts) || !Array.isArray(value.utcWeekdayHourDistribution))
+        return false;
+    let dailyTotal = 0;
+    let previousDate;
+    for (const row of value.dailyCounts) {
+        if (!hasExactKeys(row, ['date', 'count']) || typeof row.date !== 'string' || !DATE.test(row.date) || !isCount(row.count) || row.count === 0)
+            return false;
+        if (previousDate !== undefined && previousDate.localeCompare(row.date) >= 0)
+            return false;
+        previousDate = row.date;
+        dailyTotal += row.count;
+    }
+    let timeTotal = 0;
+    let previousBucket = -1;
+    for (const row of value.utcWeekdayHourDistribution) {
+        if (!hasExactKeys(row, ['weekday', 'hour', 'count']) ||
+            !isCount(row.weekday) ||
+            row.weekday > 6 ||
+            !isCount(row.hour) ||
+            row.hour > 23 ||
+            !isCount(row.count) ||
+            row.count === 0)
+            return false;
+        const bucket = row.weekday * 24 + row.hour;
+        if (bucket <= previousBucket)
+            return false;
+        previousBucket = bucket;
+        timeTotal += row.count;
+    }
+    return dailyTotal === value.eventCount && timeTotal === value.eventCount;
+}
+function isResource(value, subscriptionId) {
+    return (hasExactKeys(value, ['scope', 'eventCount', 'operationCounts', 'resultCounts', 'tagCounts', 'executionOriginCounts', 'relatedEvidenceIds']) &&
+        isScope(value.scope) &&
+        value.scope.level === 'resource' &&
+        value.scope.subscriptionId === subscriptionId &&
+        isCount(value.eventCount) &&
+        value.eventCount > 0 &&
+        isCountRows(value.operationCounts) &&
+        countRowsTotal(value.operationCounts) === value.eventCount &&
+        isCountRows(value.resultCounts) &&
+        countRowsTotal(value.resultCounts) === value.eventCount &&
+        isCountRows(value.tagCounts, TAG_IDS) &&
+        isCountRows(value.executionOriginCounts, ORIGINS) &&
+        countRowsTotal(value.executionOriginCounts) === value.eventCount &&
+        isSortedUniqueTextArray(value.relatedEvidenceIds));
+}
+function isCountRecord(value) {
+    return isRecord(value) && Object.keys(value).every(key => !RESERVED_KEYS.has(key) && isText(key, 512) && isCount(value[key]));
+}
+function countRecordTotal(value) {
+    let total = 0;
+    for (const count of Object.values(value)) {
+        total += count;
+        if (!Number.isSafeInteger(total))
+            return undefined;
+    }
+    return total;
+}
+function isPowerHourCountRecord(value) {
+    return (isCountRecord(value) &&
+        Object.keys(value).length <= 24 &&
+        Object.entries(value).every(([hour, count]) => /^(?:0|[1-9]|1\d|2[0-3])$/.test(hour) && count > 0));
+}
+function hasValidGroupBase(value, subscriptionId, month) {
+    return (isText(value.id) &&
+        value.analysisVersion === ACTIVITY_LOG_ANALYSIS_VERSION &&
+        value.taxonomyVersion === ACTIVITY_LOG_TAXONOMY_VERSION &&
+        value.subscriptionId === subscriptionId &&
+        value.month === month &&
+        isScope(value.scope) &&
+        value.scope.subscriptionId === subscriptionId &&
+        isCount(value.eventCount) &&
+        value.eventCount > 0 &&
+        isIsoTimestamp(value.firstTimestamp) &&
+        isIsoTimestamp(value.lastTimestamp) &&
+        value.firstTimestamp <= value.lastTimestamp &&
+        typeof value.confidence === 'string' &&
+        CONFIDENCES.has(value.confidence) &&
+        isSortedUniqueTextArray(value.reasons, 32) &&
+        isSortedUniqueTextArray(value.tagIds, 32, tag => TAG_IDS.has(tag)) &&
+        isUniqueTextArray(value.evidenceEventKeys, 20) &&
+        typeof value.evidenceTruncated === 'boolean');
+}
+function isGroup(value, subscriptionId, month) {
+    if (!isRecord(value) || typeof value.type !== 'string')
+        return false;
+    const common = [
+        'id',
+        'type',
+        'analysisVersion',
+        'taxonomyVersion',
+        'subscriptionId',
+        'month',
+        'scope',
+        'eventCount',
+        'firstTimestamp',
+        'lastTimestamp',
+        'confidence',
+        'reasons',
+        'tagIds',
+        'evidenceEventKeys',
+        'evidenceTruncated',
+    ];
+    if (value.type === 'operation-summary') {
+        return (hasExactKeys(value, [...common, 'operation', 'operationEffect', 'executionOrigin', 'distinctResourceCount', 'resultCounts'], ['provider', 'resourceType']) &&
+            hasValidGroupBase(value, subscriptionId, month) &&
+            isText(value.operation, 512) &&
+            typeof value.operationEffect === 'string' &&
+            EFFECTS.has(value.operationEffect) &&
+            typeof value.executionOrigin === 'string' &&
+            ORIGINS.has(value.executionOrigin) &&
+            isCount(value.distinctResourceCount) &&
+            value.distinctResourceCount <= value.eventCount &&
+            isCountRecord(value.resultCounts));
+    }
+    if (value.type === 'security-sensitive-activity') {
+        return (hasExactKeys(value, [...common, 'capabilityTag', 'operation', 'executionOrigin', 'resultCounts']) &&
+            hasValidGroupBase(value, subscriptionId, month) &&
+            typeof value.capabilityTag === 'string' &&
+            value.capabilityTag.startsWith('security.') &&
+            value.capabilityTag !== 'security.sensitive-operation' &&
+            TAG_IDS.has(value.capabilityTag) &&
+            isText(value.operation, 512) &&
+            typeof value.executionOrigin === 'string' &&
+            ORIGINS.has(value.executionOrigin) &&
+            isCountRecord(value.resultCounts));
+    }
+    if (value.type !== 'power-pattern-evidence')
+        return false;
+    if (!hasExactKeys(value, [
+        ...common,
+        'patternId',
+        'resourceId',
+        'startCount',
+        'stopCount',
+        'opposingPairCount',
+        'utcActiveDayCount',
+        'utcHourDistribution',
+        'executionOriginCounts',
+        'resultCounts',
+        'dataSufficiency',
+    ]) ||
+        !hasValidGroupBase(value, subscriptionId, month) ||
+        value.scope.level !== 'resource' ||
+        !isText(value.patternId) ||
+        !isText(value.resourceId) ||
+        value.resourceId !== value.scope.resourceId ||
+        !isCount(value.startCount) ||
+        !isCount(value.stopCount) ||
+        value.startCount + value.stopCount !== value.eventCount ||
+        !isCount(value.opposingPairCount) ||
+        value.opposingPairCount !== Math.min(value.startCount, value.stopCount) ||
+        !isCount(value.utcActiveDayCount) ||
+        !isPowerHourCountRecord(value.utcHourDistribution) ||
+        !isCountRecord(value.executionOriginCounts) ||
+        !Object.keys(value.executionOriginCounts).every(origin => ORIGINS.has(origin)) ||
+        !isCountRecord(value.resultCounts) ||
+        !['oneSided', 'oneOff', 'sameDayRepeat', 'repeated'].includes(value.dataSufficiency))
+        return false;
+    return (countRecordTotal(value.utcHourDistribution) === value.eventCount &&
+        countRecordTotal(value.executionOriginCounts) === value.eventCount &&
+        countRecordTotal(value.resultCounts) === value.eventCount);
+}
+export function isConformedActivityAnalysisArtifact(value) {
+    if (!hasExactKeys(value, [
+        'schemaVersion',
+        'analysisVersion',
+        'taxonomyVersion',
+        'projection',
+        'subscriptionId',
+        'month',
+        'generatedAt',
+        'source',
+        'facets',
+        'activitySeries',
+        'resources',
+        'groups',
+    ]))
+        return false;
+    if (value.schemaVersion !== CONFORMED_ACTIVITY_ANALYSIS_SCHEMA_VERSION ||
+        value.analysisVersion !== ACTIVITY_LOG_ANALYSIS_VERSION ||
+        value.taxonomyVersion !== ACTIVITY_LOG_TAXONOMY_VERSION ||
+        value.projection !== 'activity-analysis' ||
+        !isText(value.subscriptionId) ||
+        typeof value.month !== 'string' ||
+        !MONTH.test(value.month) ||
+        !isIsoTimestamp(value.generatedAt))
+        return false;
+    const subscriptionId = value.subscriptionId;
+    const month = value.month;
+    if (!hasExactKeys(value.source, [
+        'portalProjectionSchemaVersion',
+        'retainedEventCount',
+        'classifiedRetainedEventCount',
+        'unclassifiedRetainedEventCount',
+        'classificationState',
+    ], ['sourceHighWatermark', 'sourceShardFingerprint']) ||
+        !isCount(value.source.portalProjectionSchemaVersion) ||
+        !isCount(value.source.retainedEventCount) ||
+        !isCount(value.source.classifiedRetainedEventCount) ||
+        !isCount(value.source.unclassifiedRetainedEventCount) ||
+        value.source.retainedEventCount !== value.source.classifiedRetainedEventCount + value.source.unclassifiedRetainedEventCount ||
+        !['complete', 'partial', 'unavailable'].includes(value.source.classificationState) ||
+        (value.source.sourceHighWatermark !== undefined && !isIsoTimestamp(value.source.sourceHighWatermark)) ||
+        (value.source.sourceShardFingerprint !== undefined &&
+            !isText(value.source.sourceShardFingerprint, CONFORMED_ACTIVITY_ANALYSIS_LIMITS_V1.sourceShardFingerprintCodeUnits)))
+        return false;
+    if (!isFacets(value.facets, value.source.retainedEventCount) ||
+        !Array.isArray(value.activitySeries) ||
+        !Array.isArray(value.resources) ||
+        !Array.isArray(value.groups))
+        return false;
+    if (!value.activitySeries.every(item => isSeries(item, subscriptionId, month)) ||
+        value.activitySeries.reduce((sum, item) => sum + item.eventCount, 0) !== value.source.classifiedRetainedEventCount)
+        return false;
+    return value.resources.every(item => isResource(item, subscriptionId)) && value.groups.every(item => isGroup(item, subscriptionId, month));
+}
+export function assertConformedActivityAnalysisArtifact(value) {
+    if (!isConformedActivityAnalysisArtifact(value))
+        throw new Error('Invalid conformed Activity Analysis artifact.');
+}
+export { assertPortalActivityAnalysisResponse, isPortalActivityAnalysisGroupId, isPortalActivityAnalysisResponse, isPortalActivityEvidenceId, isPortalActivityLogClassification, } from './activityLogAnalysisPublicValidation.js';

package/dist/esm/azure/billingPlots.js

@@ -5,6 +5,7 @@ import { isArtifactOwnershipBinding } from '../common/artifactEvidence.js';
 import { containsForbiddenArtifactControlData } from '../common/artifactControlData.js';
 import { isArtifactRevisionVector } from '../common/artifactEvidenceValidation.js';
 import { isBillingCompletedArtifactPublicationDecision, isBillingPartialArtifactPublicationDecision, } from './billingArtifactEvidence.js';
+import { isAzureFinancialChargeCoverageV1, } from './financialChargePolicy.js';
 const LEGACY_FALLBACK_FORBIDDEN_OWN_FIELDS = [
     'schemaVersion',
     'ownership',
@@ -133,6 +134,33 @@ const allowedBillingCostAnalysisFields = (value, validationBranch) => {
     allowText(value, 'subscriptionId', 'billingGenerationId', 'currencyCode', 'currencySymbol', 'forecastMethod');
     allowControl(value, 'schemaVersion', 'ownership', 'revision', 'artifactEvidence');
     allowChildren(value, 'ownership', 'revision', 'artifactEvidence', 'chartData', 'anomalies');
+    if (isRecord(value.financialChargeCoverage)) {
+        const coverage = value.financialChargeCoverage;
+        allowControl(value, 'financialChargeCoverage');
+        allowChildren(value, 'financialChargeCoverage');
+        allowControl(coverage, 'contractVersion', 'policyRef', 'status', 'coordinate', 'sourceTotals', 'unknownObjects');
+        allowText(coverage, 'contractVersion', 'policyRef', 'status');
+        allowChildren(coverage, 'coordinate', 'sourceTotals', 'unknownObjects');
+        if (isRecord(coverage.coordinate)) {
+            allowControl(coverage.coordinate, 'generationId', 'providerName', 'providerScopeId', 'basis', 'period', 'currencyCode', 'minorUnitScale');
+            allowText(coverage.coordinate, 'generationId', 'providerName', 'providerScopeId', 'basis', 'currencyCode');
+            allowChildren(coverage.coordinate, 'period');
+            if (isRecord(coverage.coordinate.period)) {
+                allowText(coverage.coordinate.period, 'startDate', 'endDateExclusive');
+            }
+        }
+        if (isRecord(coverage.sourceTotals))
+            allowControl(coverage.sourceTotals, ...Object.keys(coverage.sourceTotals));
+        if (Array.isArray(coverage.unknownObjects)) {
+            for (const item of coverage.unknownObjects) {
+                if (!isRecord(item))
+                    continue;
+                allowControl(item, ...Object.keys(item));
+                allowText(item, 'objectKey', 'name', 'resourceType', 'resourceId', 'billableComponentKey');
+                allowTextArray(item, 'reasonCodes');
+            }
+        }
+    }
     if (validationBranch !== 'business-v1')
         allowControl(value, 'artifactState');
     if (validationBranch === 'legacy-fallback')
@@ -384,11 +412,12 @@ const hasValidBillingCostAnalysisBusinessFields = (value) => {
         return false;
     return [value.forecastMonthTotal, value.forecastRemaining, value.forecastPeriodEnd].every(isOptionalFiniteNumber);
 };
-const BILLING_PUBLIC_DATA_STATES = new Set(['current', 'stale', 'previous-verified']);
+const BILLING_PUBLIC_DATA_STATES = new Set(['current', 'partial', 'stale', 'previous-verified']);
 const BILLING_PUBLIC_BUSINESS_FIELDS = new Set([
     'schemaVersion',
     'subscriptionId',
     'dataState',
+    'financialChargeCoverage',
     'chartData',
     'anomalies',
     'currencyCode',
@@ -398,7 +427,7 @@ const BILLING_PUBLIC_BUSINESS_FIELDS = new Set([
     'forecastRemaining',
     'forecastPeriodEnd',
 ]);
-const BILLING_PUBLIC_NO_ACTIVITY_FIELDS = new Set(['schemaVersion', 'subscriptionId', 'dataState']);
+const BILLING_PUBLIC_NO_ACTIVITY_FIELDS = new Set(['schemaVersion', 'subscriptionId', 'dataState', 'financialChargeCoverage']);
 const hasOnlyFields = (value, allowedFields) => Object.keys(value).every(field => allowedFields.has(field));
 const hasValidBillingCostAnalysisPublicBusinessFields = (value) => {
     if (!isPathSegment(value.subscriptionId))
@@ -417,12 +446,17 @@ export const isBillingCostAnalysisPublicResponse = (value) => {
         return false;
     }
     if (value.dataState === 'no-activity') {
-        return hasOnlyFields(value, BILLING_PUBLIC_NO_ACTIVITY_FIELDS);
+        return (hasOnlyFields(value, BILLING_PUBLIC_NO_ACTIVITY_FIELDS) &&
+            isAzureFinancialChargeCoverageV1(value.financialChargeCoverage) &&
+            value.financialChargeCoverage.coordinate.providerScopeId === value.subscriptionId);
     }
     return (BILLING_PUBLIC_DATA_STATES.has(value.dataState) &&
         hasOnlyFields(value, BILLING_PUBLIC_BUSINESS_FIELDS) &&
         !containsForbiddenBillingCostAnalysisControlData(value, 'business-v1') &&
-        hasValidBillingCostAnalysisPublicBusinessFields(value));
+        hasValidBillingCostAnalysisPublicBusinessFields(value) &&
+        isAzureFinancialChargeCoverageV1(value.financialChargeCoverage) &&
+        value.financialChargeCoverage.coordinate.providerScopeId === value.subscriptionId &&
+        value.financialChargeCoverage.coordinate.currencyCode === value.currencyCode);
 };
 const isBillingCostAnalysisBusinessPayloadForBranch = (value, validationBranch) => !containsForbiddenBillingCostAnalysisControlData(value, validationBranch) &&
     !LEGACY_FALLBACK_FORBIDDEN_OWN_FIELDS.some(field => hasOwn(value, field)) &&
@@ -454,6 +488,13 @@ export const isBillingCostAnalysisMetadataV2 = (value) => {
     }
     if (!hasValidBillingCostAnalysisBusinessFields(value))
         return false;
+    if (value.financialChargeCoverage !== undefined &&
+        (!isAzureFinancialChargeCoverageV1(value.financialChargeCoverage) ||
+            value.financialChargeCoverage.coordinate.generationId !== value.billingGenerationId ||
+            value.financialChargeCoverage.coordinate.providerScopeId !== value.subscriptionId ||
+            value.financialChargeCoverage.coordinate.currencyCode !== value.currencyCode)) {
+        return false;
+    }
     if (!hasValidMetadataEvidenceState(value.artifactState, value.artifactEvidence, value.billingGenerationId, value.inputManifestDigest, value.chartData, value.anomalies)) {
         return false;
     }

package/dist/esm/azure/commitmentsPlanning.js

@@ -1 +1,8 @@
-export {};
+/** Every `CommitmentsFreshnessReasonCode`, for dependency-free runtime guards. */
+export const COMMITMENTS_FRESHNESS_REASON_CODES = [
+    'collection-stale',
+    'permission-denied',
+    'collection-failed',
+    'not-collected',
+    'status-invalid',
+];