@spottoai/types-package 1.0.2-dev1138.13 → 1.0.2-dev1138.14

package/dist/esm/scheduler/resourceStrategyCapabilityValidation.js

@@ -0,0 +1,265 @@
+import { RESOURCE_STRATEGY_CONTRACT_LIMITS, } from './resourceStrategyContracts.js';
+import { hasOnlyKeys, isBoundedParameters, isBoundedString, isBoundedStringArray, isCapabilityRef, isIsoTimestamp, isNonNegativeInteger, isOptionalBoundedString, isPositiveInteger, isRecord, isWithinJsonByteLimit, } from './resourceStrategyValidationShared.js';
+const isPresentationLabel = (value) => isBoundedString(value, 80) &&
+    value === value.trim() &&
+    !/[<>]/.test(value) &&
+    Array.from(value).every(character => {
+        const codePoint = character.codePointAt(0);
+        return codePoint !== undefined && codePoint >= 0x20 && codePoint !== 0x7f;
+    }) &&
+    !/https?:\/\//i.test(value);
+export function isResourceSchedulingCapabilityProjection(value) {
+    if (!isWithinJsonByteLimit(value, RESOURCE_STRATEGY_CONTRACT_LIMITS.publicDtoBytes) || !isRecord(value))
+        return false;
+    const allowed = [
+        'capability',
+        'contentHash',
+        'publishedAtUtc',
+        'provider',
+        'resourceTypes',
+        'strategy',
+        'displayName',
+        'description',
+        'presentation',
+        'configurationSchemaKind',
+        'configurationSchema',
+        'recommendationMaturity',
+        'lifecycleStatus',
+        'executionPolicy',
+        'baseline',
+        'cost',
+        'cadence',
+        'disruption',
+        'restore',
+        'automation',
+        'dependencies',
+        'acknowledgement',
+    ];
+    if (!hasOnlyKeys(value, allowed))
+        return false;
+    const executionPolicy = value.executionPolicy;
+    const presentation = value.presentation;
+    const baseline = value.baseline;
+    const cost = value.cost;
+    const cadence = value.cadence;
+    const disruption = value.disruption;
+    const restore = value.restore;
+    const automation = value.automation;
+    const dependencies = value.dependencies;
+    if (!isCapabilityRef(value.capability) ||
+        !isBoundedString(value.contentHash, 200) ||
+        !isIsoTimestamp(value.publishedAtUtc) ||
+        !isBoundedString(value.provider, 100) ||
+        !isBoundedStringArray(value.resourceTypes, RESOURCE_STRATEGY_CONTRACT_LIMITS.resourceTypes) ||
+        value.resourceTypes.length === 0 ||
+        !['on-off', 'sku-change', 'dial', 'recreate'].includes(String(value.strategy)) ||
+        !isBoundedString(value.displayName) ||
+        !isBoundedString(value.description, 2000) ||
+        !isRecord(presentation) ||
+        !hasOnlyKeys(presentation, ['resourceKindLabel', 'reduceTransitionLabel', 'restoreTransitionLabel', 'reducedStateLabel', 'restoredStateLabel']) ||
+        !isPresentationLabel(presentation.resourceKindLabel) ||
+        !isPresentationLabel(presentation.reduceTransitionLabel) ||
+        !isPresentationLabel(presentation.restoreTransitionLabel) ||
+        !isPresentationLabel(presentation.reducedStateLabel) ||
+        !isPresentationLabel(presentation.restoredStateLabel) ||
+        !isBoundedString(value.configurationSchemaKind, 200) ||
+        !isBoundedParameters(value.configurationSchema) ||
+        !['unsupported', 'candidate', 'supported'].includes(String(value.recommendationMaturity)) ||
+        !['published', 'deprecated', 'withdrawn'].includes(String(value.lifecycleStatus)) ||
+        !isRecord(executionPolicy) ||
+        !isRecord(baseline) ||
+        !isRecord(cost) ||
+        !isRecord(cadence) ||
+        !isRecord(disruption) ||
+        !isRecord(restore) ||
+        !isRecord(automation) ||
+        !isRecord(dependencies) ||
+        !hasOnlyKeys(executionPolicy, ['authoring', 'reduce', 'restore', 'disableReason', 'supersededBy']) ||
+        !hasOnlyKeys(baseline, ['policy', 'mutationDomains', 'coupledValueLabels', 'driftPolicy']) ||
+        !hasOnlyKeys(cost, [
+            'billingClass',
+            'reducedMeters',
+            'retainedMeters',
+            'billingGranularityMinutes',
+            'minimumUsefulReducedMinutes',
+            'commitmentInteraction',
+        ]) ||
+        !hasOnlyKeys(cadence, [
+            'minimumTransitionIntervalMinutes',
+            'minimumAvailableWindowMinutes',
+            'minimumReducedWindowMinutes',
+            'maximumChangesPerRollingWindow',
+            'maximumReducedDurationMinutes',
+            'preferredBillingBoundary',
+            'reduceFlexMinutes',
+        ]) ||
+        !hasOnlyKeys(disruption, ['reversibility', 'risk', 'affectedScopeLabel', 'expectedDowntimeMinutes', 'supportedBusyPolicies']) ||
+        !hasOnlyKeys(restore, [
+            'restoreLeadMinutes',
+            'dispatchSafetyIntervalMinutes',
+            'capacityReturnRisk',
+            'retryPolicyLabel',
+            'escalationClass',
+        ]) ||
+        !hasOnlyKeys(automation, ['ownership', 'conflictingControllerLabels']) ||
+        !hasOnlyKeys(dependencies, ['hasDependencies', 'summary', 'mutableIdentityRisk'])) {
+        return false;
+    }
+    if (!['allowed', 'blocked'].includes(String(executionPolicy.authoring)) ||
+        !['allowed', 'blocked'].includes(String(executionPolicy.reduce)) ||
+        !['allowed', 'blocked'].includes(String(executionPolicy.restore)) ||
+        (executionPolicy.disableReason !== undefined && !isBoundedString(executionPolicy.disableReason, 500)) ||
+        (executionPolicy.supersededBy !== undefined && !isCapabilityRef(executionPolicy.supersededBy))) {
+        return false;
+    }
+    if (!['none', 'capture-selected-state', 'capture-resource-snapshot'].includes(String(baseline.policy)) ||
+        !isBoundedStringArray(baseline.mutationDomains) ||
+        (baseline.coupledValueLabels !== undefined && !isBoundedStringArray(baseline.coupledValueLabels)) ||
+        !['block', 'adopt-before-reduce', 'restore-captured', 'capability-defined'].includes(String(baseline.driftPolicy))) {
+        return false;
+    }
+    if (!['A-meter-stops', 'B-meter-reduces', 'C-no-material-saving'].includes(String(cost.billingClass)) ||
+        !isBoundedStringArray(cost.reducedMeters) ||
+        !isBoundedStringArray(cost.retainedMeters) ||
+        (cost.billingGranularityMinutes !== undefined && !isPositiveInteger(cost.billingGranularityMinutes)) ||
+        (cost.minimumUsefulReducedMinutes !== undefined && !isPositiveInteger(cost.minimumUsefulReducedMinutes)) ||
+        !['none', 'may-reduce-invoice-saving', 'unknown'].includes(String(cost.commitmentInteraction))) {
+        return false;
+    }
+    if (!isPositiveInteger(cadence.minimumTransitionIntervalMinutes) ||
+        (cadence.minimumAvailableWindowMinutes !== undefined && !isPositiveInteger(cadence.minimumAvailableWindowMinutes)) ||
+        (cadence.minimumReducedWindowMinutes !== undefined && !isPositiveInteger(cadence.minimumReducedWindowMinutes)) ||
+        (cadence.maximumReducedDurationMinutes !== undefined && !isPositiveInteger(cadence.maximumReducedDurationMinutes)) ||
+        (cadence.reduceFlexMinutes !== undefined && !isNonNegativeInteger(cadence.reduceFlexMinutes)) ||
+        (cadence.preferredBillingBoundary !== undefined && !['none', 'start-of-hour'].includes(String(cadence.preferredBillingBoundary)))) {
+        return false;
+    }
+    if (cadence.maximumChangesPerRollingWindow !== undefined) {
+        const window = cadence.maximumChangesPerRollingWindow;
+        if (!isRecord(window) ||
+            !hasOnlyKeys(window, ['changes', 'windowMinutes']) ||
+            !isPositiveInteger(window.changes) ||
+            !isPositiveInteger(window.windowMinutes)) {
+            return false;
+        }
+    }
+    if (!['reversible', 'conditional', 'destructive'].includes(String(disruption.reversibility)) ||
+        !['low', 'medium', 'high'].includes(String(disruption.risk)) ||
+        !isBoundedString(disruption.affectedScopeLabel) ||
+        !Array.isArray(disruption.supportedBusyPolicies) ||
+        disruption.supportedBusyPolicies.length > 3 ||
+        new Set(disruption.supportedBusyPolicies).size !== disruption.supportedBusyPolicies.length ||
+        !disruption.supportedBusyPolicies.every(mode => ['skip', 'wait-until-deadline', 'force'].includes(String(mode)))) {
+        return false;
+    }
+    if (disruption.expectedDowntimeMinutes !== undefined) {
+        const downtime = disruption.expectedDowntimeMinutes;
+        if (!isRecord(downtime) ||
+            !hasOnlyKeys(downtime, ['minimum', 'maximum']) ||
+            !isNonNegativeInteger(downtime.minimum) ||
+            !isNonNegativeInteger(downtime.maximum) ||
+            Number(downtime.minimum) > Number(downtime.maximum)) {
+            return false;
+        }
+    }
+    if (!isNonNegativeInteger(restore.restoreLeadMinutes) ||
+        (restore.dispatchSafetyIntervalMinutes !== undefined && !isNonNegativeInteger(restore.dispatchSafetyIntervalMinutes)) ||
+        !['none-known', 'possible', 'high', 'unknown'].includes(String(restore.capacityReturnRisk)) ||
+        !isBoundedString(restore.retryPolicyLabel) ||
+        !isBoundedString(restore.escalationClass) ||
+        !['spotto', 'native', 'coexistence-proven', 'unsupported-conflict'].includes(String(automation.ownership)) ||
+        !isBoundedStringArray(automation.conflictingControllerLabels) ||
+        typeof dependencies.hasDependencies !== 'boolean' ||
+        (dependencies.summary !== undefined && !isBoundedString(dependencies.summary, 2000)) ||
+        (dependencies.mutableIdentityRisk !== undefined && typeof dependencies.mutableIdentityRisk !== 'boolean')) {
+        return false;
+    }
+    const minimumReducedWindowMinutes = cadence.minimumReducedWindowMinutes;
+    const dispatchSafetyIntervalMinutes = restore.dispatchSafetyIntervalMinutes;
+    if (minimumReducedWindowMinutes !== undefined &&
+        dispatchSafetyIntervalMinutes !== undefined &&
+        minimumReducedWindowMinutes < restore.restoreLeadMinutes + dispatchSafetyIntervalMinutes) {
+        return false;
+    }
+    if (minimumReducedWindowMinutes !== undefined &&
+        cost.minimumUsefulReducedMinutes !== undefined &&
+        cost.minimumUsefulReducedMinutes < minimumReducedWindowMinutes) {
+        return false;
+    }
+    if (value.acknowledgement !== undefined) {
+        const acknowledgement = value.acknowledgement;
+        if (!isRecord(acknowledgement) ||
+            !hasOnlyKeys(acknowledgement, ['version', 'severity', 'message']) ||
+            !isBoundedString(acknowledgement.version, 200) ||
+            !['info', 'warning', 'destructive'].includes(String(acknowledgement.severity)) ||
+            !isBoundedString(acknowledgement.message, 2000)) {
+            return false;
+        }
+    }
+    const requiresDisableReason = value.lifecycleStatus === 'withdrawn' ||
+        executionPolicy.authoring === 'blocked' ||
+        executionPolicy.reduce === 'blocked' ||
+        executionPolicy.restore === 'blocked';
+    if (requiresDisableReason && !isBoundedString(executionPolicy.disableReason, 500))
+        return false;
+    if (executionPolicy.reduce === 'allowed' && executionPolicy.restore !== 'allowed')
+        return false;
+    if (cost.billingClass === 'C-no-material-saving' && (executionPolicy.authoring !== 'blocked' || executionPolicy.reduce !== 'blocked'))
+        return false;
+    if (value.strategy === 'recreate') {
+        if (!isRecord(value.acknowledgement) || value.acknowledgement.severity !== 'destructive')
+            return false;
+    }
+    return true;
+}
+const readinessStates = new Set([
+    'ready',
+    'blocked',
+    'pending-permission-propagation',
+    'missing-permission',
+    'scope-mismatch',
+    'manifest-outdated',
+    'credential-unavailable',
+    'permission-check-unavailable',
+    'blocked-by-lock',
+    'blocked-by-deny-assignment',
+    'blocked-by-policy',
+    'target-missing',
+    'dependency-unready',
+    'conflicting-automation',
+    'unsupported-resource-state',
+]);
+export function isResourceSchedulingReadinessProjection(value) {
+    return (isWithinJsonByteLimit(value, RESOURCE_STRATEGY_CONTRACT_LIMITS.publicDtoBytes) &&
+        isRecord(value) &&
+        hasOnlyKeys(value, [
+            'companyId',
+            'cloudAccountId',
+            'providerScopeId',
+            'resourceId',
+            'capability',
+            'state',
+            'checkedAtUtc',
+            'expiresAtUtc',
+            'reasonCodes',
+            'missingActions',
+            'requiredScopes',
+            'offendingScopes',
+            'repairLink',
+        ]) &&
+        isBoundedString(value.companyId, 200) &&
+        isBoundedString(value.cloudAccountId, 200) &&
+        isBoundedString(value.providerScopeId, 300) &&
+        isBoundedString(value.resourceId, 2000) &&
+        isCapabilityRef(value.capability) &&
+        typeof value.state === 'string' &&
+        readinessStates.has(value.state) &&
+        isIsoTimestamp(value.checkedAtUtc) &&
+        isIsoTimestamp(value.expiresAtUtc) &&
+        Date.parse(value.expiresAtUtc) >= Date.parse(value.checkedAtUtc) &&
+        isBoundedStringArray(value.reasonCodes) &&
+        (value.missingActions === undefined || isBoundedStringArray(value.missingActions)) &&
+        (value.requiredScopes === undefined || isBoundedStringArray(value.requiredScopes)) &&
+        (value.offendingScopes === undefined || isBoundedStringArray(value.offendingScopes)) &&
+        isOptionalBoundedString(value.repairLink, 2000));
+}

package/dist/esm/scheduler/resourceStrategyContracts.js

@@ -0,0 +1,20 @@
+export const RESOURCE_STRATEGY_CONTRACT_LIMITS = {
+    textLength: 500,
+    rules: 64,
+    ruleDays: 7,
+    resourceTypes: 64,
+    metadataItems: 64,
+    evidenceReferences: 32,
+    draftPeriodKeys: 64,
+    grantGroups: 128,
+    permissionOperations: 8192,
+    listResults: 100,
+    dryRunChecks: 7,
+    dryRunReasonCodes: 32,
+    dryRunDtoBytes: 16384,
+    // Stable readiness evidence may remain current for 24 hours. Transient
+    // verdicts still publish their shorter dependency expiry (normally 5 min).
+    dryRunMaxTtlMs: 24 * 60 * 60000,
+    parameterBytes: 32768,
+    publicDtoBytes: 262144,
+};

package/dist/esm/scheduler/resourceStrategyFinancialValidation.js

@@ -0,0 +1,145 @@
+import { RESOURCE_STRATEGY_CONTRACT_LIMITS, } from './resourceStrategyContracts.js';
+import { isResourceStrategyWeeklyScheduleSuggestion, isResourceStrategyWeeklyScheduleWriteRequest } from './resourceStrategyScheduleValidation.js';
+import { hasOnlyKeys, isBoundedString, isBoundedStringArray, isCapabilityRef, isCurrency, isDate, isIsoTimestamp, isNonNegativeDecimal, isOptionalBoundedString, isPositiveInteger, isRecord, isWithinJsonByteLimit, } from './resourceStrategyValidationShared.js';
+function isMoneyProjection(value) {
+    if (!isRecord(value) ||
+        !hasOnlyKeys(value, [
+            'measure',
+            'amount',
+            'basis',
+            'provenance',
+            'period',
+            'currency',
+            'additivity',
+            'evidenceObservedAtUtc',
+            'coverage',
+            'components',
+        ]) ||
+        value.measure !== 'savings' ||
+        !isNonNegativeDecimal(value.amount) ||
+        !Array.isArray(value.components) ||
+        value.components.length === 0 ||
+        value.components.length > RESOURCE_STRATEGY_CONTRACT_LIMITS.metadataItems) {
+        return false;
+    }
+    const componentIds = new Set();
+    const validComponents = value.components.every(component => {
+        if (!isRecord(component) ||
+            !hasOnlyKeys(component, ['componentId', 'amount', 'unit', 'tier']) ||
+            !isBoundedString(component.componentId, 200) ||
+            !isNonNegativeDecimal(component.amount) ||
+            !isBoundedString(component.unit, 200) ||
+            !isOptionalBoundedString(component.tier, 200) ||
+            componentIds.has(component.componentId)) {
+            return false;
+        }
+        componentIds.add(component.componentId);
+        return true;
+    });
+    if (!validComponents)
+        return false;
+    const decimalScale = 100000000n;
+    const toScaledInteger = (amount) => {
+        const [whole, fraction = ''] = amount.split('.');
+        return BigInt(whole) * decimalScale + BigInt(fraction.padEnd(8, '0'));
+    };
+    const componentTotal = value.components.reduce((total, component) => total + toScaledInteger(component.amount), 0n);
+    if (componentTotal !== toScaledInteger(value.amount))
+        return false;
+    return ((value.basis === 'billed' || value.basis === 'amortized') &&
+        ['billing-backed', 'estimated', 'blended'].includes(String(value.provenance)) &&
+        isRecord(value.period) &&
+        hasOnlyKeys(value.period, ['startDate', 'endDate']) &&
+        isDate(value.period.startDate) &&
+        isDate(value.period.endDate) &&
+        value.period.startDate <= value.period.endDate &&
+        isCurrency(value.currency) &&
+        (value.additivity === 'scenario' || value.additivity === 'portfolio') &&
+        isIsoTimestamp(value.evidenceObservedAtUtc) &&
+        (value.coverage === 'complete' || value.coverage === 'partial'));
+}
+function isScenarioMoneyProjection(value) {
+    return isMoneyProjection(value) && value.additivity === 'scenario';
+}
+export function isResourceSchedulePreviewRequest(value) {
+    return (isWithinJsonByteLimit(value, RESOURCE_STRATEGY_CONTRACT_LIMITS.publicDtoBytes) &&
+        isRecord(value) &&
+        hasOnlyKeys(value, ['draft', 'draftHash', 'evidenceReferences', 'concurrency', 'draftPeriodKeys']) &&
+        isResourceStrategyWeeklyScheduleWriteRequest(value.draft) &&
+        isBoundedString(value.draftHash, 200) &&
+        isBoundedStringArray(value.evidenceReferences, RESOURCE_STRATEGY_CONTRACT_LIMITS.evidenceReferences) &&
+        isRecord(value.concurrency) &&
+        hasOnlyKeys(value.concurrency, ['requestVersion', 'evidenceVersion']) &&
+        isPositiveInteger(value.concurrency.requestVersion) &&
+        isOptionalBoundedString(value.concurrency.evidenceVersion, 200) &&
+        (value.draftPeriodKeys === undefined || isBoundedStringArray(value.draftPeriodKeys, RESOURCE_STRATEGY_CONTRACT_LIMITS.draftPeriodKeys)));
+}
+export function isResourceSchedulePreviewResponse(value) {
+    if (!isWithinJsonByteLimit(value, RESOURCE_STRATEGY_CONTRACT_LIMITS.publicDtoBytes) ||
+        !isRecord(value) ||
+        !hasOnlyKeys(value, ['draftHash', 'requestVersion', 'availability', 'aggregate', 'windows', 'unavailableReason']) ||
+        !isBoundedString(value.draftHash, 200) ||
+        !isPositiveInteger(value.requestVersion) ||
+        !['available', 'unavailable'].includes(String(value.availability)) ||
+        !Array.isArray(value.windows) ||
+        value.windows.length > RESOURCE_STRATEGY_CONTRACT_LIMITS.draftPeriodKeys) {
+        return false;
+    }
+    const validWindows = value.windows.every(window => isRecord(window) &&
+        isBoundedString(window.draftPeriodKey, 200) &&
+        (window.availability === 'available'
+            ? hasOnlyKeys(window, ['draftPeriodKey', 'availability', 'projection']) && isScenarioMoneyProjection(window.projection)
+            : window.availability === 'unavailable' &&
+                hasOnlyKeys(window, ['draftPeriodKey', 'availability', 'unavailableReason']) &&
+                isPreviewUnavailableReason(window.unavailableReason)));
+    if (!validWindows)
+        return false;
+    if (value.availability === 'available') {
+        return hasOnlyKeys(value, ['draftHash', 'requestVersion', 'availability', 'aggregate', 'windows']) && isScenarioMoneyProjection(value.aggregate);
+    }
+    return (hasOnlyKeys(value, ['draftHash', 'requestVersion', 'availability', 'windows', 'unavailableReason']) &&
+        value.aggregate === undefined &&
+        isPreviewUnavailableReason(value.unavailableReason));
+}
+function isPreviewUnavailableReason(value) {
+    return ['missing-evidence', 'stale-evidence', 'mixed-currency', 'unsupported', 'calculation-failed'].includes(String(value));
+}
+export function isResourceSchedulingOpportunity(value) {
+    if (!isWithinJsonByteLimit(value, RESOURCE_STRATEGY_CONTRACT_LIMITS.publicDtoBytes) || !isRecord(value))
+        return false;
+    const commonKeys = [
+        'opportunityId',
+        'provider',
+        'providerScopeId',
+        'cloudAccountId',
+        'resourceId',
+        'capability',
+        'suggestedDefinition',
+        'projectionAvailability',
+        'projection',
+        'projectionUnavailableReason',
+        'observedAtUtc',
+    ];
+    if (!hasOnlyKeys(value, commonKeys) ||
+        !isBoundedString(value.opportunityId, 200) ||
+        !isBoundedString(value.provider, 100) ||
+        !isBoundedString(value.providerScopeId, 300) ||
+        !isOptionalBoundedString(value.cloudAccountId, 200) ||
+        !isBoundedString(value.resourceId, 2000) ||
+        !isCapabilityRef(value.capability) ||
+        (value.suggestedDefinition !== undefined && !isResourceStrategyWeeklyScheduleSuggestion(value.suggestedDefinition)) ||
+        !isIsoTimestamp(value.observedAtUtc)) {
+        return false;
+    }
+    if (value.suggestedDefinition !== undefined) {
+        const suggestion = value.suggestedDefinition;
+        if (suggestion.capability.capabilityId !== value.capability.capabilityId ||
+            suggestion.capability.capabilityVersion !== value.capability.capabilityVersion) {
+            return false;
+        }
+    }
+    if (value.projectionAvailability === 'available') {
+        return isScenarioMoneyProjection(value.projection) && value.projectionUnavailableReason === undefined;
+    }
+    return (value.projectionAvailability === 'unavailable' && value.projection === undefined && isPreviewUnavailableReason(value.projectionUnavailableReason));
+}

package/dist/esm/scheduler/resourceStrategyPermissionValidation.js

@@ -0,0 +1,190 @@
+import { RESOURCE_STRATEGY_CONTRACT_LIMITS, } from './resourceStrategyContracts.js';
+import { hasOnlyKeys, isBoundedString, isBoundedStringArray, isCapabilityRef, isIsoTimestamp, isRecord, isWithinJsonByteLimit, } from './resourceStrategyValidationShared.js';
+export function isResourceSchedulePermissionManifestProjection(value) {
+    if (!isWithinJsonByteLimit(value, RESOURCE_STRATEGY_CONTRACT_LIMITS.publicDtoBytes) ||
+        !isRecord(value) ||
+        !hasOnlyKeys(value, [
+            'schemaVersion',
+            'provider',
+            'version',
+            'contentHash',
+            'capabilityVersions',
+            'orderedGrantGroupHashes',
+            'grantGroups',
+            'generatedAtUtc',
+            'evidenceObservedAtUtc',
+            'expiresAtUtc',
+            'reviewStatus',
+            'change',
+        ]) ||
+        value.schemaVersion !== 1 ||
+        !isBoundedString(value.provider, 100) ||
+        !isBoundedString(value.version, 200) ||
+        !isBoundedString(value.contentHash, 200) ||
+        !Array.isArray(value.capabilityVersions) ||
+        value.capabilityVersions.length === 0 ||
+        value.capabilityVersions.length > RESOURCE_STRATEGY_CONTRACT_LIMITS.metadataItems ||
+        !value.capabilityVersions.every(isCapabilityRef) ||
+        !Array.isArray(value.grantGroups) ||
+        value.grantGroups.length === 0 ||
+        value.grantGroups.length > RESOURCE_STRATEGY_CONTRACT_LIMITS.grantGroups ||
+        !Array.isArray(value.orderedGrantGroupHashes) ||
+        value.orderedGrantGroupHashes.length !== value.grantGroups.length ||
+        !isIsoTimestamp(value.generatedAtUtc) ||
+        !isIsoTimestamp(value.evidenceObservedAtUtc) ||
+        !(value.expiresAtUtc === null || isIsoTimestamp(value.expiresAtUtc)) ||
+        !['current', 'review-required', 'expired'].includes(String(value.reviewStatus)) ||
+        !isRecord(value.change) ||
+        !hasOnlyKeys(value.change, ['status', 'addedOperations', 'removedOperations']) ||
+        !['new', 'unchanged', 'expanding', 'narrowing', 'missing'].includes(String(value.change.status)) ||
+        !isPermissionChangeOperations(value.change.addedOperations) ||
+        !isPermissionChangeOperations(value.change.removedOperations) ||
+        Date.parse(value.evidenceObservedAtUtc) > Date.parse(value.generatedAtUtc) ||
+        (typeof value.expiresAtUtc === 'string' && Date.parse(value.expiresAtUtc) < Date.parse(value.generatedAtUtc)) ||
+        new Set(value.capabilityVersions.map(item => `${item.capabilityId}:${item.capabilityVersion}`)).size !== value.capabilityVersions.length) {
+        return false;
+    }
+    const change = value.change;
+    const addedKeys = new Set(change.addedOperations.map(permissionChangeOperationKey));
+    const removedKeys = new Set(change.removedOperations.map(permissionChangeOperationKey));
+    if (addedKeys.size !== change.addedOperations.length ||
+        removedKeys.size !== change.removedOperations.length ||
+        [...addedKeys].some(key => removedKeys.has(key))) {
+        return false;
+    }
+    if ((value.change.status === 'unchanged' && (change.addedOperations.length > 0 || change.removedOperations.length > 0)) ||
+        ((value.change.status === 'new' || value.change.status === 'missing') &&
+            (change.addedOperations.length === 0 || change.removedOperations.length > 0)) ||
+        (value.change.status === 'expanding' && change.addedOperations.length === 0) ||
+        (value.change.status === 'narrowing' && (change.addedOperations.length > 0 || change.removedOperations.length === 0))) {
+        return false;
+    }
+    const grantGroups = value.grantGroups;
+    const seenGroupHashes = new Set();
+    const validGrantGroups = grantGroups.every(group => {
+        if (!isRecord(group) ||
+            !hasOnlyKeys(group, [
+                'groupHash',
+                'provider',
+                'providerScopeId',
+                'exactAssignmentScope',
+                'operationSetHash',
+                'principalRef',
+                'roleDefinitionRef',
+                'roleName',
+                'roleDefinitionScope',
+                'roleAssignmentRef',
+                'actions',
+                'dataActions',
+                'disclosureKeys',
+            ]) ||
+            !isBoundedString(group.groupHash, 200) ||
+            group.provider !== value.provider ||
+            !isBoundedString(group.providerScopeId, 300) ||
+            !isBoundedString(group.exactAssignmentScope, 2000) ||
+            !isBoundedString(group.operationSetHash, 200) ||
+            !isBoundedString(group.principalRef, 200) ||
+            !isBoundedString(group.roleDefinitionRef, 200) ||
+            !isBoundedString(group.roleName, 500) ||
+            !isBoundedString(group.roleDefinitionScope, 2000) ||
+            !isBoundedString(group.roleAssignmentRef, 200) ||
+            !isPermissionOperations(group.actions) ||
+            !isPermissionOperations(group.dataActions) ||
+            group.actions.length + group.dataActions.length === 0 ||
+            (group.disclosureKeys !== undefined && !isBoundedStringArray(group.disclosureKeys)) ||
+            seenGroupHashes.has(group.groupHash)) {
+            return false;
+        }
+        const actions = group.actions;
+        const dataActions = group.dataActions;
+        if (actions.some(action => dataActions.some(dataAction => dataAction.operation.toLowerCase() === action.operation.toLowerCase()))) {
+            return false;
+        }
+        seenGroupHashes.add(group.groupHash);
+        return true;
+    });
+    if (!validGrantGroups ||
+        !value.orderedGrantGroupHashes.every((hash, index) => isBoundedString(hash, 200) && isRecord(grantGroups[index]) && hash === grantGroups[index].groupHash)) {
+        return false;
+    }
+    const currentOperationKeys = new Set();
+    for (const group of grantGroups) {
+        if (!isRecord(group))
+            return false;
+        for (const operation of group.actions) {
+            currentOperationKeys.add(permissionChangeOperationKey({
+                groupHash: String(group.groupHash),
+                providerScopeId: String(group.providerScopeId),
+                exactAssignmentScope: String(group.exactAssignmentScope),
+                operationKind: 'action',
+                operation: operation.operation,
+            }));
+        }
+        for (const operation of group.dataActions) {
+            currentOperationKeys.add(permissionChangeOperationKey({
+                groupHash: String(group.groupHash),
+                providerScopeId: String(group.providerScopeId),
+                exactAssignmentScope: String(group.exactAssignmentScope),
+                operationKind: 'data-action',
+                operation: operation.operation,
+            }));
+        }
+    }
+    if ((value.change.status === 'new' || value.change.status === 'missing') &&
+        (addedKeys.size !== currentOperationKeys.size || [...currentOperationKeys].some(key => !addedKeys.has(key)))) {
+        return false;
+    }
+    return (change.addedOperations.every(operation => currentOperationKeys.has(permissionChangeOperationKey(operation))) &&
+        change.removedOperations.every(operation => !currentOperationKeys.has(permissionChangeOperationKey(operation))));
+}
+function permissionChangeOperationKey(value) {
+    return [value.groupHash, value.providerScopeId, value.exactAssignmentScope, value.operationKind, value.operation]
+        .map(item => item.toLowerCase())
+        .join('\u0000');
+}
+function isPermissionChangeOperations(value) {
+    return (Array.isArray(value) &&
+        value.length <= RESOURCE_STRATEGY_CONTRACT_LIMITS.permissionOperations &&
+        value.every(item => isRecord(item) &&
+            hasOnlyKeys(item, ['groupHash', 'providerScopeId', 'exactAssignmentScope', 'operationKind', 'operation']) &&
+            isBoundedString(item.groupHash, 200) &&
+            isBoundedString(item.providerScopeId, 300) &&
+            isBoundedString(item.exactAssignmentScope, 2000) &&
+            ['action', 'data-action'].includes(String(item.operationKind)) &&
+            isBoundedString(item.operation, 500) &&
+            !item.operation.includes('*')));
+}
+function isPermissionOperations(value) {
+    if (!Array.isArray(value) || value.length > RESOURCE_STRATEGY_CONTRACT_LIMITS.metadataItems)
+        return false;
+    const operations = new Set();
+    return value.every(item => {
+        if (!isRecord(item) ||
+            !hasOnlyKeys(item, ['operation', 'permissionSetRefs', 'reason', 'evidenceUrl']) ||
+            !isBoundedString(item.operation, 500) ||
+            item.operation.includes('*') ||
+            !Array.isArray(item.permissionSetRefs) ||
+            item.permissionSetRefs.length === 0 ||
+            !isBoundedStringArray(item.permissionSetRefs) ||
+            new Set(item.permissionSetRefs).size !== item.permissionSetRefs.length ||
+            !isBoundedString(item.reason, 2000) ||
+            !isBoundedString(item.evidenceUrl, 2000) ||
+            operations.has(item.operation.toLowerCase())) {
+            return false;
+        }
+        operations.add(item.operation.toLowerCase());
+        return true;
+    });
+}
+export function isResourceSchedulePermissionManifestConsent(value) {
+    return (isWithinJsonByteLimit(value, RESOURCE_STRATEGY_CONTRACT_LIMITS.publicDtoBytes) &&
+        isRecord(value) &&
+        hasOnlyKeys(value, ['version', 'contentHash', 'orderedGrantGroupHashes']) &&
+        isBoundedString(value.version, 200) &&
+        isBoundedString(value.contentHash, 200) &&
+        Array.isArray(value.orderedGrantGroupHashes) &&
+        value.orderedGrantGroupHashes.length > 0 &&
+        value.orderedGrantGroupHashes.length <= RESOURCE_STRATEGY_CONTRACT_LIMITS.grantGroups &&
+        value.orderedGrantGroupHashes.every(item => isBoundedString(item, 200)) &&
+        new Set(value.orderedGrantGroupHashes).size === value.orderedGrantGroupHashes.length);
+}