@yiaany/ghostapi 0.1.8 → 0.2.0

package/dist/credentials/credentialBroker.js

@@ -3,7 +3,7 @@ import { lstat, readFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { getDataPaths } from "../config/dataPaths.js";
 import { sanitizeSecretString } from "../security/secrets.js";
-import { atomicWriteJson, ensurePrivateDirectory, withFileLock } from "../storage/fileStore.js";
+import { atomicWriteJson, ensurePrivateDirectory, withFileLock, } from "../storage/fileStore.js";
 const SCHEMA_VERSION = 1;
 const MAX_STORE_BYTES = 1024 * 1024;
 const MAX_CREDENTIALS = 1_000;
@@ -39,12 +39,19 @@ export class CredentialBroker {
         this.executor = options.executor;
         this.workloadVerifier = options.workloadVerifier;
         this.actionReceiptVerifier = options.actionReceiptVerifier;
-        this.breakGlassAuthorizer = options.breakGlassAuthorizer ?? createDisabledBreakGlassAuthorizer();
+        this.breakGlassAuthorizer =
+            options.breakGlassAuthorizer ?? createDisabledBreakGlassAuthorizer();
     }
     async registerCredential(input) {
-        const candidate = validateCredentialMetadata({ ...input, version: 1, createdAt: this.timestamp(), expiresAt: input.expiresAt });
+        const candidate = validateCredentialMetadata({
+            ...input,
+            version: 1,
+            createdAt: this.timestamp(),
+            expiresAt: input.expiresAt,
+        });
         return this.mutate((state) => {
-            if (state.credentials.some((credential) => credential.tenantId === candidate.tenantId && credential.id === candidate.id))
+            if (state.credentials.some((credential) => credential.tenantId === candidate.tenantId &&
+                credential.id === candidate.id))
                 throw new CredentialBrokerError("Credential already exists.");
             state.credentials.push(candidate);
             return clone(candidate);
@@ -64,7 +71,9 @@ export class CredentialBroker {
             credential.version += 1;
             credential.rotatedAt = now;
             for (const grant of state.grants)
-                if (grant.tenantId === tenantId && grant.credentialId === credentialId && grant.revokedAt === undefined)
+                if (grant.tenantId === tenantId &&
+                    grant.credentialId === credentialId &&
+                    grant.revokedAt === undefined)
                     grant.revokedAt = now;
             return clone(credential);
         });
@@ -77,7 +86,9 @@ export class CredentialBroker {
             if (credential.revokedAt === undefined)
                 credential.revokedAt = now;
             for (const grant of state.grants)
-                if (grant.tenantId === tenantId && grant.credentialId === credentialId && grant.revokedAt === undefined)
+                if (grant.tenantId === tenantId &&
+                    grant.credentialId === credentialId &&
+                    grant.revokedAt === undefined)
                     grant.revokedAt = now;
         });
     }
@@ -89,13 +100,18 @@ export class CredentialBroker {
             const credential = findCredential(state, workload.tenantId, request.credentialId);
             assertCredentialUsable(credential, now);
             assertRequestMatchesCredential(request, credential, workload);
-            const normalOwnerMatch = credential.ownerWorkloadId === workload.workloadId && credential.ownerWorkloadKind === workload.workloadKind;
-            const breakGlass = normalOwnerMatch ? undefined : await this.breakGlassAuthorizer.authorize(input.breakGlassApproval, workload, request);
-            if (breakGlass !== undefined && Date.parse(expiresAt) - Date.parse(now) > MAX_BREAK_GLASS_TTL_MS)
+            const normalOwnerMatch = credential.ownerWorkloadId === workload.workloadId &&
+                credential.ownerWorkloadKind === workload.workloadKind;
+            const breakGlass = normalOwnerMatch
+                ? undefined
+                : await this.breakGlassAuthorizer.authorize(input.breakGlassApproval, workload, request);
+            if (breakGlass !== undefined &&
+                Date.parse(expiresAt) - Date.parse(now) > MAX_BREAK_GLASS_TTL_MS)
                 throw new CredentialBrokerError("Break-glass grants must expire within five minutes.");
             if (Date.parse(expiresAt) - Date.parse(now) > MAX_GRANT_TTL_MS)
                 throw new CredentialBrokerError("Credential grants must expire within fifteen minutes.");
-            if (Date.parse(expiresAt) > Date.parse(credential.expiresAt) || Date.parse(expiresAt) > Date.parse(workload.expiresAt))
+            if (Date.parse(expiresAt) > Date.parse(credential.expiresAt) ||
+                Date.parse(expiresAt) > Date.parse(workload.expiresAt))
                 throw new CredentialBrokerError("Credential grant expiry exceeds its credential or workload lifetime.");
             const grant = {
                 id: identifier(`grant-${randomUUID().replace(/-/g, "")}`, "Credential grant id"),
@@ -114,7 +130,7 @@ export class CredentialBroker {
                 action: clone(request.action),
                 issuedAt: now,
                 expiresAt,
-                ...(breakGlass === undefined ? {} : { breakGlass })
+                ...(breakGlass === undefined ? {} : { breakGlass }),
             };
             state.grants.push(grant);
             return clone(grant);
@@ -133,7 +149,8 @@ export class CredentialBroker {
             assertCredentialUsable(credential, now);
             if (credential.version !== grant.credentialVersion)
                 throw new CredentialBrokerError("Credential grant was invalidated by rotation.");
-            if (credential.provider !== this.executor.provider || !grant.scopes.every((scope) => this.executor.supportsScope(scope)))
+            if (credential.provider !== this.executor.provider ||
+                !grant.scopes.every((scope) => this.executor.supportsScope(scope)))
                 throw new CredentialBrokerError("Credential executor denies the requested scope.");
             const prior = state.receipts.find((receipt) => receipt.grantId === grant.id);
             if (prior !== undefined) {
@@ -142,16 +159,32 @@ export class CredentialBroker {
                 throw new CredentialBrokerError("Prior credential execution has no retry-safe outcome and will not retry automatically.");
             }
             await this.actionReceiptVerifier.verify(request.action, workload);
-            const receipt = { id: identifier(`credential-use-${randomUUID().replace(/-/g, "")}`, "Credential use receipt id"), grantId: grant.id, credentialId: credential.id, credentialVersion: credential.version, tenantId: credential.tenantId, workloadId: workload.workloadId, action: clone(grant.action), status: "executing", executedAt: now };
+            const receipt = {
+                id: identifier(`credential-use-${randomUUID().replace(/-/g, "")}`, "Credential use receipt id"),
+                grantId: grant.id,
+                credentialId: credential.id,
+                credentialVersion: credential.version,
+                tenantId: credential.tenantId,
+                workloadId: workload.workloadId,
+                action: clone(grant.action),
+                status: "executing",
+                executedAt: now,
+            };
             state.receipts.push(receipt);
-            return { grant: clone(grant), credential: clone(credential), receipt: clone(receipt) };
+            return {
+                grant: clone(grant),
+                credential: clone(credential),
+                receipt: clone(receipt),
+            };
         });
         if ("status" in started)
             return started;
         let secret;
         try {
             secret = await this.vault.readSecret(started.credential.vaultRef);
-            if (!(secret instanceof Uint8Array) || secret.byteLength === 0 || secret.byteLength > 64 * 1024)
+            if (!(secret instanceof Uint8Array) ||
+                secret.byteLength === 0 ||
+                secret.byteLength > 64 * 1024)
                 throw new CredentialBrokerError("Credential vault returned invalid secret material.");
             await this.assertExecutionActive(started.grant, input.identity);
         }
@@ -160,7 +193,12 @@ export class CredentialBroker {
             throw new CredentialBrokerError("Credential execution did not start.");
         }
         try {
-            const result = await this.executor.execute({ secret, grant: clone(started.grant), workload: clone(workload), assertActive: async () => this.assertExecutionActive(started.grant, input.identity) });
+            const result = await this.executor.execute({
+                secret,
+                grant: clone(started.grant),
+                workload: clone(workload),
+                assertActive: async () => this.assertExecutionActive(started.grant, input.identity),
+            });
             return await this.completeExecution(started.receipt.id, "executed", result.providerRequestId);
         }
         catch {
@@ -179,12 +217,21 @@ export class CredentialBroker {
             const current = state.grants.find((candidate) => candidate.id === grant.id);
             if (current === undefined)
                 throw new CredentialBrokerError("Credential grant was not found.");
-            assertGrantUsable(current, verifiedWorkload, { credentialId: grant.credentialId, provider: grant.provider, scopes: grant.scopes, audience: grant.audience, action: grant.action }, this.timestamp());
+            assertGrantUsable(current, verifiedWorkload, {
+                credentialId: grant.credentialId,
+                provider: grant.provider,
+                scopes: grant.scopes,
+                audience: grant.audience,
+                action: grant.action,
+            }, this.timestamp());
             const credential = findCredential(state, verifiedWorkload.tenantId, current.credentialId);
             assertCredentialUsable(credential, this.timestamp());
-            if (credential.version !== current.credentialVersion || credential.provider !== this.executor.provider || !current.scopes.every((scope) => this.executor.supportsScope(scope)))
+            if (credential.version !== current.credentialVersion ||
+                credential.provider !== this.executor.provider ||
+                !current.scopes.every((scope) => this.executor.supportsScope(scope)))
                 throw new CredentialBrokerError("Credential grant is no longer executable.");
-            if (state.receipts.find((receipt) => receipt.grantId === current.id)?.status !== "executing")
+            if (state.receipts.find((receipt) => receipt.grantId === current.id)
+                ?.status !== "executing")
                 throw new CredentialBrokerError("Credential execution is no longer active.");
         });
     }
@@ -200,7 +247,8 @@ export class CredentialBroker {
                 findCredential(state, receipt.tenantId, receipt.credentialId).lastUsedAt = now;
             }
             else {
-                receipt.failureCode = status === "failed" ? "execution_not_started" : "unknown_outcome";
+                receipt.failureCode =
+                    status === "failed" ? "execution_not_started" : "unknown_outcome";
             }
             return clone(receipt);
         });
@@ -209,7 +257,15 @@ export class CredentialBroker {
         const state = await this.read();
         const candidates = state.credentials.filter((credential) => credential.revokedAt === undefined);
         const results = await Promise.all(candidates.map(async (credential) => {
-            const active = this.workloadVerifier.isActive === undefined ? false : await this.workloadVerifier.isActive({ tenantId: credential.tenantId, projectId: credential.projectId, environment: credential.environment, workloadId: credential.ownerWorkloadId, workloadKind: credential.ownerWorkloadKind });
+            const active = this.workloadVerifier.isActive === undefined
+                ? false
+                : await this.workloadVerifier.isActive({
+                    tenantId: credential.tenantId,
+                    projectId: credential.projectId,
+                    environment: credential.environment,
+                    workloadId: credential.ownerWorkloadId,
+                    workloadKind: credential.ownerWorkloadKind,
+                });
             return active ? undefined : clone(credential);
         }));
         return results.filter((credential) => credential !== undefined);
@@ -260,7 +316,11 @@ export class CredentialBroker {
     }
 }
 export function createDisabledBreakGlassAuthorizer() {
-    return { async authorize() { throw new CredentialBrokerError("Break-glass authorization is not configured."); } };
+    return {
+        async authorize() {
+            throw new CredentialBrokerError("Break-glass authorization is not configured.");
+        },
+    };
 }
 export function createTestActionReceiptVerifier(reference) {
     let calls = 0;
@@ -270,9 +330,11 @@ export function createTestActionReceiptVerifier(reference) {
                 calls += 1;
                 if (!sameAction(reference, candidate))
                     throw new CredentialBrokerError("Action receipt does not authorize this credential use.");
-            }
+            },
+        },
+        get calls() {
+            return calls;
         },
-        get calls() { return calls; }
     };
 }
 export function createTestCredentialVault() {
@@ -285,13 +347,15 @@ export function createTestCredentialVault() {
                 if (value === undefined)
                     throw new CredentialBrokerError("Credential vault reference was not found.");
                 return new Uint8Array(value);
-            }
+            },
         },
         put(vaultRef, material) {
-            if (!(material instanceof Uint8Array) || material.byteLength === 0 || material.byteLength > 64 * 1024)
+            if (!(material instanceof Uint8Array) ||
+                material.byteLength === 0 ||
+                material.byteLength > 64 * 1024)
                 throw new CredentialBrokerError("Test credential material is invalid.");
             values.set(reference(vaultRef, "Credential vault reference"), new Uint8Array(material));
-        }
+        },
     };
 }
 export function createTestCredentialExecutor() {
@@ -301,14 +365,19 @@ export function createTestCredentialExecutor() {
             provider: "test-provider",
             supportsScope: (scope) => scope === "test.execute",
             async execute(input) {
-                if (input.grant.audience !== "ghostapi-server" || !input.grant.scopes.every((scope) => scope === "test.execute") || input.secret.byteLength === 0)
+                if (input.grant.audience !== "ghostapi-server" ||
+                    !input.grant.scopes.every((scope) => scope === "test.execute") ||
+                    input.secret.byteLength === 0)
                     throw new CredentialBrokerError("Test provider rejected credential execution.");
                 await input.assertActive();
-                executions.push({ grantId: input.grant.id, secretLength: input.secret.byteLength });
+                executions.push({
+                    grantId: input.grant.id,
+                    secretLength: input.secret.byteLength,
+                });
                 return { providerRequestId: `test-provider-${input.grant.id}` };
-            }
+            },
         },
-        executions
+        executions,
     };
 }
 export function createTestWorkloadIdentityProvider(options = {}) {
@@ -318,7 +387,9 @@ export function createTestWorkloadIdentityProvider(options = {}) {
     return {
         verifier: {
             async authenticate(identity) {
-                if (identity === null || typeof identity !== "object" || !issued.has(identity))
+                if (identity === null ||
+                    typeof identity !== "object" ||
+                    !issued.has(identity))
                     throw new CredentialBrokerError("Workload identity is not authenticated.");
                 const workload = validateWorkloadIdentity(identity, timestampFrom(now));
                 if (!active.has(workloadKey(workload)))
@@ -327,7 +398,7 @@ export function createTestWorkloadIdentityProvider(options = {}) {
             },
             async isActive(binding) {
                 return active.has(workloadKey(binding));
-            }
+            },
         },
         issue(input) {
             const workload = validateWorkloadIdentity({ schemaVersion: 1, kind: "ghostapi.workload-identity", ...input }, timestampFrom(now));
@@ -341,7 +412,7 @@ export function createTestWorkloadIdentityProvider(options = {}) {
             for (const key of [...active])
                 if (key.endsWith(`:${id}`))
                     active.delete(key);
-        }
+        },
     };
 }
 export function createTestBreakGlassAuthorizer(options = {}) {
@@ -350,20 +421,28 @@ export function createTestBreakGlassAuthorizer(options = {}) {
     return {
         authorizer: {
             async authorize(approval, workload, request) {
-                if (approval === null || typeof approval !== "object" || !issued.has(approval))
+                if (approval === null ||
+                    typeof approval !== "object" ||
+                    !issued.has(approval))
                     throw new CredentialBrokerError("Break-glass approval is not trusted.");
                 const parsed = validateBreakGlassApproval(approval, timestampFrom(now));
-                if (parsed.approvedBy === workload.subjectId || parsed.approvedBy === workload.workloadId || !sameAction(parsed.action, request.action))
+                if (parsed.approvedBy === workload.subjectId ||
+                    parsed.approvedBy === workload.workloadId ||
+                    !sameAction(parsed.action, request.action))
                     throw new CredentialBrokerError("Break-glass approval does not authorize this workload action.");
-                return { approvalId: parsed.approvalId, approvedBy: parsed.approvedBy, reason: parsed.reason };
-            }
+                return {
+                    approvalId: parsed.approvalId,
+                    approvedBy: parsed.approvedBy,
+                    reason: parsed.reason,
+                };
+            },
         },
         issue(input) {
             const approval = validateBreakGlassApproval({ schemaVersion: 1, kind: "ghostapi.break-glass-approval", ...input }, timestampFrom(now));
             const frozen = Object.freeze(clone(approval));
             issued.add(frozen);
             return frozen;
-        }
+        },
     };
 }
 function emptyState() {
@@ -379,8 +458,12 @@ function validateState(value) {
     const grants = array(state.grants, "Credential grants", MAX_GRANTS).map(validateGrant);
     unique(grants.map((grant) => grant.id), "Credential grant ids");
     for (const grant of grants) {
-        const credential = credentials.find((candidate) => candidate.tenantId === grant.tenantId && candidate.id === grant.credentialId);
-        if (credential === undefined || grant.credentialVersion > credential.version || grant.provider !== credential.provider || !grant.scopes.every((scope) => credential.allowedScopes.includes(scope)))
+        const credential = credentials.find((candidate) => candidate.tenantId === grant.tenantId &&
+            candidate.id === grant.credentialId);
+        if (credential === undefined ||
+            grant.credentialVersion > credential.version ||
+            grant.provider !== credential.provider ||
+            !grant.scopes.every((scope) => credential.allowedScopes.includes(scope)))
             throw new CredentialBrokerError("Credential grant references an invalid credential.");
     }
     const receipts = array(state.receipts, "Credential use receipts", MAX_RECEIPTS).map(validateReceipt);
@@ -388,87 +471,286 @@ function validateState(value) {
     unique(receipts.map((receipt) => receipt.grantId), "Credential use receipt grants");
     for (const receipt of receipts) {
         const grant = grants.find((candidate) => candidate.id === receipt.grantId);
-        if (grant === undefined || receipt.credentialId !== grant.credentialId || receipt.credentialVersion !== grant.credentialVersion || receipt.tenantId !== grant.tenantId || receipt.workloadId !== grant.workloadId || !sameAction(receipt.action, grant.action))
+        if (grant === undefined ||
+            receipt.credentialId !== grant.credentialId ||
+            receipt.credentialVersion !== grant.credentialVersion ||
+            receipt.tenantId !== grant.tenantId ||
+            receipt.workloadId !== grant.workloadId ||
+            !sameAction(receipt.action, grant.action))
             throw new CredentialBrokerError("Credential use receipt references an invalid grant.");
     }
     return { schemaVersion: 1, credentials, grants, receipts };
 }
 function validateCredentialMetadata(value) {
     const metadata = object(value, "Credential metadata is invalid.");
-    exactKeys(metadata, ["id", "tenantId", "projectId", "environment", "provider", "ownerWorkloadId", "ownerWorkloadKind", "vaultRef", "allowedScopes", "version", "createdAt", "expiresAt", "rotatedAt", "revokedAt", "lastUsedAt"], "Credential metadata", ["rotatedAt", "revokedAt", "lastUsedAt"]);
+    exactKeys(metadata, [
+        "id",
+        "tenantId",
+        "projectId",
+        "environment",
+        "provider",
+        "ownerWorkloadId",
+        "ownerWorkloadKind",
+        "vaultRef",
+        "allowedScopes",
+        "version",
+        "createdAt",
+        "expiresAt",
+        "rotatedAt",
+        "revokedAt",
+        "lastUsedAt",
+    ], "Credential metadata", ["rotatedAt", "revokedAt", "lastUsedAt"]);
     const createdAt = timestamp(metadata.createdAt, "Credential creation time");
     const expiresAt = timestamp(metadata.expiresAt, "Credential expiry");
     if (Date.parse(expiresAt) <= Date.parse(createdAt))
         throw new CredentialBrokerError("Credential expiry must follow creation.");
-    return { id: identifier(metadata.id, "Credential id"), tenantId: identifier(metadata.tenantId, "Credential tenant id"), projectId: identifier(metadata.projectId, "Credential project id"), environment: identifier(metadata.environment, "Credential environment"), provider: identifier(metadata.provider, "Credential provider"), ownerWorkloadId: identifier(metadata.ownerWorkloadId, "Credential owner workload id"), ownerWorkloadKind: workloadKind(metadata.ownerWorkloadKind), vaultRef: reference(metadata.vaultRef, "Credential vault reference"), allowedScopes: scopes(metadata.allowedScopes, "Credential allowed scopes"), version: positiveInteger(metadata.version, "Credential version"), createdAt, expiresAt, ...(metadata.rotatedAt === undefined ? {} : { rotatedAt: timestamp(metadata.rotatedAt, "Credential rotation time") }), ...(metadata.revokedAt === undefined ? {} : { revokedAt: timestamp(metadata.revokedAt, "Credential revocation time") }), ...(metadata.lastUsedAt === undefined ? {} : { lastUsedAt: timestamp(metadata.lastUsedAt, "Credential last use time") }) };
+    return {
+        id: identifier(metadata.id, "Credential id"),
+        tenantId: identifier(metadata.tenantId, "Credential tenant id"),
+        projectId: identifier(metadata.projectId, "Credential project id"),
+        environment: identifier(metadata.environment, "Credential environment"),
+        provider: identifier(metadata.provider, "Credential provider"),
+        ownerWorkloadId: identifier(metadata.ownerWorkloadId, "Credential owner workload id"),
+        ownerWorkloadKind: workloadKind(metadata.ownerWorkloadKind),
+        vaultRef: reference(metadata.vaultRef, "Credential vault reference"),
+        allowedScopes: scopes(metadata.allowedScopes, "Credential allowed scopes"),
+        version: positiveInteger(metadata.version, "Credential version"),
+        createdAt,
+        expiresAt,
+        ...(metadata.rotatedAt === undefined
+            ? {}
+            : {
+                rotatedAt: timestamp(metadata.rotatedAt, "Credential rotation time"),
+            }),
+        ...(metadata.revokedAt === undefined
+            ? {}
+            : {
+                revokedAt: timestamp(metadata.revokedAt, "Credential revocation time"),
+            }),
+        ...(metadata.lastUsedAt === undefined
+            ? {}
+            : {
+                lastUsedAt: timestamp(metadata.lastUsedAt, "Credential last use time"),
+            }),
+    };
 }
 function validateGrant(value) {
     const grant = object(value, "Credential grant is invalid.");
-    exactKeys(grant, ["id", "credentialId", "credentialVersion", "tenantId", "projectId", "environment", "workloadId", "subjectId", "workloadKind", "runId", "provider", "scopes", "audience", "action", "issuedAt", "expiresAt", "breakGlass", "revokedAt"], "Credential grant", ["breakGlass", "revokedAt"]);
+    exactKeys(grant, [
+        "id",
+        "credentialId",
+        "credentialVersion",
+        "tenantId",
+        "projectId",
+        "environment",
+        "workloadId",
+        "subjectId",
+        "workloadKind",
+        "runId",
+        "provider",
+        "scopes",
+        "audience",
+        "action",
+        "issuedAt",
+        "expiresAt",
+        "breakGlass",
+        "revokedAt",
+    ], "Credential grant", ["breakGlass", "revokedAt"]);
     const issuedAt = timestamp(grant.issuedAt, "Credential grant issue time");
     const expiresAt = timestamp(grant.expiresAt, "Credential grant expiry");
-    if (Date.parse(expiresAt) <= Date.parse(issuedAt) || Date.parse(expiresAt) - Date.parse(issuedAt) > MAX_GRANT_TTL_MS)
+    if (Date.parse(expiresAt) <= Date.parse(issuedAt) ||
+        Date.parse(expiresAt) - Date.parse(issuedAt) > MAX_GRANT_TTL_MS)
         throw new CredentialBrokerError("Credential grant lifetime is invalid.");
-    const breakGlass = grant.breakGlass === undefined ? undefined : breakGlassRecord(grant.breakGlass);
-    if (breakGlass !== undefined && Date.parse(expiresAt) - Date.parse(issuedAt) > MAX_BREAK_GLASS_TTL_MS)
+    const breakGlass = grant.breakGlass === undefined
+        ? undefined
+        : breakGlassRecord(grant.breakGlass);
+    if (breakGlass !== undefined &&
+        Date.parse(expiresAt) - Date.parse(issuedAt) > MAX_BREAK_GLASS_TTL_MS)
         throw new CredentialBrokerError("Break-glass grant lifetime is invalid.");
     if (grant.audience !== "ghostapi-server")
         throw new CredentialBrokerError("Credential grant audience is invalid.");
-    return { id: identifier(grant.id, "Credential grant id"), credentialId: identifier(grant.credentialId, "Credential id"), credentialVersion: positiveInteger(grant.credentialVersion, "Credential version"), tenantId: identifier(grant.tenantId, "Credential tenant id"), projectId: identifier(grant.projectId, "Credential project id"), environment: identifier(grant.environment, "Credential environment"), workloadId: identifier(grant.workloadId, "Credential workload id"), subjectId: identifier(grant.subjectId, "Credential subject id"), workloadKind: workloadKind(grant.workloadKind), runId: identifier(grant.runId, "Credential run id"), provider: identifier(grant.provider, "Credential provider"), scopes: scopes(grant.scopes, "Credential grant scopes"), audience: "ghostapi-server", action: actionReference(grant.action), issuedAt, expiresAt, ...(breakGlass === undefined ? {} : { breakGlass }), ...(grant.revokedAt === undefined ? {} : { revokedAt: timestamp(grant.revokedAt, "Credential grant revocation time") }) };
+    return {
+        id: identifier(grant.id, "Credential grant id"),
+        credentialId: identifier(grant.credentialId, "Credential id"),
+        credentialVersion: positiveInteger(grant.credentialVersion, "Credential version"),
+        tenantId: identifier(grant.tenantId, "Credential tenant id"),
+        projectId: identifier(grant.projectId, "Credential project id"),
+        environment: identifier(grant.environment, "Credential environment"),
+        workloadId: identifier(grant.workloadId, "Credential workload id"),
+        subjectId: identifier(grant.subjectId, "Credential subject id"),
+        workloadKind: workloadKind(grant.workloadKind),
+        runId: identifier(grant.runId, "Credential run id"),
+        provider: identifier(grant.provider, "Credential provider"),
+        scopes: scopes(grant.scopes, "Credential grant scopes"),
+        audience: "ghostapi-server",
+        action: actionReference(grant.action),
+        issuedAt,
+        expiresAt,
+        ...(breakGlass === undefined ? {} : { breakGlass }),
+        ...(grant.revokedAt === undefined
+            ? {}
+            : {
+                revokedAt: timestamp(grant.revokedAt, "Credential grant revocation time"),
+            }),
+    };
 }
 function validateReceipt(value) {
     const receipt = object(value, "Credential use receipt is invalid.");
-    exactKeys(receipt, ["id", "grantId", "credentialId", "credentialVersion", "tenantId", "workloadId", "action", "status", "providerRequestId", "failureCode", "executedAt"], "Credential use receipt", ["providerRequestId", "failureCode"]);
-    if (receipt.status !== "executing" && receipt.status !== "executed" && receipt.status !== "failed" && receipt.status !== "unknown")
+    exactKeys(receipt, [
+        "id",
+        "grantId",
+        "credentialId",
+        "credentialVersion",
+        "tenantId",
+        "workloadId",
+        "action",
+        "status",
+        "providerRequestId",
+        "failureCode",
+        "executedAt",
+    ], "Credential use receipt", ["providerRequestId", "failureCode"]);
+    if (receipt.status !== "executing" &&
+        receipt.status !== "executed" &&
+        receipt.status !== "failed" &&
+        receipt.status !== "unknown")
         throw new CredentialBrokerError("Credential use receipt status is invalid.");
-    if (receipt.status === "executing" && (receipt.failureCode !== undefined || receipt.providerRequestId !== undefined))
+    if (receipt.status === "executing" &&
+        (receipt.failureCode !== undefined ||
+            receipt.providerRequestId !== undefined))
         throw new CredentialBrokerError("Executing credential receipt is invalid.");
-    if (receipt.status === "executed" && (receipt.failureCode !== undefined || receipt.providerRequestId === undefined))
+    if (receipt.status === "executed" &&
+        (receipt.failureCode !== undefined ||
+            receipt.providerRequestId === undefined))
         throw new CredentialBrokerError("Executed credential receipt is invalid.");
-    if (receipt.status === "failed" && (receipt.failureCode !== "execution_not_started" || receipt.providerRequestId !== undefined))
+    if (receipt.status === "failed" &&
+        (receipt.failureCode !== "execution_not_started" ||
+            receipt.providerRequestId !== undefined))
         throw new CredentialBrokerError("Failed credential receipt is invalid.");
-    if (receipt.status === "unknown" && (receipt.failureCode !== "unknown_outcome" || receipt.providerRequestId !== undefined))
+    if (receipt.status === "unknown" &&
+        (receipt.failureCode !== "unknown_outcome" ||
+            receipt.providerRequestId !== undefined))
         throw new CredentialBrokerError("Unknown credential receipt is invalid.");
-    return { id: identifier(receipt.id, "Credential use receipt id"), grantId: identifier(receipt.grantId, "Credential grant id"), credentialId: identifier(receipt.credentialId, "Credential id"), credentialVersion: positiveInteger(receipt.credentialVersion, "Credential version"), tenantId: identifier(receipt.tenantId, "Credential tenant id"), workloadId: identifier(receipt.workloadId, "Credential workload id"), action: actionReference(receipt.action), status: receipt.status, ...(receipt.providerRequestId === undefined ? {} : { providerRequestId: identifier(receipt.providerRequestId, "Provider request id") }), ...(receipt.failureCode === undefined ? {} : { failureCode: receipt.failureCode }), executedAt: timestamp(receipt.executedAt, "Credential execution time") };
+    return {
+        id: identifier(receipt.id, "Credential use receipt id"),
+        grantId: identifier(receipt.grantId, "Credential grant id"),
+        credentialId: identifier(receipt.credentialId, "Credential id"),
+        credentialVersion: positiveInteger(receipt.credentialVersion, "Credential version"),
+        tenantId: identifier(receipt.tenantId, "Credential tenant id"),
+        workloadId: identifier(receipt.workloadId, "Credential workload id"),
+        action: actionReference(receipt.action),
+        status: receipt.status,
+        ...(receipt.providerRequestId === undefined
+            ? {}
+            : {
+                providerRequestId: identifier(receipt.providerRequestId, "Provider request id"),
+            }),
+        ...(receipt.failureCode === undefined
+            ? {}
+            : {
+                failureCode: receipt.failureCode,
+            }),
+        executedAt: timestamp(receipt.executedAt, "Credential execution time"),
+    };
 }
 function validateAccessRequest(value) {
     const request = object(value, "Credential access request is invalid.");
     exactKeys(request, ["credentialId", "provider", "scopes", "audience", "action"], "Credential access request");
     if (request.audience !== "ghostapi-server")
         throw new CredentialBrokerError("Credential access request audience is invalid.");
-    return { credentialId: identifier(request.credentialId, "Credential id"), provider: identifier(request.provider, "Credential provider"), scopes: scopes(request.scopes, "Credential request scopes"), audience: "ghostapi-server", action: actionReference(request.action) };
+    return {
+        credentialId: identifier(request.credentialId, "Credential id"),
+        provider: identifier(request.provider, "Credential provider"),
+        scopes: scopes(request.scopes, "Credential request scopes"),
+        audience: "ghostapi-server",
+        action: actionReference(request.action),
+    };
 }
 function validateWorkloadIdentity(value, now) {
     const identity = object(value, "Workload identity is invalid.");
-    exactKeys(identity, ["schemaVersion", "kind", "tenantId", "projectId", "environment", "workloadId", "subjectId", "workloadKind", "runId", "issuedAt", "expiresAt"], "Workload identity");
-    if (identity.schemaVersion !== SCHEMA_VERSION || identity.kind !== "ghostapi.workload-identity")
+    exactKeys(identity, [
+        "schemaVersion",
+        "kind",
+        "tenantId",
+        "projectId",
+        "environment",
+        "workloadId",
+        "subjectId",
+        "workloadKind",
+        "runId",
+        "issuedAt",
+        "expiresAt",
+    ], "Workload identity");
+    if (identity.schemaVersion !== SCHEMA_VERSION ||
+        identity.kind !== "ghostapi.workload-identity")
         throw new CredentialBrokerError("Unsupported workload identity schema.");
     const issuedAt = timestamp(identity.issuedAt, "Workload identity issue time");
     const expiresAt = timestamp(identity.expiresAt, "Workload identity expiry");
-    if (Date.parse(expiresAt) <= Date.parse(issuedAt) || Date.parse(expiresAt) <= Date.parse(now))
+    if (Date.parse(expiresAt) <= Date.parse(issuedAt) ||
+        Date.parse(expiresAt) <= Date.parse(now))
         throw new CredentialBrokerError("Workload identity is expired.");
-    return { schemaVersion: 1, kind: "ghostapi.workload-identity", tenantId: identifier(identity.tenantId, "Workload tenant id"), projectId: identifier(identity.projectId, "Workload project id"), environment: identifier(identity.environment, "Workload environment"), workloadId: identifier(identity.workloadId, "Workload id"), subjectId: identifier(identity.subjectId, "Workload subject id"), workloadKind: workloadKind(identity.workloadKind), runId: identifier(identity.runId, "Workload run id"), issuedAt, expiresAt };
+    return {
+        schemaVersion: 1,
+        kind: "ghostapi.workload-identity",
+        tenantId: identifier(identity.tenantId, "Workload tenant id"),
+        projectId: identifier(identity.projectId, "Workload project id"),
+        environment: identifier(identity.environment, "Workload environment"),
+        workloadId: identifier(identity.workloadId, "Workload id"),
+        subjectId: identifier(identity.subjectId, "Workload subject id"),
+        workloadKind: workloadKind(identity.workloadKind),
+        runId: identifier(identity.runId, "Workload run id"),
+        issuedAt,
+        expiresAt,
+    };
 }
 function validateBreakGlassApproval(value, now) {
     const approval = object(value, "Break-glass approval is invalid.");
-    exactKeys(approval, ["schemaVersion", "kind", "approvalId", "action", "approvedBy", "reason", "issuedAt", "expiresAt"], "Break-glass approval");
-    if (approval.schemaVersion !== SCHEMA_VERSION || approval.kind !== "ghostapi.break-glass-approval")
+    exactKeys(approval, [
+        "schemaVersion",
+        "kind",
+        "approvalId",
+        "action",
+        "approvedBy",
+        "reason",
+        "issuedAt",
+        "expiresAt",
+    ], "Break-glass approval");
+    if (approval.schemaVersion !== SCHEMA_VERSION ||
+        approval.kind !== "ghostapi.break-glass-approval")
         throw new CredentialBrokerError("Unsupported break-glass approval schema.");
     const issuedAt = timestamp(approval.issuedAt, "Break-glass issue time");
     const expiresAt = timestamp(approval.expiresAt, "Break-glass expiry");
-    if (Date.parse(issuedAt) > Date.parse(now) || Date.parse(expiresAt) <= Date.parse(now) || Date.parse(expiresAt) - Date.parse(issuedAt) > MAX_BREAK_GLASS_TTL_MS)
+    if (Date.parse(issuedAt) > Date.parse(now) ||
+        Date.parse(expiresAt) <= Date.parse(now) ||
+        Date.parse(expiresAt) - Date.parse(issuedAt) > MAX_BREAK_GLASS_TTL_MS)
         throw new CredentialBrokerError("Break-glass approval is expired or exceeds five minutes.");
-    return { schemaVersion: 1, kind: "ghostapi.break-glass-approval", approvalId: identifier(approval.approvalId, "Break-glass approval id"), action: actionReference(approval.action), approvedBy: identifier(approval.approvedBy, "Break-glass approver id"), reason: text(approval.reason, "Break-glass reason", 200), issuedAt, expiresAt };
+    return {
+        schemaVersion: 1,
+        kind: "ghostapi.break-glass-approval",
+        approvalId: identifier(approval.approvalId, "Break-glass approval id"),
+        action: actionReference(approval.action),
+        approvedBy: identifier(approval.approvedBy, "Break-glass approver id"),
+        reason: text(approval.reason, "Break-glass reason", 200),
+        issuedAt,
+        expiresAt,
+    };
 }
 function breakGlassRecord(value) {
     const record = object(value, "Break-glass record is invalid.");
     exactKeys(record, ["approvalId", "approvedBy", "reason"], "Break-glass record");
-    return { approvalId: identifier(record.approvalId, "Break-glass approval id"), approvedBy: identifier(record.approvedBy, "Break-glass approver id"), reason: text(record.reason, "Break-glass reason", 200) };
+    return {
+        approvalId: identifier(record.approvalId, "Break-glass approval id"),
+        approvedBy: identifier(record.approvedBy, "Break-glass approver id"),
+        reason: text(record.reason, "Break-glass reason", 200),
+    };
 }
 function actionReference(value) {
     const action = object(value, "Credential action reference is invalid.");
     exactKeys(action, ["actionId", "actionHash", "actionReceiptHash"], "Credential action reference");
-    return { actionId: identifier(action.actionId, "Credential action id"), actionHash: hash(action.actionHash, "Credential action hash"), actionReceiptHash: hash(action.actionReceiptHash, "Credential action receipt hash") };
+    return {
+        actionId: identifier(action.actionId, "Credential action id"),
+        actionHash: hash(action.actionHash, "Credential action hash"),
+        actionReceiptHash: hash(action.actionReceiptHash, "Credential action receipt hash"),
+    };
 }
 function assertCredentialUsable(credential, now) {
     if (credential.revokedAt !== undefined)
@@ -477,17 +759,31 @@ function assertCredentialUsable(credential, now) {
         throw new CredentialBrokerError("Credential is expired.");
 }
 function assertRequestMatchesCredential(request, credential, workload) {
-    if (request.provider !== credential.provider || workload.tenantId !== credential.tenantId || workload.projectId !== credential.projectId || workload.environment !== credential.environment)
+    if (request.provider !== credential.provider ||
+        workload.tenantId !== credential.tenantId ||
+        workload.projectId !== credential.projectId ||
+        workload.environment !== credential.environment)
         throw new CredentialBrokerError("Credential request crosses a tenant, project, environment, or provider boundary.");
     if (!request.scopes.every((scope) => credential.allowedScopes.includes(scope)))
         throw new CredentialBrokerError("Credential request exceeds the credential scope.");
 }
 function assertGrantUsable(grant, workload, request, now) {
-    if (grant.revokedAt !== undefined || Date.parse(grant.expiresAt) <= Date.parse(now))
+    if (grant.revokedAt !== undefined ||
+        Date.parse(grant.expiresAt) <= Date.parse(now))
         throw new CredentialBrokerError("Credential grant is expired or revoked.");
-    if (grant.tenantId !== workload.tenantId || grant.projectId !== workload.projectId || grant.environment !== workload.environment || grant.workloadId !== workload.workloadId || grant.subjectId !== workload.subjectId || grant.workloadKind !== workload.workloadKind || grant.runId !== workload.runId)
+    if (grant.tenantId !== workload.tenantId ||
+        grant.projectId !== workload.projectId ||
+        grant.environment !== workload.environment ||
+        grant.workloadId !== workload.workloadId ||
+        grant.subjectId !== workload.subjectId ||
+        grant.workloadKind !== workload.workloadKind ||
+        grant.runId !== workload.runId)
         throw new CredentialBrokerError("Credential grant does not belong to this workload subject and run.");
-    if (grant.credentialId !== request.credentialId || grant.provider !== request.provider || grant.audience !== request.audience || !sameScopes(grant.scopes, request.scopes) || !sameAction(grant.action, request.action))
+    if (grant.credentialId !== request.credentialId ||
+        grant.provider !== request.provider ||
+        grant.audience !== request.audience ||
+        !sameScopes(grant.scopes, request.scopes) ||
+        !sameAction(grant.action, request.action))
         throw new CredentialBrokerError("Credential request differs from the granted action.");
 }
 function findCredential(state, tenantId, credentialId) {
@@ -505,26 +801,35 @@ function scopes(value, label) {
     return parsed.sort();
 }
 function workloadKind(value) {
-    if (value !== "agent_run" && value !== "ci_job" && value !== "production_service")
+    if (value !== "agent_run" &&
+        value !== "ci_job" &&
+        value !== "production_service")
         throw new CredentialBrokerError("Workload kind is invalid.");
     return value;
 }
 function sameScopes(left, right) {
-    return left.length === right.length && left.every((scope, index) => scope === right[index]);
+    return (left.length === right.length &&
+        left.every((scope, index) => scope === right[index]));
 }
 function sameAction(left, right) {
-    return left.actionId === right.actionId && left.actionHash === right.actionHash && left.actionReceiptHash === right.actionReceiptHash;
+    return (left.actionId === right.actionId &&
+        left.actionHash === right.actionHash &&
+        left.actionReceiptHash === right.actionReceiptHash);
 }
 function workloadKey(binding) {
     return `${binding.tenantId}:${binding.projectId}:${binding.environment}:${binding.workloadKind}:${binding.workloadId}`;
 }
 function identifier(value, label) {
-    if (typeof value !== "string" || !IDENTIFIER.test(value) || sanitizeSecretString(value) !== value)
+    if (typeof value !== "string" ||
+        !IDENTIFIER.test(value) ||
+        sanitizeSecretString(value) !== value)
         throw new CredentialBrokerError(`${label} must be a safe stable identifier.`);
     return value;
 }
 function reference(value, label) {
-    if (typeof value !== "string" || !REFERENCE.test(value) || sanitizeSecretString(value) !== value)
+    if (typeof value !== "string" ||
+        !REFERENCE.test(value) ||
+        sanitizeSecretString(value) !== value)
         throw new CredentialBrokerError(`${label} is invalid.`);
     return value;
 }
@@ -539,7 +844,9 @@ function positiveInteger(value, label) {
     return value;
 }
 function timestamp(value, label) {
-    if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) || !Number.isFinite(Date.parse(value)))
+    if (typeof value !== "string" ||
+        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) ||
+        !Number.isFinite(Date.parse(value)))
         throw new CredentialBrokerError(`${label} must be an ISO UTC timestamp.`);
     return value;
 }
@@ -550,7 +857,11 @@ function futureTimestamp(value, now, label) {
     return parsed;
 }
 function text(value, label, maxLength) {
-    if (typeof value !== "string" || value.length < 1 || value.length > maxLength || /[\u0000-\u001f]/.test(value) || sanitizeSecretString(value) !== value)
+    if (typeof value !== "string" ||
+        value.length < 1 ||
+        value.length > maxLength ||
+        /[\u0000-\u001f]/.test(value) ||
+        sanitizeSecretString(value) !== value)
         throw new CredentialBrokerError(`${label} is invalid.`);
     return value;
 }
@@ -566,7 +877,8 @@ function object(value, message) {
 }
 function exactKeys(value, keys, label, optional = []) {
     for (const key of Object.keys(value))
-        if (!keys.includes(key) || (value[key] === undefined && !optional.includes(key)))
+        if (!keys.includes(key) ||
+            (value[key] === undefined && !optional.includes(key)))
             throw new CredentialBrokerError(`${label} contains unsupported field: ${key}`);
 }
 function unique(values, label) {