@yiaany/ghostapi 0.1.8 → 0.2.0

package/dist/inventory/inventoryController.js

@@ -2,11 +2,11 @@ import { randomUUID } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { getDataPaths } from "../config/dataPaths.js";
-import { atomicWriteJson, ensurePrivateDirectory, withFileLock } from "../storage/fileStore.js";
+import { atomicWriteJson, ensurePrivateDirectory, withFileLock, } from "../storage/fileStore.js";
 import { sanitizeSecretString } from "../security/secrets.js";
 import { normalizeFreshnessDays } from "./analysis.js";
-import { InventoryError, INVENTORY_LIMITS, buildRecordFreshness, buildRecordProvenance, canonicalPayloadDigest, clone, edgeIdFor, emptyInventoryState, freshnessStatusFor, validateImportPayload, validateOperator, validateState } from "./types.js";
-import { computeBlastRadius, computeFindings, computeRemovalAnalysis, computeRoiReport, findAttackPaths, findingKey, graphEdges } from "./analysis.js";
+import { InventoryError, INVENTORY_LIMITS, buildRecordFreshness, buildRecordProvenance, canonicalPayloadDigest, clone, edgeIdFor, emptyInventoryState, freshnessStatusFor, validateImportPayload, validateOperator, validateState, } from "./types.js";
+import { computeBlastRadius, computeFindings, computeRemovalAnalysis, computeRoiReport, findAttackPaths, findingKey, graphEdges, } from "./analysis.js";
 export class LocalInventoryController {
     path;
     now;
@@ -16,7 +16,8 @@ export class LocalInventoryController {
     constructor(options = {}) {
         this.path = options.path ?? getDataPaths().inventoryStore;
         this.now = options.now ?? (() => new Date());
-        this.operatorAuthorizer = options.operatorAuthorizer ?? createDisabledInventoryOperatorAuthorizer();
+        this.operatorAuthorizer =
+            options.operatorAuthorizer ?? createDisabledInventoryOperatorAuthorizer();
         this.freshnessDays = options.freshnessDays;
         this.evalScenarioExists = options.evalScenarioExists;
     }
@@ -32,7 +33,16 @@ export class LocalInventoryController {
             for (const edge of state.edges)
                 before.set(edge.edgeId, edge);
             const upserted = [];
-            const counts = { agents: 0, tools: 0, identities: 0, providers: 0, resources: 0, sideEffects: 0, credentials: 0, policies: 0 };
+            const counts = {
+                agents: 0,
+                tools: 0,
+                identities: 0,
+                providers: 0,
+                resources: 0,
+                sideEffects: 0,
+                credentials: 0,
+                policies: 0,
+            };
             const imported = new ImportedRecords(payload);
             for (const input of payload.agents ?? []) {
                 upsertAgent(state, operator.tenantId, input, payload, operator.principalId, now);
@@ -85,17 +95,33 @@ export class LocalInventoryController {
                 runId,
                 importedAt: now,
                 importedBy: operator.principalId,
-                source: { sourceId: payload.source.sourceId, sourceType: payload.source.sourceType, sourceName: payload.source.sourceName, ...(payload.source.sourceVersion === undefined ? {} : { sourceVersion: payload.source.sourceVersion }) },
+                source: {
+                    sourceId: payload.source.sourceId,
+                    sourceType: payload.source.sourceType,
+                    sourceName: payload.source.sourceName,
+                    ...(payload.source.sourceVersion === undefined
+                        ? {}
+                        : { sourceVersion: payload.source.sourceVersion }),
+                },
                 digest,
                 expectedPolicyHashes: payload.expectedPolicyHashes ?? [],
-                ...(payload.counters === undefined ? {} : { counters: payload.counters }),
+                ...(payload.counters === undefined
+                    ? {}
+                    : { counters: payload.counters }),
                 recordCounts: counts,
                 edgesCreated: outcome.edgesCreated,
                 edgesRefreshed: outcome.edgesRefreshed,
-                status: "completed"
+                status: "completed",
             });
             this.rotateImportRuns(state, operator.tenantId);
-            return { runId, importedAt: now, digest, recordCounts: counts, edgesCreated: outcome.edgesCreated, edgesRefreshed: outcome.edgesRefreshed };
+            return {
+                runId,
+                importedAt: now,
+                digest,
+                recordCounts: counts,
+                edgesCreated: outcome.edgesCreated,
+                edgesRefreshed: outcome.edgesRefreshed,
+            };
         });
     }
     async inspect(identityValue) {
@@ -114,23 +140,41 @@ export class LocalInventoryController {
             }
             const computed = computeFindings(state, operator.tenantId, now, this.freshnessDays);
             let resolved = 0;
-            const appliedRemediations = state.remediations.filter((remediation) => remediation.tenantId === operator.tenantId && remediation.status === "applied");
+            const appliedRemediations = state.remediations.filter((remediation) => remediation.tenantId === operator.tenantId &&
+                remediation.status === "applied");
             const nextFindings = computed.map((finding) => {
                 const prior = previous.get(findingKey(finding));
-                const matchingRemediation = appliedRemediations.find((remediation) => remediation.findingId === finding.findingId && remediation.targetKind === finding.targetKind && remediation.targetId === finding.targetId);
+                const matchingRemediation = appliedRemediations.find((remediation) => remediation.findingId === finding.findingId &&
+                    remediation.targetKind === finding.targetKind &&
+                    remediation.targetId === finding.targetId);
                 if (matchingRemediation !== undefined) {
                     if (this.isRemediationEffective(state, operator.tenantId, matchingRemediation)) {
                         resolved += 1;
-                        return { ...finding, status: "resolved", resolvedAt: matchingRemediation.appliedAt, remediationId: matchingRemediation.remediationId };
+                        return {
+                            ...finding,
+                            status: "resolved",
+                            resolvedAt: matchingRemediation.appliedAt,
+                            remediationId: matchingRemediation.remediationId,
+                        };
                     }
                     return finding;
                 }
                 if (prior !== undefined && prior.status === "resolved") {
-                    return { ...finding, status: "resolved", resolvedAt: prior.resolvedAt, ...(prior.remediationId === undefined ? {} : { remediationId: prior.remediationId }) };
+                    return {
+                        ...finding,
+                        status: "resolved",
+                        resolvedAt: prior.resolvedAt,
+                        ...(prior.remediationId === undefined
+                            ? {}
+                            : { remediationId: prior.remediationId }),
+                    };
                 }
                 return finding;
             });
-            state.findings = [...state.findings.filter((finding) => finding.tenantId !== operator.tenantId), ...nextFindings];
+            state.findings = [
+                ...state.findings.filter((finding) => finding.tenantId !== operator.tenantId),
+                ...nextFindings,
+            ];
             this.assertStoreBounds(state);
             return { findings: nextFindings.length, resolved };
         });
@@ -165,18 +209,21 @@ export class LocalInventoryController {
         const proposal = validateRemediationProposal(input);
         const now = this.timestamp();
         return this.mutate((state) => {
-            const finding = state.findings.find((candidate) => candidate.tenantId === operator.tenantId && candidate.findingId === proposal.findingId);
+            const finding = state.findings.find((candidate) => candidate.tenantId === operator.tenantId &&
+                candidate.findingId === proposal.findingId);
             if (finding === undefined)
                 throw new InventoryError("Remediation finding was not found for the tenant.");
             if (finding.status === "resolved")
                 throw new InventoryError("Cannot propose remediation for a resolved finding.");
-            if (proposal.targetKind !== finding.targetKind || proposal.targetId !== finding.targetId)
+            if (proposal.targetKind !== finding.targetKind ||
+                proposal.targetId !== finding.targetId)
                 throw new InventoryError("Remediation target does not match the finding target.");
             this.assertRemediationTargetExists(state, operator.tenantId, proposal.targetKind, proposal.targetId);
             if (proposal.kind === "reduce_scope") {
                 if (proposal.targetKind !== "credential")
                     throw new InventoryError("reduce_scope remediation only supports credential targets.");
-                const credential = state.credentials.find((candidate) => candidate.tenantId === operator.tenantId && candidate.credentialId === proposal.targetId);
+                const credential = state.credentials.find((candidate) => candidate.tenantId === operator.tenantId &&
+                    candidate.credentialId === proposal.targetId);
                 if (credential === undefined)
                     throw new InventoryError("Remediation target credential does not exist.");
                 if (credential.status !== "active")
@@ -188,7 +235,9 @@ export class LocalInventoryController {
                 if (reduced.length >= credential.grantScopes.length)
                     throw new InventoryError("reduce_scope must remove at least one scope; permissions are never expanded.");
             }
-            if (proposal.kind === "create_eval" && this.evalScenarioExists !== undefined && !this.evalScenarioExists(proposal.evalScenarioId))
+            if (proposal.kind === "create_eval" &&
+                this.evalScenarioExists !== undefined &&
+                !this.evalScenarioExists(proposal.evalScenarioId))
                 throw new InventoryError("Eval scenario was not found for create_eval remediation.");
             if (state.remediations.length >= INVENTORY_LIMITS.maxRemediations)
                 throw new InventoryError("Remediation limit was reached.");
@@ -205,7 +254,11 @@ export class LocalInventoryController {
                 proposedBy: operator.principalId,
                 createdAt: now,
                 status: "proposed",
-                ...(proposal.ownerId === undefined && proposal.reducedScopes === undefined && proposal.evalScenarioId === undefined ? {} : { result: remediationResult(proposal, operator.principalId) })
+                ...(proposal.ownerId === undefined &&
+                    proposal.reducedScopes === undefined &&
+                    proposal.evalScenarioId === undefined
+                    ? {}
+                    : { result: remediationResult(proposal, operator.principalId) }),
             };
             state.remediations.push(record);
             this.assertStoreBounds(state);
@@ -217,7 +270,8 @@ export class LocalInventoryController {
         const now = this.timestamp();
         const safeRemediationId = safeIdentifier(remediationId, "Remediation id");
         return this.mutate((state) => {
-            const index = state.remediations.findIndex((candidate) => candidate.tenantId === operator.tenantId && candidate.remediationId === safeRemediationId);
+            const index = state.remediations.findIndex((candidate) => candidate.tenantId === operator.tenantId &&
+                candidate.remediationId === safeRemediationId);
             if (index === -1)
                 throw new InventoryError("Remediation was not found for the tenant.");
             const remediation = state.remediations[index];
@@ -226,9 +280,14 @@ export class LocalInventoryController {
             if (remediation.status === "rejected" || remediation.status === "expired")
                 throw new InventoryError(`Remediation is ${remediation.status} and cannot be applied.`);
             applyRemediationEffect(state, operator.tenantId, remediation, now);
-            const applied = { ...remediation, status: "applied", appliedAt: now };
+            const applied = {
+                ...remediation,
+                status: "applied",
+                appliedAt: now,
+            };
             state.remediations[index] = applied;
-            const finding = state.findings.find((candidate) => candidate.tenantId === operator.tenantId && candidate.findingId === remediation.findingId);
+            const finding = state.findings.find((candidate) => candidate.tenantId === operator.tenantId &&
+                candidate.findingId === remediation.findingId);
             if (finding !== undefined) {
                 finding.status = "resolved";
                 finding.resolvedAt = now;
@@ -240,10 +299,10 @@ export class LocalInventoryController {
     }
     async rejectRemediation(identityValue, remediationId) {
         const operator = await this.authorize(identityValue, "inventory.remediate");
-        const now = this.timestamp();
         const safeRemediationId = safeIdentifier(remediationId, "Remediation id");
         return this.mutate((state) => {
-            const index = state.remediations.findIndex((candidate) => candidate.tenantId === operator.tenantId && candidate.remediationId === safeRemediationId);
+            const index = state.remediations.findIndex((candidate) => candidate.tenantId === operator.tenantId &&
+                candidate.remediationId === safeRemediationId);
             if (index === -1)
                 throw new InventoryError("Remediation was not found for the tenant.");
             const remediation = state.remediations[index];
@@ -266,13 +325,22 @@ export class LocalInventoryController {
         const tenantId = operator.tenantId;
         const snapshot = snapshotFor(state, tenantId, now, this.freshnessDays);
         const scenarioRefs = state.remediations
-            .filter((remediation) => remediation.tenantId === tenantId && remediation.status === "applied" && remediation.kind === "create_eval" && remediation.result?.evalScenarioId !== undefined)
-            .map((remediation) => ({ evalScenarioId: remediation.result.evalScenarioId, forFindingId: remediation.findingId, createdBy: remediation.proposedBy }));
+            .filter((remediation) => remediation.tenantId === tenantId &&
+            remediation.status === "applied" &&
+            remediation.kind === "create_eval" &&
+            remediation.result?.evalScenarioId !== undefined)
+            .map((remediation) => ({
+            evalScenarioId: remediation.result.evalScenarioId,
+            forFindingId: remediation.findingId,
+            createdBy: remediation.proposedBy,
+        }));
         const normalized = normalizeFreshnessDays(this.freshnessDays);
         const evidenceMetadata = snapshot.agents.map((agent) => ({
             agentId: agent.agentId,
             lastEvidenceAt: agent.lastEvidenceAt,
-            status: agent.lastEvidenceAt === null ? "missing" : freshnessStatusFor(agent.lastEvidenceAt, now, normalized.evidenceFreshDays)
+            status: agent.lastEvidenceAt === null
+                ? "missing"
+                : freshnessStatusFor(agent.lastEvidenceAt, now, normalized.evidenceFreshDays),
         }));
         return {
             schemaVersion: 1,
@@ -284,7 +352,7 @@ export class LocalInventoryController {
             scenarioRefs,
             evidenceMetadata,
             removalAnalysis: computeRemovalAnalysis(state, tenantId, now, this.freshnessDays),
-            roi: computeRoiReport(state, tenantId, now, this.freshnessDays)
+            roi: computeRoiReport(state, tenantId, now, this.freshnessDays),
         };
     }
     async authorize(identity, permission) {
@@ -300,7 +368,8 @@ export class LocalInventoryController {
         return value.toISOString();
     }
     upsertSource(state, tenantId, payload, now) {
-        const existing = state.sources.find((source) => source.tenantId === tenantId && source.sourceId === payload.source.sourceId);
+        const existing = state.sources.find((source) => source.tenantId === tenantId &&
+            source.sourceId === payload.source.sourceId);
         if (existing === undefined) {
             if (state.sources.length >= INVENTORY_LIMITS.maxSources)
                 throw new InventoryError("Import source limit was reached.");
@@ -309,10 +378,12 @@ export class LocalInventoryController {
                 sourceId: payload.source.sourceId,
                 sourceType: payload.source.sourceType,
                 sourceName: payload.source.sourceName,
-                ...(payload.source.sourceVersion === undefined ? {} : { sourceVersion: payload.source.sourceVersion }),
+                ...(payload.source.sourceVersion === undefined
+                    ? {}
+                    : { sourceVersion: payload.source.sourceVersion }),
                 firstSeenAt: now,
                 lastSeenAt: now,
-                lastDigest: canonicalPayloadDigest(payload)
+                lastDigest: canonicalPayloadDigest(payload),
             });
         }
         else {
@@ -323,20 +394,40 @@ export class LocalInventoryController {
         }
     }
     assertRemediationTargetExists(state, tenantId, targetKind, targetId) {
-        const exists = targetKind === "agent" ? state.agents.some((record) => record.tenantId === tenantId && record.agentId === targetId)
-            : targetKind === "identity" ? state.identities.some((record) => record.tenantId === tenantId && record.identityId === targetId)
-                : targetKind === "tool" ? state.tools.some((record) => record.tenantId === tenantId && record.toolId === targetId)
-                    : targetKind === "provider" ? state.providers.some((record) => record.tenantId === tenantId && record.providerId === targetId)
-                        : targetKind === "resource" ? state.resources.some((record) => record.tenantId === tenantId && record.resourceId === targetId)
-                            : targetKind === "side_effect" ? state.sideEffects.some((record) => record.tenantId === tenantId && record.sideEffectId === targetId)
-                                : targetKind === "credential" ? state.credentials.some((record) => record.tenantId === tenantId && record.credentialId === targetId)
-                                    : targetKind === "environment" ? (state.agents.some((record) => record.tenantId === tenantId && record.environmentIds.includes(targetId)) ||
-                                        state.identities.some((record) => record.tenantId === tenantId && record.environmentIds.includes(targetId)) ||
-                                        state.providers.some((record) => record.tenantId === tenantId && record.environmentIds.includes(targetId)) ||
-                                        state.resources.some((record) => record.tenantId === tenantId && record.environmentIds.includes(targetId)) ||
-                                        state.credentials.some((record) => record.tenantId === tenantId && record.environmentIds.includes(targetId)) ||
-                                        state.policies.some((record) => record.tenantId === tenantId && record.environmentIds.includes(targetId)))
-                                        : targetKind === "policy" ? state.policies.some((record) => record.tenantId === tenantId && record.policyId === targetId)
+        const exists = targetKind === "agent"
+            ? state.agents.some((record) => record.tenantId === tenantId && record.agentId === targetId)
+            : targetKind === "identity"
+                ? state.identities.some((record) => record.tenantId === tenantId && record.identityId === targetId)
+                : targetKind === "tool"
+                    ? state.tools.some((record) => record.tenantId === tenantId && record.toolId === targetId)
+                    : targetKind === "provider"
+                        ? state.providers.some((record) => record.tenantId === tenantId &&
+                            record.providerId === targetId)
+                        : targetKind === "resource"
+                            ? state.resources.some((record) => record.tenantId === tenantId &&
+                                record.resourceId === targetId)
+                            : targetKind === "side_effect"
+                                ? state.sideEffects.some((record) => record.tenantId === tenantId &&
+                                    record.sideEffectId === targetId)
+                                : targetKind === "credential"
+                                    ? state.credentials.some((record) => record.tenantId === tenantId &&
+                                        record.credentialId === targetId)
+                                    : targetKind === "environment"
+                                        ? state.agents.some((record) => record.tenantId === tenantId &&
+                                            record.environmentIds.includes(targetId)) ||
+                                            state.identities.some((record) => record.tenantId === tenantId &&
+                                                record.environmentIds.includes(targetId)) ||
+                                            state.providers.some((record) => record.tenantId === tenantId &&
+                                                record.environmentIds.includes(targetId)) ||
+                                            state.resources.some((record) => record.tenantId === tenantId &&
+                                                record.environmentIds.includes(targetId)) ||
+                                            state.credentials.some((record) => record.tenantId === tenantId &&
+                                                record.environmentIds.includes(targetId)) ||
+                                            state.policies.some((record) => record.tenantId === tenantId &&
+                                                record.environmentIds.includes(targetId))
+                                        : targetKind === "policy"
+                                            ? state.policies.some((record) => record.tenantId === tenantId &&
+                                                record.policyId === targetId)
                                             : false;
         if (!exists)
             throw new InventoryError(`Remediation target ${targetKind} ${targetId} does not exist for the tenant.`);
@@ -350,21 +441,26 @@ export class LocalInventoryController {
     pruneStaleEdges(state, tenantId, now) {
         const normalized = normalizeFreshnessDays(this.freshnessDays);
         const staleBeforeMs = Date.parse(now) - normalized.edgeStaleDays * 24 * 60 * 60 * 1000;
-        state.edges = state.edges.filter((edge) => edge.tenantId !== tenantId || Date.parse(edge.lastSeenAt) >= staleBeforeMs);
+        state.edges = state.edges.filter((edge) => edge.tenantId !== tenantId ||
+            Date.parse(edge.lastSeenAt) >= staleBeforeMs);
     }
     rotateImportRuns(state, tenantId) {
         const tenantRuns = state.importRuns.filter((run) => run.tenantId === tenantId);
         if (tenantRuns.length <= INVENTORY_LIMITS.maxImports)
             return;
         const excess = tenantRuns.length - INVENTORY_LIMITS.maxImports;
-        const oldestRunIds = new Set([...tenantRuns].sort((a, b) => Date.parse(a.importedAt) - Date.parse(b.importedAt)).slice(0, excess).map((run) => run.runId));
+        const oldestRunIds = new Set([...tenantRuns]
+            .sort((a, b) => Date.parse(a.importedAt) - Date.parse(b.importedAt))
+            .slice(0, excess)
+            .map((run) => run.runId));
         state.importRuns = state.importRuns.filter((run) => !oldestRunIds.has(run.runId));
     }
     isRemediationEffective(state, tenantId, remediation) {
         if (remediation.kind === "reduce_scope") {
             if (remediation.targetKind !== "credential")
                 return false;
-            const credential = state.credentials.find((candidate) => candidate.tenantId === tenantId && candidate.credentialId === remediation.targetId);
+            const credential = state.credentials.find((candidate) => candidate.tenantId === tenantId &&
+                candidate.credentialId === remediation.targetId);
             const reduced = remediation.result?.reducedScopes;
             if (credential === undefined || reduced === undefined)
                 return false;
@@ -373,7 +469,8 @@ export class LocalInventoryController {
         if (remediation.kind === "revoke") {
             if (remediation.targetKind !== "credential")
                 return false;
-            const credential = state.credentials.find((candidate) => candidate.tenantId === tenantId && candidate.credentialId === remediation.targetId);
+            const credential = state.credentials.find((candidate) => candidate.tenantId === tenantId &&
+                candidate.credentialId === remediation.targetId);
             return credential !== undefined && credential.status === "revoked";
         }
         if (remediation.kind === "assign_owner") {
@@ -381,19 +478,23 @@ export class LocalInventoryController {
             if (ownerId === undefined)
                 return false;
             if (remediation.targetKind === "agent") {
-                const record = state.agents.find((candidate) => candidate.tenantId === tenantId && candidate.agentId === remediation.targetId);
+                const record = state.agents.find((candidate) => candidate.tenantId === tenantId &&
+                    candidate.agentId === remediation.targetId);
                 return record !== undefined && record.ownerId === ownerId;
             }
             if (remediation.targetKind === "provider") {
-                const record = state.providers.find((candidate) => candidate.tenantId === tenantId && candidate.providerId === remediation.targetId);
+                const record = state.providers.find((candidate) => candidate.tenantId === tenantId &&
+                    candidate.providerId === remediation.targetId);
                 return record !== undefined && record.ownerId === ownerId;
             }
             if (remediation.targetKind === "resource") {
-                const record = state.resources.find((candidate) => candidate.tenantId === tenantId && candidate.resourceId === remediation.targetId);
+                const record = state.resources.find((candidate) => candidate.tenantId === tenantId &&
+                    candidate.resourceId === remediation.targetId);
                 return record !== undefined && record.ownerId === ownerId;
             }
             if (remediation.targetKind === "credential") {
-                const record = state.credentials.find((candidate) => candidate.tenantId === tenantId && candidate.credentialId === remediation.targetId);
+                const record = state.credentials.find((candidate) => candidate.tenantId === tenantId &&
+                    candidate.credentialId === remediation.targetId);
                 return record !== undefined && record.ownerId === ownerId;
             }
             return false;
@@ -401,14 +502,17 @@ export class LocalInventoryController {
         if (remediation.kind === "onboard_through_gateway") {
             if (remediation.targetKind !== "agent")
                 return false;
-            const record = state.agents.find((candidate) => candidate.tenantId === tenantId && candidate.agentId === remediation.targetId);
+            const record = state.agents.find((candidate) => candidate.tenantId === tenantId &&
+                candidate.agentId === remediation.targetId);
             return record !== undefined && record.gatewayManaged === true;
         }
         if (remediation.kind === "create_eval") {
             const scenarioId = remediation.result?.evalScenarioId;
             if (scenarioId === undefined)
                 return false;
-            return this.evalScenarioExists === undefined ? true : this.evalScenarioExists(scenarioId);
+            return this.evalScenarioExists === undefined
+                ? true
+                : this.evalScenarioExists(scenarioId);
         }
         return false;
     }
@@ -444,41 +548,57 @@ export function createLocalInventoryController(options = {}) {
     return new LocalInventoryController(options);
 }
 export function createDisabledInventoryOperatorAuthorizer() {
-    return { async authenticate() { throw new InventoryError("Inventory operator authorization is not configured."); } };
+    return {
+        async authenticate() {
+            throw new InventoryError("Inventory operator authorization is not configured.");
+        },
+    };
 }
 export function createTestInventoryOperatorAuthorizer() {
     const issued = new WeakSet();
     return {
         authorizer: {
             async authenticate(identity) {
-                if (identity === null || typeof identity !== "object" || !issued.has(identity))
+                if (identity === null ||
+                    typeof identity !== "object" ||
+                    !issued.has(identity))
                     throw new InventoryError("Inventory operator identity is not authenticated.");
                 return validateOperator(identity);
-            }
+            },
         },
         issue(input) {
             const operator = Object.freeze(validateOperator(input));
             issued.add(operator);
             return operator;
-        }
+        },
     };
 }
 export function formatImportSummary(summary) {
     return `Inventory import ${summary.runId} at ${summary.importedAt} (digest ${summary.digest.slice(0, 16)}...) added ${summary.recordCounts.agents} agents, ${summary.recordCounts.tools} tools, ${summary.recordCounts.identities} identities, ${summary.recordCounts.providers} providers, ${summary.recordCounts.resources} resources, ${summary.recordCounts.sideEffects} side effects, ${summary.recordCounts.credentials} credentials, ${summary.recordCounts.policies} policies; edges created ${summary.edgesCreated}, refreshed ${summary.edgesRefreshed}.`;
 }
 export function formatAttackPathReport(report) {
-    const lines = [`Attack paths for agent ${report.agentId}: ${report.paths.length} path(s), ${report.incompletePaths} incomplete`];
+    const lines = [
+        `Attack paths for agent ${report.agentId}: ${report.paths.length} path(s), ${report.incompletePaths} incomplete`,
+    ];
     for (const path of report.paths) {
-        const chain = path.steps.map((step) => `${step.kind}:${step.id}`).join(" -> ");
-        const edgeNotes = path.edges.length === 0 ? " (no persisted edges)" : ` [edges ${path.edges.map((edge) => `${edge.sourceId}->${edge.targetId} (${edge.relation})`).join(", ")}]`;
+        const chain = path.steps
+            .map((step) => `${step.kind}:${step.id}`)
+            .join(" -> ");
+        const edgeNotes = path.edges.length === 0
+            ? " (no persisted edges)"
+            : ` [edges ${path.edges.map((edge) => `${edge.sourceId}->${edge.targetId} (${edge.relation})`).join(", ")}]`;
         lines.push(`  ${path.complete ? "complete" : "INCOMPLETE"} ${chain}${edgeNotes}`);
     }
     return lines.join("\n");
 }
 export function formatBlastRadiusReport(report) {
-    const lines = [`Blast radius for agent ${report.agentId}: ${report.resources.length} reachable resource(s), ${report.incompletePaths} incomplete path(s)`];
+    const lines = [
+        `Blast radius for agent ${report.agentId}: ${report.resources.length} reachable resource(s), ${report.incompletePaths} incomplete path(s)`,
+    ];
     for (const resource of report.resources) {
-        const effects = resource.sideEffects.map((sideEffect) => `${sideEffect.kind} (${sideEffect.severity})`).join(", ") || "none";
+        const effects = resource.sideEffects
+            .map((sideEffect) => `${sideEffect.kind} (${sideEffect.severity})`)
+            .join(", ") || "none";
         lines.push(`  resource ${resource.resourceId} via provider ${resource.providerId}: ${effects}${resource.sensitive ? " [sensitive]" : ""} (${resource.pathCount} complete path(s))`);
     }
     lines.push("  Rules:");
@@ -488,7 +608,9 @@ export function formatBlastRadiusReport(report) {
     return lines.join("\n");
 }
 export function formatRoiReport(report) {
-    const lines = [`ROI report for tenant ${report.tenantId} at ${report.generatedAt} (${report.basis})`];
+    const lines = [
+        `ROI report for tenant ${report.tenantId} at ${report.generatedAt} (${report.basis})`,
+    ];
     lines.push(`  Active agents: ${report.activeAgentCount}; production providers: ${report.productionProviderCount}`);
     lines.push(`  Incidents: prevented egress attempts ${report.incidents.preventedEgressAttempts}${report.incidents.preventedEgressSources.length === 0 ? " (not measured)" : ""}`);
     lines.push(`  Review time: ${report.incidents.reviewTimeMinutes === null ? "not measured" : `${report.incidents.reviewTimeMinutes} minutes`}`);
@@ -500,7 +622,9 @@ export function formatRoiReport(report) {
     return lines.join("\n");
 }
 export function formatRemovalAnalysis(report) {
-    const lines = [`Removal analysis for tenant ${report.tenantId} at ${report.generatedAt} (${report.basis})`];
+    const lines = [
+        `Removal analysis for tenant ${report.tenantId} at ${report.generatedAt} (${report.basis})`,
+    ];
     const coverage = report.coverage;
     lines.push(`  Coverage: policy ${coverage.policyCoverageBps} bps, evidence ${coverage.evidenceCoverageBps} bps, gateway ${coverage.gatewayCoverageBps} bps, kill switch ${coverage.killSwitchCoverageBps} bps`);
     lines.push(`  Direct credentials: ${coverage.directCredentials}; outside-gateway agents: ${coverage.outsideGatewayAgents}; unowned production: ${coverage.unownedProduction}`);
@@ -541,20 +665,28 @@ class ImportedRecords {
 function validateCrossReferences(state, tenantId, imported) {
     const has = (kind, id) => {
         if (kind === "agent")
-            return imported.agentIds.has(id) || state.agents.some((record) => record.tenantId === tenantId && record.agentId === id);
+            return (imported.agentIds.has(id) ||
+                state.agents.some((record) => record.tenantId === tenantId && record.agentId === id));
         if (kind === "tool")
-            return imported.toolIds.has(id) || state.tools.some((record) => record.tenantId === tenantId && record.toolId === id);
+            return (imported.toolIds.has(id) ||
+                state.tools.some((record) => record.tenantId === tenantId && record.toolId === id));
         if (kind === "identity")
-            return imported.identityIds.has(id) || state.identities.some((record) => record.tenantId === tenantId && record.identityId === id);
+            return (imported.identityIds.has(id) ||
+                state.identities.some((record) => record.tenantId === tenantId && record.identityId === id));
         if (kind === "provider")
-            return imported.providerIds.has(id) || state.providers.some((record) => record.tenantId === tenantId && record.providerId === id);
+            return (imported.providerIds.has(id) ||
+                state.providers.some((record) => record.tenantId === tenantId && record.providerId === id));
         if (kind === "resource")
-            return imported.resourceIds.has(id) || state.resources.some((record) => record.tenantId === tenantId && record.resourceId === id);
+            return (imported.resourceIds.has(id) ||
+                state.resources.some((record) => record.tenantId === tenantId && record.resourceId === id));
         if (kind === "side_effect")
-            return imported.sideEffectIds.has(id) || state.sideEffects.some((record) => record.tenantId === tenantId && record.sideEffectId === id);
+            return (imported.sideEffectIds.has(id) ||
+                state.sideEffects.some((record) => record.tenantId === tenantId && record.sideEffectId === id));
         if (kind === "credential")
-            return imported.credentialIds.has(id) || state.credentials.some((record) => record.tenantId === tenantId && record.credentialId === id);
-        return imported.policyIds.has(id) || state.policies.some((record) => record.tenantId === tenantId && record.policyId === id);
+            return (imported.credentialIds.has(id) ||
+                state.credentials.some((record) => record.tenantId === tenantId && record.credentialId === id));
+        return (imported.policyIds.has(id) ||
+            state.policies.some((record) => record.tenantId === tenantId && record.policyId === id));
     };
     for (const agent of importedAgents(state, tenantId)) {
         for (const identityId of agent.identityIds)
@@ -596,25 +728,62 @@ function validateCrossReferences(state, tenantId, imported) {
     }
 }
 function importedAgents(state, tenantId) {
-    return state.agents.filter((record) => record.tenantId === tenantId).map((record) => ({ agentId: record.agentId, identityIds: record.identityIds }));
+    return state.agents
+        .filter((record) => record.tenantId === tenantId)
+        .map((record) => ({
+        agentId: record.agentId,
+        identityIds: record.identityIds,
+    }));
 }
 function importedIdentities(state, tenantId) {
-    return state.identities.filter((record) => record.tenantId === tenantId).map((record) => ({ identityId: record.identityId, toolIds: record.toolIds }));
+    return state.identities
+        .filter((record) => record.tenantId === tenantId)
+        .map((record) => ({
+        identityId: record.identityId,
+        toolIds: record.toolIds,
+    }));
 }
 function importedTools(state, tenantId) {
-    return state.tools.filter((record) => record.tenantId === tenantId).map((record) => ({ toolId: record.toolId, providerId: record.providerId, credentialIds: record.credentialIds }));
+    return state.tools
+        .filter((record) => record.tenantId === tenantId)
+        .map((record) => ({
+        toolId: record.toolId,
+        providerId: record.providerId,
+        credentialIds: record.credentialIds,
+    }));
 }
 function importedProviders(state, tenantId) {
-    return state.providers.filter((record) => record.tenantId === tenantId).map((record) => ({ providerId: record.providerId, resourceIds: record.resourceIds }));
+    return state.providers
+        .filter((record) => record.tenantId === tenantId)
+        .map((record) => ({
+        providerId: record.providerId,
+        resourceIds: record.resourceIds,
+    }));
 }
 function importedResources(state, tenantId) {
-    return state.resources.filter((record) => record.tenantId === tenantId).map((record) => ({ resourceId: record.resourceId, sideEffectIds: record.sideEffectIds }));
+    return state.resources
+        .filter((record) => record.tenantId === tenantId)
+        .map((record) => ({
+        resourceId: record.resourceId,
+        sideEffectIds: record.sideEffectIds,
+    }));
 }
 function importedSideEffects(state, tenantId) {
-    return state.sideEffects.filter((record) => record.tenantId === tenantId).map((record) => ({ sideEffectId: record.sideEffectId, resourceId: record.resourceId }));
+    return state.sideEffects
+        .filter((record) => record.tenantId === tenantId)
+        .map((record) => ({
+        sideEffectId: record.sideEffectId,
+        resourceId: record.resourceId,
+    }));
 }
 function importedCredentials(state, tenantId) {
-    return state.credentials.filter((record) => record.tenantId === tenantId).map((record) => ({ credentialId: record.credentialId, providerId: record.providerId, toolIds: record.toolIds }));
+    return state.credentials
+        .filter((record) => record.tenantId === tenantId)
+        .map((record) => ({
+        credentialId: record.credentialId,
+        providerId: record.providerId,
+        toolIds: record.toolIds,
+    }));
 }
 function upsertAgent(state, tenantId, input, payload, importedBy, now) {
     const record = {
@@ -624,7 +793,9 @@ function upsertAgent(state, tenantId, input, payload, importedBy, now) {
         agentId: input.agentId,
         name: input.name,
         ownerId: input.ownerId === undefined ? null : input.ownerId,
-        ...(input.businessPurpose === undefined ? {} : { businessPurpose: input.businessPurpose }),
+        ...(input.businessPurpose === undefined
+            ? {}
+            : { businessPurpose: input.businessPurpose }),
         ...(input.model === undefined ? {} : { model: input.model }),
         ...(input.runtime === undefined ? {} : { runtime: input.runtime }),
         ...(input.version === undefined ? {} : { version: input.version }),
@@ -632,7 +803,7 @@ function upsertAgent(state, tenantId, input, payload, importedBy, now) {
         environmentIds: input.environmentIds,
         gatewayManaged: input.gatewayManaged,
         killSwitchEnabled: input.killSwitchEnabled,
-        lastEvidenceAt: input.lastEvidenceAt === undefined ? null : input.lastEvidenceAt
+        lastEvidenceAt: input.lastEvidenceAt === undefined ? null : input.lastEvidenceAt,
     };
     merge(state, "agent", input.agentId, tenantId, record, payload.source, importedBy, now);
 }
@@ -645,7 +816,7 @@ function upsertTool(state, tenantId, input, payload, importedBy, now) {
         kind: input.kind,
         providerId: input.providerId === undefined ? null : input.providerId,
         requiredScopes: input.requiredScopes,
-        credentialIds: input.credentialIds
+        credentialIds: input.credentialIds,
     };
     merge(state, "tool", input.toolId, tenantId, record, payload.source, importedBy, now);
 }
@@ -660,7 +831,7 @@ function upsertIdentity(state, tenantId, input, payload, importedBy, now) {
         agentId: input.agentId === undefined ? null : input.agentId,
         toolIds: input.toolIds,
         environmentIds: input.environmentIds,
-        scopes: input.scopes
+        scopes: input.scopes,
     };
     merge(state, "identity", input.identityId, tenantId, record, payload.source, importedBy, now);
 }
@@ -676,7 +847,7 @@ function upsertProvider(state, tenantId, input, payload, importedBy, now) {
         environmentIds: input.environmentIds,
         resourceIds: input.resourceIds,
         gatewayBound: input.gatewayBound,
-        killSwitchApplied: input.killSwitchApplied
+        killSwitchApplied: input.killSwitchApplied,
     };
     merge(state, "provider", input.providerId, tenantId, record, payload.source, importedBy, now);
 }
@@ -692,8 +863,10 @@ function upsertResource(state, tenantId, input, payload, importedBy, now) {
         environmentIds: input.environmentIds,
         sensitive: input.sensitive,
         ownerId: input.ownerId === undefined ? null : input.ownerId,
-        ...(input.businessPurpose === undefined ? {} : { businessPurpose: input.businessPurpose }),
-        sideEffectIds: input.sideEffectIds
+        ...(input.businessPurpose === undefined
+            ? {}
+            : { businessPurpose: input.businessPurpose }),
+        sideEffectIds: input.sideEffectIds,
     };
     merge(state, "resource", input.resourceId, tenantId, record, payload.source, importedBy, now);
 }
@@ -704,7 +877,7 @@ function upsertSideEffect(state, tenantId, input, payload, importedBy, now) {
         sideEffectId: input.sideEffectId,
         resourceId: input.resourceId,
         kind: input.kind,
-        severity: input.severity
+        severity: input.severity,
     };
     merge(state, "side_effect", input.sideEffectId, tenantId, record, payload.source, importedBy, now);
 }
@@ -724,7 +897,7 @@ function upsertCredential(state, tenantId, input, payload, importedBy, now) {
         issuedAt: input.issuedAt,
         lastUsedAt: input.lastUsedAt === undefined ? null : input.lastUsedAt,
         ...(input.rotatedAt === undefined ? {} : { rotatedAt: input.rotatedAt }),
-        gatewayBound: input.gatewayBound
+        gatewayBound: input.gatewayBound,
     };
     merge(state, "credential", input.credentialId, tenantId, record, payload.source, importedBy, now);
 }
@@ -737,7 +910,7 @@ function upsertPolicy(state, tenantId, input, payload, importedBy, now) {
         name: input.name,
         version: input.version,
         hash: input.hash,
-        environmentIds: input.environmentIds
+        environmentIds: input.environmentIds,
     };
     merge(state, "policy", input.policyId, tenantId, record, payload.source, importedBy, now);
 }
@@ -754,7 +927,10 @@ function merge(state, kind, id, tenantId, record, source, importedBy, now) {
     }
     else {
         const prior = list[index];
-        const mergedFreshness = { firstSeenAt: prior.freshness?.firstSeenAt ?? now, lastSeenAt: now };
+        const mergedFreshness = {
+            firstSeenAt: prior.freshness?.firstSeenAt ?? now,
+            lastSeenAt: now,
+        };
         list[index] = { ...stored, freshness: mergedFreshness, provenance };
     }
 }
@@ -823,11 +999,22 @@ function upsertEdges(state, tenantId, upserted, payload, importedBy, now, before
         const edgeId = edgeIdFor(sourceKind, sourceId, targetKind, targetId, relation);
         const prior = before.get(edgeId);
         if (prior === undefined) {
-            state.edges.push({ tenantId, edgeId, sourceKind, sourceId, targetKind, targetId, relation, provenance, firstSeenAt: now, lastSeenAt: now });
+            state.edges.push({
+                tenantId,
+                edgeId,
+                sourceKind,
+                sourceId,
+                targetKind,
+                targetId,
+                relation,
+                provenance,
+                firstSeenAt: now,
+                lastSeenAt: now,
+            });
             edgesCreated += 1;
         }
         else {
-            state.edges = state.edges.map((edge) => (edge.edgeId === edgeId ? { ...edge, lastSeenAt: now } : edge));
+            state.edges = state.edges.map((edge) => edge.edgeId === edgeId ? { ...edge, lastSeenAt: now } : edge);
             edgesRefreshed += 1;
         }
     };
@@ -870,7 +1057,20 @@ function upsertEdges(state, tenantId, upserted, payload, importedBy, now, before
                 apply("resource", resource.resourceId, "side_effect", sideEffectId, "permits");
         }
     }
-    return { recordCounts: { agents: 0, tools: 0, identities: 0, providers: 0, resources: 0, sideEffects: 0, credentials: 0, policies: 0 }, edgesCreated, edgesRefreshed };
+    return {
+        recordCounts: {
+            agents: 0,
+            tools: 0,
+            identities: 0,
+            providers: 0,
+            resources: 0,
+            sideEffects: 0,
+            credentials: 0,
+            policies: 0,
+        },
+        edgesCreated,
+        edgesRefreshed,
+    };
 }
 function snapshotFor(state, tenantId, now, freshnessDays) {
     return {
@@ -889,7 +1089,7 @@ function snapshotFor(state, tenantId, now, freshnessDays) {
         findings: clone(state.findings.filter((record) => record.tenantId === tenantId)),
         remediations: clone(state.remediations.filter((record) => record.tenantId === tenantId)),
         sources: clone(state.sources.filter((record) => record.tenantId === tenantId)),
-        importRuns: clone(state.importRuns.filter((record) => record.tenantId === tenantId))
+        importRuns: clone(state.importRuns.filter((record) => record.tenantId === tenantId)),
     };
 }
 function applyRemediationEffect(state, tenantId, remediation, now) {
@@ -898,25 +1098,29 @@ function applyRemediationEffect(state, tenantId, remediation, now) {
         if (result === undefined || result.ownerId === undefined)
             throw new InventoryError("assign_owner remediation requires an owner id.");
         if (remediation.targetKind === "agent") {
-            const record = state.agents.find((candidate) => candidate.tenantId === tenantId && candidate.agentId === remediation.targetId);
+            const record = state.agents.find((candidate) => candidate.tenantId === tenantId &&
+                candidate.agentId === remediation.targetId);
             if (record === undefined)
                 throw new InventoryError("Remediation target agent does not exist.");
             record.ownerId = result.ownerId;
         }
         else if (remediation.targetKind === "provider") {
-            const record = state.providers.find((candidate) => candidate.tenantId === tenantId && candidate.providerId === remediation.targetId);
+            const record = state.providers.find((candidate) => candidate.tenantId === tenantId &&
+                candidate.providerId === remediation.targetId);
             if (record === undefined)
                 throw new InventoryError("Remediation target provider does not exist.");
             record.ownerId = result.ownerId;
         }
         else if (remediation.targetKind === "resource") {
-            const record = state.resources.find((candidate) => candidate.tenantId === tenantId && candidate.resourceId === remediation.targetId);
+            const record = state.resources.find((candidate) => candidate.tenantId === tenantId &&
+                candidate.resourceId === remediation.targetId);
             if (record === undefined)
                 throw new InventoryError("Remediation target resource does not exist.");
             record.ownerId = result.ownerId;
         }
         else if (remediation.targetKind === "credential") {
-            const record = state.credentials.find((candidate) => candidate.tenantId === tenantId && candidate.credentialId === remediation.targetId);
+            const record = state.credentials.find((candidate) => candidate.tenantId === tenantId &&
+                candidate.credentialId === remediation.targetId);
             if (record === undefined)
                 throw new InventoryError("Remediation target credential does not exist.");
             record.ownerId = result.ownerId;
@@ -930,7 +1134,8 @@ function applyRemediationEffect(state, tenantId, remediation, now) {
             throw new InventoryError("reduce_scope remediation only supports credential targets.");
         if (result === undefined || result.reducedScopes === undefined)
             throw new InventoryError("reduce_scope remediation requires the reduced scope list.");
-        const record = state.credentials.find((candidate) => candidate.tenantId === tenantId && candidate.credentialId === remediation.targetId);
+        const record = state.credentials.find((candidate) => candidate.tenantId === tenantId &&
+            candidate.credentialId === remediation.targetId);
         if (record === undefined)
             throw new InventoryError("Remediation target credential does not exist.");
         if (record.status !== "active")
@@ -947,7 +1152,8 @@ function applyRemediationEffect(state, tenantId, remediation, now) {
     else if (remediation.kind === "revoke") {
         if (remediation.targetKind !== "credential")
             throw new InventoryError("revoke remediation only supports credential targets.");
-        const record = state.credentials.find((candidate) => candidate.tenantId === tenantId && candidate.credentialId === remediation.targetId);
+        const record = state.credentials.find((candidate) => candidate.tenantId === tenantId &&
+            candidate.credentialId === remediation.targetId);
         if (record === undefined)
             throw new InventoryError("Remediation target credential does not exist.");
         record.status = "revoked";
@@ -955,7 +1161,8 @@ function applyRemediationEffect(state, tenantId, remediation, now) {
     else if (remediation.kind === "onboard_through_gateway") {
         if (remediation.targetKind !== "agent")
             throw new InventoryError("onboard_through_gateway remediation only supports agent targets.");
-        const record = state.agents.find((candidate) => candidate.tenantId === tenantId && candidate.agentId === remediation.targetId);
+        const record = state.agents.find((candidate) => candidate.tenantId === tenantId &&
+            candidate.agentId === remediation.targetId);
         if (record === undefined)
             throw new InventoryError("Remediation target agent does not exist.");
         record.gatewayManaged = true;
@@ -966,7 +1173,8 @@ function applyRemediationEffect(state, tenantId, remediation, now) {
             throw new InventoryError("create_eval remediation only supports agent targets.");
         if (result === undefined || result.evalScenarioId === undefined)
             throw new InventoryError("create_eval remediation requires an eval scenario id.");
-        if (!state.agents.some((record) => record.tenantId === tenantId && record.agentId === remediation.targetId))
+        if (!state.agents.some((record) => record.tenantId === tenantId &&
+            record.agentId === remediation.targetId))
             throw new InventoryError("Remediation target agent does not exist.");
     }
 }
@@ -974,25 +1182,54 @@ function remediationResult(proposal, proposedBy) {
     return {
         description: `Proposed by ${proposedBy}`,
         ...(proposal.ownerId === undefined ? {} : { ownerId: proposal.ownerId }),
-        ...(proposal.reducedScopes === undefined ? {} : { reducedScopes: proposal.reducedScopes }),
-        ...(proposal.evalScenarioId === undefined ? {} : { evalScenarioId: proposal.evalScenarioId })
+        ...(proposal.reducedScopes === undefined
+            ? {}
+            : { reducedScopes: proposal.reducedScopes }),
+        ...(proposal.evalScenarioId === undefined
+            ? {}
+            : { evalScenarioId: proposal.evalScenarioId }),
     };
 }
 function validateRemediationProposal(value) {
     const proposal = object(value, "Remediation proposal must be an object.");
-    exactKeys(proposal, ["findingId", "kind", "targetKind", "targetId", "rationale", "ownerId", "reducedScopes", "evalScenarioId"], "remediation proposal", ["ownerId", "reducedScopes", "evalScenarioId"]);
+    exactKeys(proposal, [
+        "findingId",
+        "kind",
+        "targetKind",
+        "targetId",
+        "rationale",
+        "ownerId",
+        "reducedScopes",
+        "evalScenarioId",
+    ], "remediation proposal", ["ownerId", "reducedScopes", "evalScenarioId"]);
     const kind = proposal.kind;
-    if (!["assign_owner", "reduce_scope", "revoke", "onboard_through_gateway", "create_eval"].includes(kind))
+    if (![
+        "assign_owner",
+        "reduce_scope",
+        "revoke",
+        "onboard_through_gateway",
+        "create_eval",
+    ].includes(kind))
         throw new InventoryError("Remediation kind is invalid.");
     const targetKind = proposal.targetKind;
-    if (!["agent", "identity", "tool", "provider", "resource", "side_effect", "credential", "environment", "policy"].includes(targetKind))
+    if (![
+        "agent",
+        "identity",
+        "tool",
+        "provider",
+        "resource",
+        "side_effect",
+        "credential",
+        "environment",
+        "policy",
+    ].includes(targetKind))
         throw new InventoryError("Remediation target kind is invalid.");
     const result = {
         findingId: safeIdentifier(proposal.findingId, "Remediation finding id"),
         kind: kind,
         targetKind: targetKind,
         targetId: safeIdentifier(proposal.targetId, "Remediation target id"),
-        rationale: safeText(proposal.rationale, "Remediation rationale", 400)
+        rationale: safeText(proposal.rationale, "Remediation rationale", 400),
     };
     if (proposal.ownerId !== undefined)
         result.ownerId = safeIdentifier(proposal.ownerId, "Remediation owner id");
@@ -1009,21 +1246,30 @@ function validateRemediationProposal(value) {
     return result;
 }
 function safeIdentifier(value, label) {
-    if (typeof value !== "string" || !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(value) || sanitizeSecretString(value) !== value)
+    if (typeof value !== "string" ||
+        !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(value) ||
+        sanitizeSecretString(value) !== value)
         throw new InventoryError(`${label} must be a safe identifier.`);
     return value;
 }
 function safeScopes(value, label) {
-    if (!Array.isArray(value) || value.length > INVENTORY_LIMITS.maxScopesPerRecord)
+    if (!Array.isArray(value) ||
+        value.length > INVENTORY_LIMITS.maxScopesPerRecord)
         throw new InventoryError(`${label} is invalid.`);
     return value.map((entry) => {
-        if (typeof entry !== "string" || !/^[a-z0-9][a-z0-9._:\-]{0,127}$/.test(entry) || sanitizeSecretString(entry) !== entry)
+        if (typeof entry !== "string" ||
+            !/^[a-z0-9][a-z0-9._:\-]{0,127}$/.test(entry) ||
+            sanitizeSecretString(entry) !== entry)
             throw new InventoryError(`${label} must be safe scope identifiers.`);
         return entry;
     });
 }
 function safeText(value, label, max) {
-    if (typeof value !== "string" || value.trim() === "" || value.length > max || /[\u0000-\u001f]/.test(value) || sanitizeSecretString(value) !== value)
+    if (typeof value !== "string" ||
+        value.trim() === "" ||
+        value.length > max ||
+        /[\u0000-\u001f]/.test(value) ||
+        sanitizeSecretString(value) !== value)
         throw new InventoryError(`${label} is invalid.`);
     return value.trim();
 }
@@ -1034,7 +1280,8 @@ function object(value, message) {
 }
 function exactKeys(value, keys, label, optional = []) {
     for (const key of Object.keys(value)) {
-        if (!keys.includes(key) || (value[key] === undefined && !optional.includes(key)))
+        if (!keys.includes(key) ||
+            (value[key] === undefined && !optional.includes(key)))
             throw new InventoryError(`${label} contains unsupported field: ${key}`);
     }
 }