@yiaany/ghostapi 0.1.8 → 0.2.0

package/dist/inventory/types.js

@@ -2,13 +2,42 @@ import { createHash } from "node:crypto";
 import { sanitizeSecretString } from "../security/secrets.js";
 export const INVENTORY_SCHEMA_VERSION = 1;
 export const INVENTORY_KIND = "ghostapi.inventory";
-export const IMPORT_SOURCE_TYPES = ["config", "ci", "gateway", "cloud"];
+export const IMPORT_SOURCE_TYPES = [
+    "config",
+    "ci",
+    "gateway",
+    "cloud",
+];
 export const TOOL_KINDS = ["mcp_server", "sdk_client", "http_client"];
 export const IDENTITY_ROLES = ["service_account", "user", "workload"];
-export const SIDE_EFFECT_KINDS = ["read", "create", "update", "communicate", "money_movement", "delete", "permission_change", "deployment"];
+export const SIDE_EFFECT_KINDS = [
+    "read",
+    "create",
+    "update",
+    "communicate",
+    "money_movement",
+    "delete",
+    "permission_change",
+    "deployment",
+];
 export const IMPACT_SEVERITIES = ["low", "medium", "high", "critical"];
-export const EDGE_RELATIONS = ["owns", "uses", "connects", "exposes", "permits", "requires"];
-export const NODE_KINDS = ["agent", "identity", "tool", "provider", "resource", "side_effect", "credential"];
+export const EDGE_RELATIONS = [
+    "owns",
+    "uses",
+    "connects",
+    "exposes",
+    "permits",
+    "requires",
+];
+export const NODE_KINDS = [
+    "agent",
+    "identity",
+    "tool",
+    "provider",
+    "resource",
+    "side_effect",
+    "credential",
+];
 export const FINDING_KINDS = [
     "orphaned_agents",
     "stale_unused_credentials",
@@ -17,13 +46,33 @@ export const FINDING_KINDS = [
     "agents_outside_gateway",
     "missing_kill_switch",
     "missing_evidence",
-    "policy_drift"
+    "policy_drift",
 ];
 export const FINDING_BASIS = ["evidence", "heuristic"];
-export const FINDING_SEVERITIES = ["critical", "high", "medium", "low"];
-export const REMEDIATION_KINDS = ["assign_owner", "reduce_scope", "revoke", "onboard_through_gateway", "create_eval"];
-export const REMEDIATION_STATUSES = ["proposed", "applied", "rejected", "expired"];
-export const FRESHNESS_DEFAULT_DAYS = { edgeStale: 90, credentialStale: 90, evidenceFresh: 30 };
+export const FINDING_SEVERITIES = [
+    "critical",
+    "high",
+    "medium",
+    "low",
+];
+export const REMEDIATION_KINDS = [
+    "assign_owner",
+    "reduce_scope",
+    "revoke",
+    "onboard_through_gateway",
+    "create_eval",
+];
+export const REMEDIATION_STATUSES = [
+    "proposed",
+    "applied",
+    "rejected",
+    "expired",
+];
+export const FRESHNESS_DEFAULT_DAYS = {
+    edgeStale: 90,
+    credentialStale: 90,
+    evidenceFresh: 30,
+};
 const IDENTIFIER = /^[a-z0-9][a-z0-9._-]{0,127}$/;
 const SCOPE_IDENTIFIER = /^[a-z0-9][a-z0-9._:\-]{0,127}$/;
 const HASH = /^[a-f0-9]{64}$/;
@@ -45,7 +94,7 @@ export const INVENTORY_LIMITS = {
     maxRemediations: 1000,
     maxReferencesPerRecord: 64,
     maxScopesPerRecord: 32,
-    maxCounters: 3
+    maxCounters: 3,
 };
 export class InventoryError extends Error {
     constructor(message) {
@@ -69,7 +118,7 @@ export function emptyInventoryState() {
         policies: [],
         edges: [],
         findings: [],
-        remediations: []
+        remediations: [],
     };
 }
 export function sha256Digest(value) {
@@ -82,30 +131,74 @@ export function sortedKeysReplacer(_key, value) {
     if (Array.isArray(value))
         return value;
     if (value !== null && typeof value === "object") {
-        return Object.fromEntries(Object.entries(value).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
+        return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0));
     }
     return value;
 }
 export function validateImportPayload(value) {
     const payload = object(value, "Inventory import must be an object.");
-    exactKeys(payload, ["schemaVersion", "kind", "source", "expectedPolicyHashes", "counters", "agents", "tools", "identities", "providers", "resources", "sideEffects", "credentials", "policies"], "inventory import", [
-        "expectedPolicyHashes", "counters", "agents", "tools", "identities", "providers", "resources", "sideEffects", "credentials", "policies"
+    exactKeys(payload, [
+        "schemaVersion",
+        "kind",
+        "source",
+        "expectedPolicyHashes",
+        "counters",
+        "agents",
+        "tools",
+        "identities",
+        "providers",
+        "resources",
+        "sideEffects",
+        "credentials",
+        "policies",
+    ], "inventory import", [
+        "expectedPolicyHashes",
+        "counters",
+        "agents",
+        "tools",
+        "identities",
+        "providers",
+        "resources",
+        "sideEffects",
+        "credentials",
+        "policies",
     ]);
-    if (payload.schemaVersion !== INVENTORY_SCHEMA_VERSION || payload.kind !== "ghostapi.inventory-import")
+    if (payload.schemaVersion !== INVENTORY_SCHEMA_VERSION ||
+        payload.kind !== "ghostapi.inventory-import")
         throw new InventoryError("Unsupported inventory import schema.");
     const source = validateImportSource(payload.source);
     if (source.sourceType === "config" && payload.counters !== undefined)
         throw new InventoryError("Counters are only allowed for ci, gateway, or cloud imports.");
-    const expectedPolicyHashes = payload.expectedPolicyHashes === undefined ? [] : array(payload.expectedPolicyHashes, "expected policy hashes", 64).map(validateExpectedPolicyHash);
-    const counters = payload.counters === undefined ? undefined : validateCounters(payload.counters);
-    const agents = payload.agents === undefined ? [] : array(payload.agents, "agents", 200).map(validateImportedAgent);
-    const tools = payload.tools === undefined ? [] : array(payload.tools, "tools", 200).map(validateImportedTool);
-    const identities = payload.identities === undefined ? [] : array(payload.identities, "identities", 200).map(validateImportedIdentity);
-    const providers = payload.providers === undefined ? [] : array(payload.providers, "providers", 100).map(validateImportedProvider);
-    const resources = payload.resources === undefined ? [] : array(payload.resources, "resources", 300).map(validateImportedResource);
-    const sideEffects = payload.sideEffects === undefined ? [] : array(payload.sideEffects, "side effects", 400).map(validateImportedSideEffect);
-    const credentials = payload.credentials === undefined ? [] : array(payload.credentials, "credentials", 200).map(validateImportedCredential);
-    const policies = payload.policies === undefined ? [] : array(payload.policies, "policies", 50).map(validateImportedPolicy);
+    const expectedPolicyHashes = payload.expectedPolicyHashes === undefined
+        ? []
+        : array(payload.expectedPolicyHashes, "expected policy hashes", 64).map(validateExpectedPolicyHash);
+    const counters = payload.counters === undefined
+        ? undefined
+        : validateCounters(payload.counters);
+    const agents = payload.agents === undefined
+        ? []
+        : array(payload.agents, "agents", 200).map(validateImportedAgent);
+    const tools = payload.tools === undefined
+        ? []
+        : array(payload.tools, "tools", 200).map(validateImportedTool);
+    const identities = payload.identities === undefined
+        ? []
+        : array(payload.identities, "identities", 200).map(validateImportedIdentity);
+    const providers = payload.providers === undefined
+        ? []
+        : array(payload.providers, "providers", 100).map(validateImportedProvider);
+    const resources = payload.resources === undefined
+        ? []
+        : array(payload.resources, "resources", 300).map(validateImportedResource);
+    const sideEffects = payload.sideEffects === undefined
+        ? []
+        : array(payload.sideEffects, "side effects", 400).map(validateImportedSideEffect);
+    const credentials = payload.credentials === undefined
+        ? []
+        : array(payload.credentials, "credentials", 200).map(validateImportedCredential);
+    const policies = payload.policies === undefined
+        ? []
+        : array(payload.policies, "policies", 50).map(validateImportedPolicy);
     unique(agents.map((agent) => agent.agentId), "agent ids");
     unique(tools.map((tool) => tool.toolId), "tool ids");
     unique(identities.map((identity) => identity.identityId), "identity ids");
@@ -127,13 +220,30 @@ export function validateImportPayload(value) {
         resources,
         sideEffects,
         credentials,
-        policies
+        policies,
     };
 }
 export function validateState(value) {
     const state = object(value, "Inventory store must be an object.");
-    exactKeys(state, ["schemaVersion", "kind", "sources", "importRuns", "agents", "tools", "identities", "providers", "resources", "sideEffects", "credentials", "policies", "edges", "findings", "remediations"], "inventory store");
-    if (state.schemaVersion !== INVENTORY_SCHEMA_VERSION || state.kind !== INVENTORY_KIND)
+    exactKeys(state, [
+        "schemaVersion",
+        "kind",
+        "sources",
+        "importRuns",
+        "agents",
+        "tools",
+        "identities",
+        "providers",
+        "resources",
+        "sideEffects",
+        "credentials",
+        "policies",
+        "edges",
+        "findings",
+        "remediations",
+    ], "inventory store");
+    if (state.schemaVersion !== INVENTORY_SCHEMA_VERSION ||
+        state.kind !== INVENTORY_KIND)
         throw new InventoryError("Unsupported inventory store schema.");
     const sources = array(state.sources, "import sources", INVENTORY_LIMITS.maxSources).map(validateSourceRecord);
     const importRuns = array(state.importRuns, "import runs", INVENTORY_LIMITS.maxImports).map(validateImportRunRecord);
@@ -148,7 +258,23 @@ export function validateState(value) {
     const edges = array(state.edges, "graph edges", INVENTORY_LIMITS.maxEdges).map(validateEdge);
     const findings = array(state.findings, "findings", INVENTORY_LIMITS.maxFindings).map(validateFindingRecord);
     const remediations = array(state.remediations, "remediations", INVENTORY_LIMITS.maxRemediations).map(validateRemediationRecord);
-    return { schemaVersion: 1, kind: "ghostapi.inventory", sources, importRuns, agents, tools, identities, providers, resources, sideEffects, credentials, policies, edges, findings, remediations };
+    return {
+        schemaVersion: 1,
+        kind: "ghostapi.inventory",
+        sources,
+        importRuns,
+        agents,
+        tools,
+        identities,
+        providers,
+        resources,
+        sideEffects,
+        credentials,
+        policies,
+        edges,
+        findings,
+        remediations,
+    };
 }
 export function clone(value) {
     return structuredClone(value);
@@ -166,7 +292,7 @@ export function validateOperator(value) {
         id: identifier(operator.id, "Inventory operator id"),
         principalId: identifier(operator.principalId, "Inventory operator principal id"),
         tenantId: identifier(operator.tenantId, "Inventory operator tenant id"),
-        permissions
+        permissions,
     };
 }
 export function validateFindingsAndRemediations(value) {
@@ -174,11 +300,15 @@ export function validateFindingsAndRemediations(value) {
     exactKeys(box, ["findings", "remediations"], "inventory findings box");
     return {
         findings: array(box.findings, "findings", INVENTORY_LIMITS.maxFindings).map(validateFindingRecord),
-        remediations: array(box.remediations, "remediations", INVENTORY_LIMITS.maxRemediations).map(validateRemediationRecord)
+        remediations: array(box.remediations, "remediations", INVENTORY_LIMITS.maxRemediations).map(validateRemediationRecord),
     };
 }
 function isInventoryPermission(value) {
-    return value === "inventory.import" || value === "inventory.inspect" || value === "inventory.analyze" || value === "inventory.remediate" || value === "inventory.export";
+    return (value === "inventory.import" ||
+        value === "inventory.inspect" ||
+        value === "inventory.analyze" ||
+        value === "inventory.remediate" ||
+        value === "inventory.export");
 }
 function validateImportSource(value) {
     const source = object(value, "Inventory import source is invalid.");
@@ -190,19 +320,34 @@ function validateImportSource(value) {
         sourceId: identifier(source.sourceId, "Import source id"),
         sourceType: sourceType,
         sourceName: text(source.sourceName, "Import source name", 120),
-        ...(source.sourceVersion === undefined ? {} : { sourceVersion: text(source.sourceVersion, "Import source version", 64) })
+        ...(source.sourceVersion === undefined
+            ? {}
+            : {
+                sourceVersion: text(source.sourceVersion, "Import source version", 64),
+            }),
     };
 }
 function validateExpectedPolicyHash(value) {
     const expected = object(value, "Expected policy hash is invalid.");
     exactKeys(expected, ["environmentId", "policyHash"], "expected policy hash");
-    return { environmentId: identifier(expected.environmentId, "Environment id"), policyHash: hash(expected.policyHash, "Policy hash") };
+    return {
+        environmentId: identifier(expected.environmentId, "Environment id"),
+        policyHash: hash(expected.policyHash, "Policy hash"),
+    };
 }
 function validateCounters(value) {
     const counters = object(value, "Import counters are invalid.");
-    exactKeys(counters, ["preventedEgressAttempts", "reviewTimeMinutes", "meanTimeToContainMinutes"], "import counters");
+    exactKeys(counters, [
+        "preventedEgressAttempts",
+        "reviewTimeMinutes",
+        "meanTimeToContainMinutes",
+    ], "import counters");
     const result = {};
-    for (const key of ["preventedEgressAttempts", "reviewTimeMinutes", "meanTimeToContainMinutes"]) {
+    for (const key of [
+        "preventedEgressAttempts",
+        "reviewTimeMinutes",
+        "meanTimeToContainMinutes",
+    ]) {
         if (counters[key] !== undefined)
             result[key] = nonNegative(counters[key], `Import counter ${key}`, 9_999_999_999);
     }
@@ -210,24 +355,59 @@ function validateCounters(value) {
 }
 function validateImportedAgent(value) {
     const record = object(value, "Imported agent is invalid.");
-    exactKeys(record, ["agentId", "name", "ownerId", "businessPurpose", "model", "runtime", "version", "identityIds", "environmentIds", "gatewayManaged", "killSwitchEnabled", "lastEvidenceAt"], "imported agent", [
-        "ownerId", "businessPurpose", "model", "runtime", "version", "lastEvidenceAt"
+    exactKeys(record, [
+        "agentId",
+        "name",
+        "ownerId",
+        "businessPurpose",
+        "model",
+        "runtime",
+        "version",
+        "identityIds",
+        "environmentIds",
+        "gatewayManaged",
+        "killSwitchEnabled",
+        "lastEvidenceAt",
+    ], "imported agent", [
+        "ownerId",
+        "businessPurpose",
+        "model",
+        "runtime",
+        "version",
+        "lastEvidenceAt",
     ]);
-    if (typeof record.gatewayManaged !== "boolean" || typeof record.killSwitchEnabled !== "boolean")
+    if (typeof record.gatewayManaged !== "boolean" ||
+        typeof record.killSwitchEnabled !== "boolean")
         throw new InventoryError("Imported agent booleans are invalid.");
     return {
         agentId: identifier(record.agentId, "Agent id"),
         name: text(record.name, "Agent name", 160),
-        ...(record.ownerId === undefined ? {} : { ownerId: identifier(record.ownerId, "Agent owner id") }),
-        ...(record.businessPurpose === undefined ? {} : { businessPurpose: text(record.businessPurpose, "Agent business purpose", 240) }),
-        ...(record.model === undefined ? {} : { model: text(record.model, "Agent model", 120) }),
-        ...(record.runtime === undefined ? {} : { runtime: text(record.runtime, "Agent runtime", 120) }),
-        ...(record.version === undefined ? {} : { version: text(record.version, "Agent version", 64) }),
+        ...(record.ownerId === undefined
+            ? {}
+            : { ownerId: identifier(record.ownerId, "Agent owner id") }),
+        ...(record.businessPurpose === undefined
+            ? {}
+            : {
+                businessPurpose: text(record.businessPurpose, "Agent business purpose", 240),
+            }),
+        ...(record.model === undefined
+            ? {}
+            : { model: text(record.model, "Agent model", 120) }),
+        ...(record.runtime === undefined
+            ? {}
+            : { runtime: text(record.runtime, "Agent runtime", 120) }),
+        ...(record.version === undefined
+            ? {}
+            : { version: text(record.version, "Agent version", 64) }),
         identityIds: identifiers(record.identityIds, "Agent identity ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         environmentIds: identifiers(record.environmentIds, "Agent environment ids", 16),
         gatewayManaged: record.gatewayManaged,
         killSwitchEnabled: record.killSwitchEnabled,
-        ...(record.lastEvidenceAt === undefined ? {} : { lastEvidenceAt: timestamp(record.lastEvidenceAt, "Agent last evidence time") })
+        ...(record.lastEvidenceAt === undefined
+            ? {}
+            : {
+                lastEvidenceAt: timestamp(record.lastEvidenceAt, "Agent last evidence time"),
+            }),
     };
 }
 function validateImportedTool(value) {
@@ -240,14 +420,24 @@ function validateImportedTool(value) {
         toolId: identifier(record.toolId, "Tool id"),
         name: text(record.name, "Tool name", 160),
         kind: kind,
-        ...(record.providerId === undefined ? {} : { providerId: identifier(record.providerId, "Tool provider id") }),
+        ...(record.providerId === undefined
+            ? {}
+            : { providerId: identifier(record.providerId, "Tool provider id") }),
         requiredScopes: scopes(record.requiredScopes, "Tool required scopes", INVENTORY_LIMITS.maxScopesPerRecord),
-        credentialIds: identifiers(record.credentialIds, "Tool credential ids", INVENTORY_LIMITS.maxReferencesPerRecord)
+        credentialIds: identifiers(record.credentialIds, "Tool credential ids", INVENTORY_LIMITS.maxReferencesPerRecord),
     };
 }
 function validateImportedIdentity(value) {
     const record = object(value, "Imported identity is invalid.");
-    exactKeys(record, ["identityId", "principalId", "role", "agentId", "toolIds", "environmentIds", "scopes"], "imported identity", ["agentId"]);
+    exactKeys(record, [
+        "identityId",
+        "principalId",
+        "role",
+        "agentId",
+        "toolIds",
+        "environmentIds",
+        "scopes",
+    ], "imported identity", ["agentId"]);
     const role = record.role;
     if (!IDENTITY_ROLES.includes(role))
         throw new InventoryError("Imported identity role is invalid.");
@@ -255,31 +445,55 @@ function validateImportedIdentity(value) {
         identityId: identifier(record.identityId, "Identity id"),
         principalId: identifier(record.principalId, "Identity principal id"),
         role: role,
-        ...(record.agentId === undefined ? {} : { agentId: identifier(record.agentId, "Identity agent id") }),
+        ...(record.agentId === undefined
+            ? {}
+            : { agentId: identifier(record.agentId, "Identity agent id") }),
         toolIds: identifiers(record.toolIds, "Identity tool ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         environmentIds: identifiers(record.environmentIds, "Identity environment ids", 16),
-        scopes: scopes(record.scopes, "Identity scopes", INVENTORY_LIMITS.maxScopesPerRecord)
+        scopes: scopes(record.scopes, "Identity scopes", INVENTORY_LIMITS.maxScopesPerRecord),
     };
 }
 function validateImportedProvider(value) {
     const record = object(value, "Imported provider is invalid.");
-    exactKeys(record, ["providerId", "name", "providerType", "ownerId", "environmentIds", "resourceIds", "gatewayBound", "killSwitchApplied"], "imported provider", ["ownerId"]);
-    if (typeof record.gatewayBound !== "boolean" || typeof record.killSwitchApplied !== "boolean")
+    exactKeys(record, [
+        "providerId",
+        "name",
+        "providerType",
+        "ownerId",
+        "environmentIds",
+        "resourceIds",
+        "gatewayBound",
+        "killSwitchApplied",
+    ], "imported provider", ["ownerId"]);
+    if (typeof record.gatewayBound !== "boolean" ||
+        typeof record.killSwitchApplied !== "boolean")
         throw new InventoryError("Imported provider booleans are invalid.");
     return {
         providerId: identifier(record.providerId, "Provider id"),
         name: text(record.name, "Provider name", 160),
         providerType: text(record.providerType, "Provider type", 120),
-        ...(record.ownerId === undefined ? {} : { ownerId: identifier(record.ownerId, "Provider owner id") }),
+        ...(record.ownerId === undefined
+            ? {}
+            : { ownerId: identifier(record.ownerId, "Provider owner id") }),
         environmentIds: identifiers(record.environmentIds, "Provider environment ids", 16),
         resourceIds: identifiers(record.resourceIds, "Provider resource ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         gatewayBound: record.gatewayBound,
-        killSwitchApplied: record.killSwitchApplied
+        killSwitchApplied: record.killSwitchApplied,
     };
 }
 function validateImportedResource(value) {
     const record = object(value, "Imported resource is invalid.");
-    exactKeys(record, ["resourceId", "providerId", "resourceType", "name", "environmentIds", "sensitive", "ownerId", "businessPurpose", "sideEffectIds"], "imported resource", ["ownerId", "businessPurpose"]);
+    exactKeys(record, [
+        "resourceId",
+        "providerId",
+        "resourceType",
+        "name",
+        "environmentIds",
+        "sensitive",
+        "ownerId",
+        "businessPurpose",
+        "sideEffectIds",
+    ], "imported resource", ["ownerId", "businessPurpose"]);
     if (typeof record.sensitive !== "boolean")
         throw new InventoryError("Imported resource sensitive flag is invalid.");
     return {
@@ -289,9 +503,15 @@ function validateImportedResource(value) {
         name: text(record.name, "Resource name", 160),
         environmentIds: identifiers(record.environmentIds, "Resource environment ids", 16),
         sensitive: record.sensitive,
-        ...(record.ownerId === undefined ? {} : { ownerId: identifier(record.ownerId, "Resource owner id") }),
-        ...(record.businessPurpose === undefined ? {} : { businessPurpose: text(record.businessPurpose, "Resource business purpose", 240) }),
-        sideEffectIds: identifiers(record.sideEffectIds, "Resource side effect ids", INVENTORY_LIMITS.maxReferencesPerRecord)
+        ...(record.ownerId === undefined
+            ? {}
+            : { ownerId: identifier(record.ownerId, "Resource owner id") }),
+        ...(record.businessPurpose === undefined
+            ? {}
+            : {
+                businessPurpose: text(record.businessPurpose, "Resource business purpose", 240),
+            }),
+        sideEffectIds: identifiers(record.sideEffectIds, "Resource side effect ids", INVENTORY_LIMITS.maxReferencesPerRecord),
     };
 }
 function validateImportedSideEffect(value) {
@@ -307,14 +527,25 @@ function validateImportedSideEffect(value) {
         sideEffectId: identifier(record.sideEffectId, "Side effect id"),
         resourceId: identifier(record.resourceId, "Side effect resource id"),
         kind: kind,
-        severity: severity
+        severity: severity,
     };
 }
 function validateImportedCredential(value) {
     const record = object(value, "Imported credential is invalid.");
-    exactKeys(record, ["credentialId", "name", "providerId", "ownerId", "environmentIds", "grantScopes", "toolIds", "status", "issuedAt", "lastUsedAt", "rotatedAt", "gatewayBound"], "imported credential", [
-        "ownerId", "lastUsedAt", "rotatedAt"
-    ]);
+    exactKeys(record, [
+        "credentialId",
+        "name",
+        "providerId",
+        "ownerId",
+        "environmentIds",
+        "grantScopes",
+        "toolIds",
+        "status",
+        "issuedAt",
+        "lastUsedAt",
+        "rotatedAt",
+        "gatewayBound",
+    ], "imported credential", ["ownerId", "lastUsedAt", "rotatedAt"]);
     if (record.status !== "active" && record.status !== "revoked")
         throw new InventoryError("Imported credential status is invalid.");
     if (typeof record.gatewayBound !== "boolean")
@@ -323,15 +554,23 @@ function validateImportedCredential(value) {
         credentialId: identifier(record.credentialId, "Credential id"),
         name: text(record.name, "Credential name", 160),
         providerId: identifier(record.providerId, "Credential provider id"),
-        ...(record.ownerId === undefined ? {} : { ownerId: identifier(record.ownerId, "Credential owner id") }),
+        ...(record.ownerId === undefined
+            ? {}
+            : { ownerId: identifier(record.ownerId, "Credential owner id") }),
         environmentIds: identifiers(record.environmentIds, "Credential environment ids", 16),
         grantScopes: scopes(record.grantScopes, "Credential grant scopes", INVENTORY_LIMITS.maxScopesPerRecord),
         toolIds: identifiers(record.toolIds, "Credential tool ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         status: record.status,
         issuedAt: timestamp(record.issuedAt, "Credential issued time"),
-        ...(record.lastUsedAt === undefined ? {} : { lastUsedAt: timestamp(record.lastUsedAt, "Credential last used time") }),
-        ...(record.rotatedAt === undefined ? {} : { rotatedAt: timestamp(record.rotatedAt, "Credential rotated time") }),
-        gatewayBound: record.gatewayBound
+        ...(record.lastUsedAt === undefined
+            ? {}
+            : {
+                lastUsedAt: timestamp(record.lastUsedAt, "Credential last used time"),
+            }),
+        ...(record.rotatedAt === undefined
+            ? {}
+            : { rotatedAt: timestamp(record.rotatedAt, "Credential rotated time") }),
+        gatewayBound: record.gatewayBound,
     };
 }
 function validateImportedPolicy(value) {
@@ -342,12 +581,21 @@ function validateImportedPolicy(value) {
         name: text(record.name, "Policy name", 160),
         version: text(record.version, "Policy version", 64),
         hash: hash(record.hash, "Policy hash"),
-        environmentIds: identifiers(record.environmentIds, "Policy environment ids", 16)
+        environmentIds: identifiers(record.environmentIds, "Policy environment ids", 16),
     };
 }
 function validateSourceRecord(value) {
     const record = object(value, "Import source is invalid.");
-    exactKeys(record, ["tenantId", "sourceId", "sourceType", "sourceName", "sourceVersion", "firstSeenAt", "lastSeenAt", "lastDigest"], "import source", ["sourceVersion"]);
+    exactKeys(record, [
+        "tenantId",
+        "sourceId",
+        "sourceType",
+        "sourceName",
+        "sourceVersion",
+        "firstSeenAt",
+        "lastSeenAt",
+        "lastDigest",
+    ], "import source", ["sourceVersion"]);
     const sourceType = record.sourceType;
     if (!IMPORT_SOURCE_TYPES.includes(sourceType))
         throw new InventoryError("Import source type is invalid.");
@@ -356,16 +604,34 @@ function validateSourceRecord(value) {
         sourceId: identifier(record.sourceId, "Source id"),
         sourceType: sourceType,
         sourceName: text(record.sourceName, "Source name", 120),
-        ...(record.sourceVersion === undefined ? {} : { sourceVersion: text(record.sourceVersion, "Source version", 64) }),
+        ...(record.sourceVersion === undefined
+            ? {}
+            : { sourceVersion: text(record.sourceVersion, "Source version", 64) }),
         firstSeenAt: timestamp(record.firstSeenAt, "Source first seen time"),
         lastSeenAt: timestamp(record.lastSeenAt, "Source last seen time"),
-        lastDigest: hash(record.lastDigest, "Source digest")
+        lastDigest: hash(record.lastDigest, "Source digest"),
     };
 }
 function validateImportRunRecord(value) {
     const record = object(value, "Import run is invalid.");
-    exactKeys(record, ["schemaVersion", "kind", "tenantId", "runId", "importedAt", "importedBy", "source", "digest", "expectedPolicyHashes", "counters", "recordCounts", "edgesCreated", "edgesRefreshed", "status"], "import run", ["counters"]);
-    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION || record.kind !== "ghostapi.inventory-import-run")
+    exactKeys(record, [
+        "schemaVersion",
+        "kind",
+        "tenantId",
+        "runId",
+        "importedAt",
+        "importedBy",
+        "source",
+        "digest",
+        "expectedPolicyHashes",
+        "counters",
+        "recordCounts",
+        "edgesCreated",
+        "edgesRefreshed",
+        "status",
+    ], "import run", ["counters"]);
+    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION ||
+        record.kind !== "ghostapi.inventory-import-run")
         throw new InventoryError("Unsupported import run schema.");
     if (record.status !== "completed")
         throw new InventoryError("Import run status is invalid.");
@@ -375,8 +641,19 @@ function validateImportRunRecord(value) {
     if (!IMPORT_SOURCE_TYPES.includes(sourceType))
         throw new InventoryError("Import run source type is invalid.");
     const recordCounts = object(record.recordCounts, "Import run record counts are invalid.");
-    exactKeys(recordCounts, ["agents", "tools", "identities", "providers", "resources", "sideEffects", "credentials", "policies"], "import run record counts");
-    const counters = record.counters === undefined ? undefined : validateCounters(record.counters);
+    exactKeys(recordCounts, [
+        "agents",
+        "tools",
+        "identities",
+        "providers",
+        "resources",
+        "sideEffects",
+        "credentials",
+        "policies",
+    ], "import run record counts");
+    const counters = record.counters === undefined
+        ? undefined
+        : validateCounters(record.counters);
     if (sourceType === "config" && counters !== undefined)
         throw new InventoryError("Counters are only allowed for ci, gateway, or cloud imports.");
     return {
@@ -390,7 +667,11 @@ function validateImportRunRecord(value) {
             sourceId: identifier(source.sourceId, "Import run source id"),
             sourceType: sourceType,
             sourceName: text(source.sourceName, "Import run source name", 120),
-            ...(source.sourceVersion === undefined ? {} : { sourceVersion: text(source.sourceVersion, "Import run source version", 64) })
+            ...(source.sourceVersion === undefined
+                ? {}
+                : {
+                    sourceVersion: text(source.sourceVersion, "Import run source version", 64),
+                }),
         },
         digest: hash(record.digest, "Import run digest"),
         expectedPolicyHashes: array(record.expectedPolicyHashes, "import run expected policy hashes", 64).map(validateExpectedPolicyHash),
@@ -403,21 +684,39 @@ function validateImportRunRecord(value) {
             resources: nonNegative(recordCounts.resources, "Import run resource count", 1000),
             sideEffects: nonNegative(recordCounts.sideEffects, "Import run side effect count", 2000),
             credentials: nonNegative(recordCounts.credentials, "Import run credential count", 500),
-            policies: nonNegative(recordCounts.policies, "Import run policy count", 100)
+            policies: nonNegative(recordCounts.policies, "Import run policy count", 100),
         },
         edgesCreated: nonNegative(record.edgesCreated, "Import run edges created", 6000),
         edgesRefreshed: nonNegative(record.edgesRefreshed, "Import run edges refreshed", 6000),
-        status: "completed"
+        status: "completed",
     };
 }
 function validateAgentRecord(value) {
     const record = object(value, "Agent record is invalid.");
-    exactKeys(record, ["schemaVersion", "kind", "tenantId", "agentId", "name", "ownerId", "businessPurpose", "model", "runtime", "version", "identityIds", "environmentIds", "gatewayManaged", "killSwitchEnabled", "lastEvidenceAt", "provenance", "freshness"], "agent record", [
-        "businessPurpose", "model", "runtime", "version"
-    ]);
-    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION || record.kind !== "ghostapi.inventory-agent")
+    exactKeys(record, [
+        "schemaVersion",
+        "kind",
+        "tenantId",
+        "agentId",
+        "name",
+        "ownerId",
+        "businessPurpose",
+        "model",
+        "runtime",
+        "version",
+        "identityIds",
+        "environmentIds",
+        "gatewayManaged",
+        "killSwitchEnabled",
+        "lastEvidenceAt",
+        "provenance",
+        "freshness",
+    ], "agent record", ["businessPurpose", "model", "runtime", "version"]);
+    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION ||
+        record.kind !== "ghostapi.inventory-agent")
         throw new InventoryError("Unsupported agent record schema.");
-    if (typeof record.gatewayManaged !== "boolean" || typeof record.killSwitchEnabled !== "boolean")
+    if (typeof record.gatewayManaged !== "boolean" ||
+        typeof record.killSwitchEnabled !== "boolean")
         throw new InventoryError("Agent record booleans are invalid.");
     return {
         schemaVersion: 1,
@@ -425,23 +724,52 @@ function validateAgentRecord(value) {
         tenantId: identifier(record.tenantId, "Agent tenant id"),
         agentId: identifier(record.agentId, "Agent id"),
         name: text(record.name, "Agent name", 160),
-        ownerId: record.ownerId === null ? null : record.ownerId === undefined ? null : identifier(record.ownerId, "Agent owner id"),
-        ...(record.businessPurpose === undefined ? {} : { businessPurpose: text(record.businessPurpose, "Agent business purpose", 240) }),
-        ...(record.model === undefined ? {} : { model: text(record.model, "Agent model", 120) }),
-        ...(record.runtime === undefined ? {} : { runtime: text(record.runtime, "Agent runtime", 120) }),
-        ...(record.version === undefined ? {} : { version: text(record.version, "Agent version", 64) }),
+        ownerId: record.ownerId === null
+            ? null
+            : record.ownerId === undefined
+                ? null
+                : identifier(record.ownerId, "Agent owner id"),
+        ...(record.businessPurpose === undefined
+            ? {}
+            : {
+                businessPurpose: text(record.businessPurpose, "Agent business purpose", 240),
+            }),
+        ...(record.model === undefined
+            ? {}
+            : { model: text(record.model, "Agent model", 120) }),
+        ...(record.runtime === undefined
+            ? {}
+            : { runtime: text(record.runtime, "Agent runtime", 120) }),
+        ...(record.version === undefined
+            ? {}
+            : { version: text(record.version, "Agent version", 64) }),
         identityIds: identifiers(record.identityIds, "Agent identity ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         environmentIds: identifiers(record.environmentIds, "Agent environment ids", 16),
         gatewayManaged: record.gatewayManaged,
         killSwitchEnabled: record.killSwitchEnabled,
-        lastEvidenceAt: record.lastEvidenceAt === null ? null : record.lastEvidenceAt === undefined ? null : timestamp(record.lastEvidenceAt, "Agent last evidence time"),
+        lastEvidenceAt: record.lastEvidenceAt === null
+            ? null
+            : record.lastEvidenceAt === undefined
+                ? null
+                : timestamp(record.lastEvidenceAt, "Agent last evidence time"),
         provenance: validateProvenance(record.provenance),
-        freshness: validateFreshness(record.freshness)
+        freshness: validateFreshness(record.freshness),
     };
 }
 function validateToolRecord(value) {
     const record = object(value, "Tool record is invalid.");
-    exactKeys(record, ["schemaVersion", "kind", "tenantId", "toolId", "name", "providerId", "requiredScopes", "credentialIds", "provenance", "freshness"], "tool record", ["providerId"]);
+    exactKeys(record, [
+        "schemaVersion",
+        "kind",
+        "tenantId",
+        "toolId",
+        "name",
+        "providerId",
+        "requiredScopes",
+        "credentialIds",
+        "provenance",
+        "freshness",
+    ], "tool record", ["providerId"]);
     if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION)
         throw new InventoryError("Unsupported tool record schema.");
     const toolKind = record.kind;
@@ -453,17 +781,35 @@ function validateToolRecord(value) {
         toolId: identifier(record.toolId, "Tool id"),
         name: text(record.name, "Tool name", 160),
         kind: toolKind,
-        providerId: record.providerId === null ? null : record.providerId === undefined ? null : identifier(record.providerId, "Tool provider id"),
+        providerId: record.providerId === null
+            ? null
+            : record.providerId === undefined
+                ? null
+                : identifier(record.providerId, "Tool provider id"),
         requiredScopes: scopes(record.requiredScopes, "Tool required scopes", INVENTORY_LIMITS.maxScopesPerRecord),
         credentialIds: identifiers(record.credentialIds, "Tool credential ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         provenance: validateProvenance(record.provenance),
-        freshness: validateFreshness(record.freshness)
+        freshness: validateFreshness(record.freshness),
     };
 }
 function validateIdentityRecord(value) {
     const record = object(value, "Identity record is invalid.");
-    exactKeys(record, ["schemaVersion", "kind", "tenantId", "identityId", "principalId", "role", "agentId", "toolIds", "environmentIds", "scopes", "provenance", "freshness"], "identity record", ["agentId"]);
-    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION || record.kind !== "ghostapi.inventory-identity")
+    exactKeys(record, [
+        "schemaVersion",
+        "kind",
+        "tenantId",
+        "identityId",
+        "principalId",
+        "role",
+        "agentId",
+        "toolIds",
+        "environmentIds",
+        "scopes",
+        "provenance",
+        "freshness",
+    ], "identity record", ["agentId"]);
+    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION ||
+        record.kind !== "ghostapi.inventory-identity")
         throw new InventoryError("Unsupported identity record schema.");
     const role = record.role;
     if (!IDENTITY_ROLES.includes(role))
@@ -475,20 +821,40 @@ function validateIdentityRecord(value) {
         identityId: identifier(record.identityId, "Identity id"),
         principalId: identifier(record.principalId, "Identity principal id"),
         role: role,
-        agentId: record.agentId === null ? null : record.agentId === undefined ? null : identifier(record.agentId, "Identity agent id"),
+        agentId: record.agentId === null
+            ? null
+            : record.agentId === undefined
+                ? null
+                : identifier(record.agentId, "Identity agent id"),
         toolIds: identifiers(record.toolIds, "Identity tool ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         environmentIds: identifiers(record.environmentIds, "Identity environment ids", 16),
         scopes: scopes(record.scopes, "Identity scopes", INVENTORY_LIMITS.maxScopesPerRecord),
         provenance: validateProvenance(record.provenance),
-        freshness: validateFreshness(record.freshness)
+        freshness: validateFreshness(record.freshness),
     };
 }
 function validateProviderRecord(value) {
     const record = object(value, "Provider record is invalid.");
-    exactKeys(record, ["schemaVersion", "kind", "tenantId", "providerId", "name", "providerType", "ownerId", "environmentIds", "resourceIds", "gatewayBound", "killSwitchApplied", "provenance", "freshness"], "provider record", ["ownerId"]);
-    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION || record.kind !== "ghostapi.inventory-provider")
+    exactKeys(record, [
+        "schemaVersion",
+        "kind",
+        "tenantId",
+        "providerId",
+        "name",
+        "providerType",
+        "ownerId",
+        "environmentIds",
+        "resourceIds",
+        "gatewayBound",
+        "killSwitchApplied",
+        "provenance",
+        "freshness",
+    ], "provider record", ["ownerId"]);
+    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION ||
+        record.kind !== "ghostapi.inventory-provider")
         throw new InventoryError("Unsupported provider record schema.");
-    if (typeof record.gatewayBound !== "boolean" || typeof record.killSwitchApplied !== "boolean")
+    if (typeof record.gatewayBound !== "boolean" ||
+        typeof record.killSwitchApplied !== "boolean")
         throw new InventoryError("Provider record booleans are invalid.");
     return {
         schemaVersion: 1,
@@ -497,19 +863,39 @@ function validateProviderRecord(value) {
         providerId: identifier(record.providerId, "Provider id"),
         name: text(record.name, "Provider name", 160),
         providerType: text(record.providerType, "Provider type", 120),
-        ownerId: record.ownerId === null ? null : record.ownerId === undefined ? null : identifier(record.ownerId, "Provider owner id"),
+        ownerId: record.ownerId === null
+            ? null
+            : record.ownerId === undefined
+                ? null
+                : identifier(record.ownerId, "Provider owner id"),
         environmentIds: identifiers(record.environmentIds, "Provider environment ids", 16),
         resourceIds: identifiers(record.resourceIds, "Provider resource ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         gatewayBound: record.gatewayBound,
         killSwitchApplied: record.killSwitchApplied,
         provenance: validateProvenance(record.provenance),
-        freshness: validateFreshness(record.freshness)
+        freshness: validateFreshness(record.freshness),
     };
 }
 function validateResourceRecord(value) {
     const record = object(value, "Resource record is invalid.");
-    exactKeys(record, ["schemaVersion", "kind", "tenantId", "resourceId", "providerId", "resourceType", "name", "environmentIds", "sensitive", "ownerId", "businessPurpose", "sideEffectIds", "provenance", "freshness"], "resource record", ["ownerId", "businessPurpose"]);
-    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION || record.kind !== "ghostapi.inventory-resource")
+    exactKeys(record, [
+        "schemaVersion",
+        "kind",
+        "tenantId",
+        "resourceId",
+        "providerId",
+        "resourceType",
+        "name",
+        "environmentIds",
+        "sensitive",
+        "ownerId",
+        "businessPurpose",
+        "sideEffectIds",
+        "provenance",
+        "freshness",
+    ], "resource record", ["ownerId", "businessPurpose"]);
+    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION ||
+        record.kind !== "ghostapi.inventory-resource")
         throw new InventoryError("Unsupported resource record schema.");
     if (typeof record.sensitive !== "boolean")
         throw new InventoryError("Resource record sensitive flag is invalid.");
@@ -523,16 +909,33 @@ function validateResourceRecord(value) {
         name: text(record.name, "Resource name", 160),
         environmentIds: identifiers(record.environmentIds, "Resource environment ids", 16),
         sensitive: record.sensitive,
-        ownerId: record.ownerId === null ? null : record.ownerId === undefined ? null : identifier(record.ownerId, "Resource owner id"),
-        ...(record.businessPurpose === undefined ? {} : { businessPurpose: text(record.businessPurpose, "Resource business purpose", 240) }),
+        ownerId: record.ownerId === null
+            ? null
+            : record.ownerId === undefined
+                ? null
+                : identifier(record.ownerId, "Resource owner id"),
+        ...(record.businessPurpose === undefined
+            ? {}
+            : {
+                businessPurpose: text(record.businessPurpose, "Resource business purpose", 240),
+            }),
         sideEffectIds: identifiers(record.sideEffectIds, "Resource side effect ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         provenance: validateProvenance(record.provenance),
-        freshness: validateFreshness(record.freshness)
+        freshness: validateFreshness(record.freshness),
     };
 }
 function validateSideEffectRecord(value) {
     const record = object(value, "Side effect record is invalid.");
-    exactKeys(record, ["schemaVersion", "tenantId", "sideEffectId", "resourceId", "kind", "severity", "provenance", "freshness"], "side effect record");
+    exactKeys(record, [
+        "schemaVersion",
+        "tenantId",
+        "sideEffectId",
+        "resourceId",
+        "kind",
+        "severity",
+        "provenance",
+        "freshness",
+    ], "side effect record");
     if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION)
         throw new InventoryError("Unsupported side effect record schema.");
     const kind = record.kind;
@@ -549,13 +952,32 @@ function validateSideEffectRecord(value) {
         kind: kind,
         severity: severity,
         provenance: validateProvenance(record.provenance),
-        freshness: validateFreshness(record.freshness)
+        freshness: validateFreshness(record.freshness),
     };
 }
 function validateCredentialRecord(value) {
     const record = object(value, "Credential record is invalid.");
-    exactKeys(record, ["schemaVersion", "kind", "tenantId", "credentialId", "name", "providerId", "ownerId", "environmentIds", "grantScopes", "toolIds", "status", "issuedAt", "lastUsedAt", "rotatedAt", "gatewayBound", "provenance", "freshness"], "credential record", ["ownerId", "lastUsedAt", "rotatedAt"]);
-    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION || record.kind !== "ghostapi.inventory-credential")
+    exactKeys(record, [
+        "schemaVersion",
+        "kind",
+        "tenantId",
+        "credentialId",
+        "name",
+        "providerId",
+        "ownerId",
+        "environmentIds",
+        "grantScopes",
+        "toolIds",
+        "status",
+        "issuedAt",
+        "lastUsedAt",
+        "rotatedAt",
+        "gatewayBound",
+        "provenance",
+        "freshness",
+    ], "credential record", ["ownerId", "lastUsedAt", "rotatedAt"]);
+    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION ||
+        record.kind !== "ghostapi.inventory-credential")
         throw new InventoryError("Unsupported credential record schema.");
     if (record.status !== "active" && record.status !== "revoked")
         throw new InventoryError("Credential record status is invalid.");
@@ -568,23 +990,45 @@ function validateCredentialRecord(value) {
         credentialId: identifier(record.credentialId, "Credential id"),
         name: text(record.name, "Credential name", 160),
         providerId: identifier(record.providerId, "Credential provider id"),
-        ownerId: record.ownerId === null ? null : record.ownerId === undefined ? null : identifier(record.ownerId, "Credential owner id"),
+        ownerId: record.ownerId === null
+            ? null
+            : record.ownerId === undefined
+                ? null
+                : identifier(record.ownerId, "Credential owner id"),
         environmentIds: identifiers(record.environmentIds, "Credential environment ids", 16),
         grantScopes: scopes(record.grantScopes, "Credential grant scopes", INVENTORY_LIMITS.maxScopesPerRecord),
         toolIds: identifiers(record.toolIds, "Credential tool ids", INVENTORY_LIMITS.maxReferencesPerRecord),
         status: record.status,
         issuedAt: timestamp(record.issuedAt, "Credential issued time"),
-        lastUsedAt: record.lastUsedAt === null ? null : record.lastUsedAt === undefined ? null : timestamp(record.lastUsedAt, "Credential last used time"),
-        ...(record.rotatedAt === undefined ? {} : { rotatedAt: timestamp(record.rotatedAt, "Credential rotated time") }),
+        lastUsedAt: record.lastUsedAt === null
+            ? null
+            : record.lastUsedAt === undefined
+                ? null
+                : timestamp(record.lastUsedAt, "Credential last used time"),
+        ...(record.rotatedAt === undefined
+            ? {}
+            : { rotatedAt: timestamp(record.rotatedAt, "Credential rotated time") }),
         gatewayBound: record.gatewayBound,
         provenance: validateProvenance(record.provenance),
-        freshness: validateFreshness(record.freshness)
+        freshness: validateFreshness(record.freshness),
     };
 }
 function validatePolicyRecord(value) {
     const record = object(value, "Policy record is invalid.");
-    exactKeys(record, ["schemaVersion", "kind", "tenantId", "policyId", "name", "version", "hash", "environmentIds", "provenance", "freshness"], "policy record");
-    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION || record.kind !== "ghostapi.inventory-policy")
+    exactKeys(record, [
+        "schemaVersion",
+        "kind",
+        "tenantId",
+        "policyId",
+        "name",
+        "version",
+        "hash",
+        "environmentIds",
+        "provenance",
+        "freshness",
+    ], "policy record");
+    if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION ||
+        record.kind !== "ghostapi.inventory-policy")
         throw new InventoryError("Unsupported policy record schema.");
     return {
         schemaVersion: 1,
@@ -596,12 +1040,23 @@ function validatePolicyRecord(value) {
         hash: hash(record.hash, "Policy hash"),
         environmentIds: identifiers(record.environmentIds, "Policy environment ids", 16),
         provenance: validateProvenance(record.provenance),
-        freshness: validateFreshness(record.freshness)
+        freshness: validateFreshness(record.freshness),
     };
 }
 function validateEdge(value) {
     const record = object(value, "Graph edge is invalid.");
-    exactKeys(record, ["tenantId", "edgeId", "sourceKind", "sourceId", "targetKind", "targetId", "relation", "provenance", "firstSeenAt", "lastSeenAt"], "graph edge");
+    exactKeys(record, [
+        "tenantId",
+        "edgeId",
+        "sourceKind",
+        "sourceId",
+        "targetKind",
+        "targetId",
+        "relation",
+        "provenance",
+        "firstSeenAt",
+        "lastSeenAt",
+    ], "graph edge");
     if (!NODE_KINDS.includes(record.sourceKind))
         throw new InventoryError("Graph edge source kind is invalid.");
     if (!NODE_KINDS.includes(record.targetKind))
@@ -618,12 +1073,27 @@ function validateEdge(value) {
         relation: record.relation,
         provenance: validateProvenance(record.provenance),
         firstSeenAt: timestamp(record.firstSeenAt, "Edge first seen time"),
-        lastSeenAt: timestamp(record.lastSeenAt, "Edge last seen time")
+        lastSeenAt: timestamp(record.lastSeenAt, "Edge last seen time"),
     };
 }
 function validateFindingRecord(value) {
     const record = object(value, "Finding record is invalid.");
-    exactKeys(record, ["schemaVersion", "tenantId", "findingId", "kind", "severity", "targetKind", "targetId", "ruleId", "reason", "basis", "discoveredAt", "status", "resolvedAt", "remediationId"], "finding record", ["resolvedAt", "remediationId"]);
+    exactKeys(record, [
+        "schemaVersion",
+        "tenantId",
+        "findingId",
+        "kind",
+        "severity",
+        "targetKind",
+        "targetId",
+        "ruleId",
+        "reason",
+        "basis",
+        "discoveredAt",
+        "status",
+        "resolvedAt",
+        "remediationId",
+    ], "finding record", ["resolvedAt", "remediationId"]);
     if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION)
         throw new InventoryError("Unsupported finding record schema.");
     if (!FINDING_KINDS.includes(record.kind))
@@ -634,7 +1104,15 @@ function validateFindingRecord(value) {
         throw new InventoryError("Finding basis is invalid.");
     if (record.status !== "open" && record.status !== "resolved")
         throw new InventoryError("Finding status is invalid.");
-    if (record.targetKind !== "agent" && record.targetKind !== "identity" && record.targetKind !== "tool" && record.targetKind !== "provider" && record.targetKind !== "resource" && record.targetKind !== "side_effect" && record.targetKind !== "credential" && record.targetKind !== "environment" && record.targetKind !== "policy")
+    if (record.targetKind !== "agent" &&
+        record.targetKind !== "identity" &&
+        record.targetKind !== "tool" &&
+        record.targetKind !== "provider" &&
+        record.targetKind !== "resource" &&
+        record.targetKind !== "side_effect" &&
+        record.targetKind !== "credential" &&
+        record.targetKind !== "environment" &&
+        record.targetKind !== "policy")
         throw new InventoryError("Finding target kind is invalid.");
     return {
         schemaVersion: 1,
@@ -649,22 +1127,52 @@ function validateFindingRecord(value) {
         basis: record.basis,
         discoveredAt: timestamp(record.discoveredAt, "Finding discovery time"),
         status: record.status,
-        ...(record.resolvedAt === undefined ? {} : { resolvedAt: timestamp(record.resolvedAt, "Finding resolved time") }),
-        ...(record.remediationId === undefined ? {} : { remediationId: identifier(record.remediationId, "Finding remediation id") })
+        ...(record.resolvedAt === undefined
+            ? {}
+            : { resolvedAt: timestamp(record.resolvedAt, "Finding resolved time") }),
+        ...(record.remediationId === undefined
+            ? {}
+            : {
+                remediationId: identifier(record.remediationId, "Finding remediation id"),
+            }),
     };
 }
 function validateRemediationRecord(value) {
     const record = object(value, "Remediation record is invalid.");
-    exactKeys(record, ["schemaVersion", "tenantId", "remediationId", "findingId", "kind", "targetKind", "targetId", "rationale", "proposedBy", "createdAt", "status", "appliedAt", "result"], "remediation record", ["appliedAt", "result"]);
+    exactKeys(record, [
+        "schemaVersion",
+        "tenantId",
+        "remediationId",
+        "findingId",
+        "kind",
+        "targetKind",
+        "targetId",
+        "rationale",
+        "proposedBy",
+        "createdAt",
+        "status",
+        "appliedAt",
+        "result",
+    ], "remediation record", ["appliedAt", "result"]);
     if (record.schemaVersion !== INVENTORY_SCHEMA_VERSION)
         throw new InventoryError("Unsupported remediation record schema.");
     if (!REMEDIATION_KINDS.includes(record.kind))
         throw new InventoryError("Remediation kind is invalid.");
     if (!REMEDIATION_STATUSES.includes(record.status))
         throw new InventoryError("Remediation status is invalid.");
-    if (record.targetKind !== "agent" && record.targetKind !== "identity" && record.targetKind !== "tool" && record.targetKind !== "provider" && record.targetKind !== "resource" && record.targetKind !== "side_effect" && record.targetKind !== "credential" && record.targetKind !== "environment" && record.targetKind !== "policy")
+    if (record.targetKind !== "agent" &&
+        record.targetKind !== "identity" &&
+        record.targetKind !== "tool" &&
+        record.targetKind !== "provider" &&
+        record.targetKind !== "resource" &&
+        record.targetKind !== "side_effect" &&
+        record.targetKind !== "credential" &&
+        record.targetKind !== "environment" &&
+        record.targetKind !== "policy")
         throw new InventoryError("Remediation target kind is invalid.");
-    const result = record.result === undefined ? undefined : validateRemediationResult(record.result);
+    const result = record.result === undefined
+        ? undefined
+        : validateRemediationResult(record.result);
     return {
         schemaVersion: 1,
         tenantId: identifier(record.tenantId, "Remediation tenant id"),
@@ -677,8 +1185,10 @@ function validateRemediationRecord(value) {
         proposedBy: identifier(record.proposedBy, "Remediation proposer"),
         createdAt: timestamp(record.createdAt, "Remediation creation time"),
         status: record.status,
-        ...(record.appliedAt === undefined ? {} : { appliedAt: timestamp(record.appliedAt, "Remediation applied time") }),
-        ...(result === undefined ? {} : { result })
+        ...(record.appliedAt === undefined
+            ? {}
+            : { appliedAt: timestamp(record.appliedAt, "Remediation applied time") }),
+        ...(result === undefined ? {} : { result }),
     };
 }
 function validateRemediationResult(value) {
@@ -686,9 +1196,19 @@ function validateRemediationResult(value) {
     exactKeys(result, ["description", "reducedScopes", "evalScenarioId", "ownerId"], "remediation result", ["reducedScopes", "evalScenarioId", "ownerId"]);
     return {
         description: text(result.description, "Remediation result description", 400),
-        ...(result.reducedScopes === undefined ? {} : { reducedScopes: scopes(result.reducedScopes, "Remediation reduced scopes", INVENTORY_LIMITS.maxScopesPerRecord) }),
-        ...(result.evalScenarioId === undefined ? {} : { evalScenarioId: identifier(result.evalScenarioId, "Remediation eval scenario id") }),
-        ...(result.ownerId === undefined ? {} : { ownerId: identifier(result.ownerId, "Remediation owner id") })
+        ...(result.reducedScopes === undefined
+            ? {}
+            : {
+                reducedScopes: scopes(result.reducedScopes, "Remediation reduced scopes", INVENTORY_LIMITS.maxScopesPerRecord),
+            }),
+        ...(result.evalScenarioId === undefined
+            ? {}
+            : {
+                evalScenarioId: identifier(result.evalScenarioId, "Remediation eval scenario id"),
+            }),
+        ...(result.ownerId === undefined
+            ? {}
+            : { ownerId: identifier(result.ownerId, "Remediation owner id") }),
     };
 }
 function validateProvenance(value) {
@@ -702,7 +1222,7 @@ function validateProvenance(value) {
         sourceType: sourceType,
         sourceName: text(provenance.sourceName, "Provenance source name", 120),
         importedAt: timestamp(provenance.importedAt, "Provenance import time"),
-        importedBy: identifier(provenance.importedBy, "Provenance importer")
+        importedBy: identifier(provenance.importedBy, "Provenance importer"),
     };
 }
 function validateFreshness(value) {
@@ -710,11 +1230,17 @@ function validateFreshness(value) {
     exactKeys(freshness, ["firstSeenAt", "lastSeenAt"], "record freshness");
     return {
         firstSeenAt: timestamp(freshness.firstSeenAt, "Record first seen time"),
-        lastSeenAt: timestamp(freshness.lastSeenAt, "Record last seen time")
+        lastSeenAt: timestamp(freshness.lastSeenAt, "Record last seen time"),
     };
 }
 export function buildRecordProvenance(source, importedAt, importedBy) {
-    return { sourceId: source.sourceId, sourceType: source.sourceType, sourceName: source.sourceName, importedAt, importedBy };
+    return {
+        sourceId: source.sourceId,
+        sourceType: source.sourceType,
+        sourceName: source.sourceName,
+        importedAt,
+        importedBy,
+    };
 }
 export function buildRecordFreshness(now) {
     return { firstSeenAt: now, lastSeenAt: now };
@@ -741,7 +1267,8 @@ function array(value, label, max) {
 }
 function exactKeys(value, keys, label, optional = []) {
     for (const key of Object.keys(value)) {
-        if (!keys.includes(key) || (value[key] === undefined && !optional.includes(key)))
+        if (!keys.includes(key) ||
+            (value[key] === undefined && !optional.includes(key)))
             throw new InventoryError(`${label} contains unsupported field: ${key}`);
     }
 }
@@ -750,7 +1277,9 @@ function unique(values, label) {
         throw new InventoryError(`${label} must be unique.`);
 }
 function identifier(value, label) {
-    if (typeof value !== "string" || !IDENTIFIER.test(value) || sanitizeSecretString(value) !== value)
+    if (typeof value !== "string" ||
+        !IDENTIFIER.test(value) ||
+        sanitizeSecretString(value) !== value)
         throw new InventoryError(`${label} must be a safe identifier.`);
     return value;
 }
@@ -759,18 +1288,26 @@ function identifiers(value, label, max) {
 }
 function scopes(value, label, max) {
     return array(value, label, max).map((entry) => {
-        if (typeof entry !== "string" || !SCOPE_IDENTIFIER.test(entry) || sanitizeSecretString(entry) !== entry)
+        if (typeof entry !== "string" ||
+            !SCOPE_IDENTIFIER.test(entry) ||
+            sanitizeSecretString(entry) !== entry)
             throw new InventoryError(`${label} must be safe scope identifiers.`);
         return entry;
     });
 }
 function text(value, label, max) {
-    if (typeof value !== "string" || value.trim() === "" || value.length > max || /[\u0000-\u001f]/.test(value) || sanitizeSecretString(value) !== value)
+    if (typeof value !== "string" ||
+        value.trim() === "" ||
+        value.length > max ||
+        /[\u0000-\u001f]/.test(value) ||
+        sanitizeSecretString(value) !== value)
         throw new InventoryError(`${label} is invalid.`);
     return value.trim();
 }
 function timestamp(value, label) {
-    if (typeof value !== "string" || !TIMESTAMP.test(value) || !Number.isFinite(Date.parse(value)))
+    if (typeof value !== "string" ||
+        !TIMESTAMP.test(value) ||
+        !Number.isFinite(Date.parse(value)))
         throw new InventoryError(`${label} must be an ISO UTC timestamp.`);
     return value;
 }
@@ -780,7 +1317,10 @@ function hash(value, label) {
     return value;
 }
 function nonNegative(value, label, max) {
-    if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > max)
+    if (typeof value !== "number" ||
+        !Number.isInteger(value) ||
+        value < 0 ||
+        value > max)
         throw new InventoryError(`${label} is invalid.`);
     return value;
 }