@yiaany/ghostapi 0.1.9 → 0.2.0

package/dist/teamControl/controlPlane.js

@@ -2,9 +2,9 @@ import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { getDataPaths } from "../config/dataPaths.js";
-import { validateEvidenceReport } from "../evidence/index.js";
-import { isSecretFieldName, sanitizeSecretString } from "../security/secrets.js";
-import { atomicWriteJson, ensurePrivateDirectory, withFileLock } from "../storage/fileStore.js";
+import { validateEvidenceReport, } from "../evidence/index.js";
+import { isSecretFieldName, sanitizeSecretString, } from "../security/secrets.js";
+import { atomicWriteJson, ensurePrivateDirectory, withFileLock, } from "../storage/fileStore.js";
 const SCHEMA_VERSION = 3;
 const MAX_STORE_BYTES = 1024 * 1024;
 const TOKEN_PREFIX = "gapi_team_";
@@ -15,19 +15,46 @@ const EVIDENCE_RETENTION_DAYS = 30;
 const AUDIT_RETENTION_DAYS = 90;
 const MAX_SERVICE_TOKEN_SCOPES = 20;
 const authenticatedServiceActors = new WeakMap();
-const READ_PERMISSIONS = ["project.read", "environment.read", "scenario.read", "evidence.read", "policy.read"];
-const PUBLISH_PERMISSIONS = ["scenario.publish", "evidence.upload"];
-const OWNER_PERMISSIONS = ["member.manage", "project.manage", "environment.manage", "policy.manage", "token.manage", "service_account.manage", "audit.read", "audit.export", "data.delete", "retention.manage", ...READ_PERMISSIONS, ...PUBLISH_PERMISSIONS];
+const READ_PERMISSIONS = [
+    "project.read",
+    "environment.read",
+    "scenario.read",
+    "evidence.read",
+    "policy.read",
+];
+const PUBLISH_PERMISSIONS = [
+    "scenario.publish",
+    "evidence.upload",
+];
+const OWNER_PERMISSIONS = [
+    "member.manage",
+    "project.manage",
+    "environment.manage",
+    "policy.manage",
+    "token.manage",
+    "service_account.manage",
+    "audit.read",
+    "audit.export",
+    "data.delete",
+    "retention.manage",
+    ...READ_PERMISSIONS,
+    ...PUBLISH_PERMISSIONS,
+];
 const ADMIN_PERMISSIONS = OWNER_PERMISSIONS.filter((permission) => permission !== "member.manage");
-const DEVELOPER_PERMISSIONS = [...READ_PERMISSIONS, ...PUBLISH_PERMISSIONS];
+const DEVELOPER_PERMISSIONS = [
+    ...READ_PERMISSIONS,
+    ...PUBLISH_PERMISSIONS,
+];
 const VIEWER_PERMISSIONS = [...READ_PERMISSIONS];
-const SERVICE_ACCOUNT_PERMISSIONS = [...DEVELOPER_PERMISSIONS.filter((permission) => permission !== "policy.read")];
+const SERVICE_ACCOUNT_PERMISSIONS = [
+    ...DEVELOPER_PERMISSIONS.filter((permission) => permission !== "policy.read"),
+];
 export const TEAM_PERMISSION_MATRIX = Object.freeze({
     owner: Object.freeze([...OWNER_PERMISSIONS]),
     admin: Object.freeze([...ADMIN_PERMISSIONS]),
     developer: Object.freeze([...DEVELOPER_PERMISSIONS]),
     viewer: Object.freeze([...VIEWER_PERMISSIONS]),
-    service_account: Object.freeze([...SERVICE_ACCOUNT_PERMISSIONS])
+    service_account: Object.freeze([...SERVICE_ACCOUNT_PERMISSIONS]),
 });
 export class TeamControlPlaneError extends Error {
     constructor(message) {
@@ -56,21 +83,38 @@ export class LocalTeamControlPlane {
                 throw new TeamControlPlaneError("Organization already exists.");
             const organization = { id: organizationId, name, createdAt: now };
             state.organizations.push(organization);
-            state.members.push({ id: ownerId, organizationId, role: "owner", createdAt: now });
-            state.auditAnchors.push({ organizationId, sequence: 0, hash: auditGenesisHash(organizationId) });
+            state.members.push({
+                id: ownerId,
+                organizationId,
+                role: "owner",
+                createdAt: now,
+            });
+            state.auditAnchors.push({
+                organizationId,
+                sequence: 0,
+                hash: auditGenesisHash(organizationId),
+            });
             appendAudit(state, organizationId, ownerId, "organization.bootstrap", organizationId, now);
             return organization;
         });
     }
     async addMember(actor, input) {
         const memberId = identifier(input.memberId, "Member id");
-        if (input.role !== "admin" && input.role !== "developer" && input.role !== "viewer")
+        if (input.role !== "admin" &&
+            input.role !== "developer" &&
+            input.role !== "viewer")
             throw new TeamControlPlaneError("Member role is invalid.");
         return this.mutate((state, now) => {
             requirePermission(state, actor, "member.manage");
-            if (state.members.some((member) => member.organizationId === actor.organizationId && member.id === memberId))
+            if (state.members.some((member) => member.organizationId === actor.organizationId &&
+                member.id === memberId))
                 throw new TeamControlPlaneError("Member already exists.");
-            const member = { id: memberId, organizationId: actor.organizationId, role: input.role, createdAt: now };
+            const member = {
+                id: memberId,
+                organizationId: actor.organizationId,
+                role: input.role,
+                createdAt: now,
+            };
             state.members.push(member);
             appendAudit(state, actor.organizationId, actorId(actor), "member.add", memberId, now);
             return member;
@@ -81,9 +125,16 @@ export class LocalTeamControlPlane {
         const name = text(input.name, "Service account name", 120);
         return this.mutate((state, now) => {
             requirePermission(state, actor, "service_account.manage");
-            if (state.serviceAccounts.some((account) => account.organizationId === actor.organizationId && account.id === serviceAccountId))
+            if (state.serviceAccounts.some((account) => account.organizationId === actor.organizationId &&
+                account.id === serviceAccountId))
                 throw new TeamControlPlaneError("Service account already exists.");
-            const account = { id: serviceAccountId, organizationId: actor.organizationId, name, createdBy: actorId(actor), createdAt: now };
+            const account = {
+                id: serviceAccountId,
+                organizationId: actor.organizationId,
+                name,
+                createdBy: actorId(actor),
+                createdAt: now,
+            };
             state.serviceAccounts.push(account);
             appendAudit(state, actor.organizationId, actorId(actor), "service_account.create", serviceAccountId, now);
             return account;
@@ -93,13 +144,17 @@ export class LocalTeamControlPlane {
         const id = identifier(serviceAccountId, "Service account id");
         await this.mutate((state, now) => {
             requirePermission(state, actor, "service_account.manage");
-            const account = state.serviceAccounts.find((candidate) => candidate.organizationId === actor.organizationId && candidate.id === id);
+            const account = state.serviceAccounts.find((candidate) => candidate.organizationId === actor.organizationId &&
+                candidate.id === id);
             if (account === undefined)
                 throw new TeamControlPlaneError("Resource not found.");
             if (account.disabledAt === undefined) {
                 account.disabledAt = now;
                 for (const token of state.tokens) {
-                    if (token.organizationId === actor.organizationId && token.type === "service" && token.subjectId === id && token.revokedAt === undefined)
+                    if (token.organizationId === actor.organizationId &&
+                        token.type === "service" &&
+                        token.subjectId === id &&
+                        token.revokedAt === undefined)
                         token.revokedAt = now;
                 }
                 appendAudit(state, actor.organizationId, actorId(actor), "service_account.disable", id, now);
@@ -111,9 +166,15 @@ export class LocalTeamControlPlane {
         const name = text(input.name, "Project name", 120);
         return this.mutate((state, now) => {
             requirePermission(state, actor, "project.manage");
-            if (state.projects.some((project) => project.organizationId === actor.organizationId && project.id === projectId))
+            if (state.projects.some((project) => project.organizationId === actor.organizationId &&
+                project.id === projectId))
                 throw new TeamControlPlaneError("Project already exists.");
-            const project = { id: projectId, organizationId: actor.organizationId, name, createdAt: now };
+            const project = {
+                id: projectId,
+                organizationId: actor.organizationId,
+                name,
+                createdAt: now,
+            };
             state.projects.push(project);
             appendAudit(state, actor.organizationId, actorId(actor), "project.register", projectId, now);
             return project;
@@ -128,9 +189,18 @@ export class LocalTeamControlPlane {
         return this.mutate((state, now) => {
             requirePermission(state, actor, "environment.manage");
             requireProject(state, actor.organizationId, projectId);
-            if (state.environments.some((environment) => environment.organizationId === actor.organizationId && environment.projectId === projectId && environment.id === environmentId))
+            if (state.environments.some((environment) => environment.organizationId === actor.organizationId &&
+                environment.projectId === projectId &&
+                environment.id === environmentId))
                 throw new TeamControlPlaneError("Environment already exists.");
-            const environment = { id: environmentId, organizationId: actor.organizationId, projectId, name, kind: input.kind, createdAt: now };
+            const environment = {
+                id: environmentId,
+                organizationId: actor.organizationId,
+                projectId,
+                name,
+                kind: input.kind,
+                createdAt: now,
+            };
             state.environments.push(environment);
             appendAudit(state, actor.organizationId, actorId(actor), "environment.create", environmentId, now);
             return environment;
@@ -140,11 +210,22 @@ export class LocalTeamControlPlane {
         const expiresAt = futureTimestamp(input.expiresAt, this.now());
         return this.mutate((state, now) => {
             requirePermission(state, actor, "token.manage");
-            const memberId = input.memberId === undefined ? userActorId(actor) : identifier(input.memberId, "Token member id");
-            const subject = requireMember(state, { organizationId: actor.organizationId, memberId });
+            const memberId = input.memberId === undefined
+                ? userActorId(actor)
+                : identifier(input.memberId, "Token member id");
+            const subject = requireMember(state, {
+                organizationId: actor.organizationId,
+                memberId,
+            });
             if (!canManageMemberToken(actorRole(state, actor), subject.role))
                 throw new TeamControlPlaneError("Access denied.");
-            const issued = issueTokenRecord(state, { organizationId: actor.organizationId, type: "user", subjectId: memberId, issuedBy: actorId(actor), expiresAt }, now, this.randomTokenBytes);
+            const issued = issueTokenRecord(state, {
+                organizationId: actor.organizationId,
+                type: "user",
+                subjectId: memberId,
+                issuedBy: actorId(actor),
+                expiresAt,
+            }, now, this.randomTokenBytes);
             appendAudit(state, actor.organizationId, actorId(actor), "token.issue", issued.tokenId, now);
             return issued;
         });
@@ -156,7 +237,14 @@ export class LocalTeamControlPlane {
             requirePermission(state, actor, "token.manage");
             requireServiceAccount(state, actor.organizationId, serviceAccountId);
             const scope = validateTokenScope(input.scope, state, actor.organizationId);
-            const issued = issueTokenRecord(state, { organizationId: actor.organizationId, type: "service", subjectId: serviceAccountId, issuedBy: actorId(actor), expiresAt, scope }, now, this.randomTokenBytes);
+            const issued = issueTokenRecord(state, {
+                organizationId: actor.organizationId,
+                type: "service",
+                subjectId: serviceAccountId,
+                issuedBy: actorId(actor),
+                expiresAt,
+                scope,
+            }, now, this.randomTokenBytes);
             appendAudit(state, actor.organizationId, actorId(actor), "token.issue_service", issued.tokenId, now);
             return issued;
         });
@@ -165,18 +253,32 @@ export class LocalTeamControlPlane {
         const id = identifier(tokenId, "Token id");
         return this.mutate((state, now) => {
             requirePermission(state, actor, "token.manage");
-            const oldToken = state.tokens.find((candidate) => candidate.id === id && candidate.organizationId === actor.organizationId);
+            const oldToken = state.tokens.find((candidate) => candidate.id === id &&
+                candidate.organizationId === actor.organizationId);
             if (oldToken === undefined)
                 throw new TeamControlPlaneError("Resource not found.");
             if (oldToken.revokedAt !== undefined)
                 throw new TeamControlPlaneError("Token is already revoked.");
-            if (oldToken.type === "user" && !canManageMemberToken(actorRole(state, actor), requireMember(state, { organizationId: actor.organizationId, memberId: oldToken.subjectId }).role))
+            if (oldToken.type === "user" &&
+                !canManageMemberToken(actorRole(state, actor), requireMember(state, {
+                    organizationId: actor.organizationId,
+                    memberId: oldToken.subjectId,
+                }).role))
                 throw new TeamControlPlaneError("Access denied.");
-            const expiresAt = input.expiresAt === undefined ? oldToken.expiresAt : futureTimestamp(input.expiresAt, this.now());
+            const expiresAt = input.expiresAt === undefined
+                ? oldToken.expiresAt
+                : futureTimestamp(input.expiresAt, this.now());
             if (new Date(expiresAt).getTime() <= new Date(now).getTime())
                 throw new TeamControlPlaneError("Token expiry must be within the next 90 days.");
             oldToken.revokedAt = now;
-            const issued = issueTokenRecord(state, { organizationId: oldToken.organizationId, type: oldToken.type, subjectId: oldToken.subjectId, issuedBy: actorId(actor), expiresAt, ...(oldToken.scope === undefined ? {} : { scope: oldToken.scope }) }, now, this.randomTokenBytes);
+            const issued = issueTokenRecord(state, {
+                organizationId: oldToken.organizationId,
+                type: oldToken.type,
+                subjectId: oldToken.subjectId,
+                issuedBy: actorId(actor),
+                expiresAt,
+                ...(oldToken.scope === undefined ? {} : { scope: oldToken.scope }),
+            }, now, this.randomTokenBytes);
             appendAudit(state, actor.organizationId, actorId(actor), "token.rotate", `${id}->${issued.tokenId}`, now);
             return issued;
         });
@@ -185,10 +287,15 @@ export class LocalTeamControlPlane {
         const id = identifier(tokenId, "Token id");
         await this.mutate((state, now) => {
             requirePermission(state, actor, "token.manage");
-            const token = state.tokens.find((candidate) => candidate.id === id && candidate.organizationId === actor.organizationId);
+            const token = state.tokens.find((candidate) => candidate.id === id &&
+                candidate.organizationId === actor.organizationId);
             if (token === undefined)
                 throw new TeamControlPlaneError("Resource not found.");
-            if (token.type === "user" && !canManageMemberToken(actorRole(state, actor), requireMember(state, { organizationId: actor.organizationId, memberId: token.subjectId }).role))
+            if (token.type === "user" &&
+                !canManageMemberToken(actorRole(state, actor), requireMember(state, {
+                    organizationId: actor.organizationId,
+                    memberId: token.subjectId,
+                }).role))
                 throw new TeamControlPlaneError("Access denied.");
             if (token.revokedAt === undefined)
                 token.revokedAt = now;
@@ -201,16 +308,31 @@ export class LocalTeamControlPlane {
         const state = await this.read();
         const digest = hash(token);
         const record = state.tokens.find((candidate) => equalHash(candidate.digest, digest));
-        if (record === undefined || record.revokedAt !== undefined || new Date(record.expiresAt).getTime() <= this.now().getTime())
+        if (record === undefined ||
+            record.revokedAt !== undefined ||
+            new Date(record.expiresAt).getTime() <= this.now().getTime())
             throw new TeamControlPlaneError("Invalid or expired token.");
         if (record.type === "user") {
-            requireMember(state, { organizationId: record.organizationId, memberId: record.subjectId });
-            return { organizationId: record.organizationId, memberId: record.subjectId };
+            requireMember(state, {
+                organizationId: record.organizationId,
+                memberId: record.subjectId,
+            });
+            return {
+                organizationId: record.organizationId,
+                memberId: record.subjectId,
+            };
         }
-        if (!state.serviceAccounts.some((account) => account.organizationId === record.organizationId && account.id === record.subjectId && account.disabledAt === undefined))
+        if (!state.serviceAccounts.some((account) => account.organizationId === record.organizationId &&
+            account.id === record.subjectId &&
+            account.disabledAt === undefined))
             throw new TeamControlPlaneError("Invalid or expired token.");
         validateTokenScope(record.scope, state, record.organizationId);
-        const actor = Object.freeze({ organizationId: record.organizationId, serviceAccountId: record.subjectId, actorType: "service_account", tokenId: record.id });
+        const actor = Object.freeze({
+            organizationId: record.organizationId,
+            serviceAccountId: record.subjectId,
+            actorType: "service_account",
+            tokenId: record.id,
+        });
         authenticatedServiceActors.set(actor, this.now);
         return actor;
     }
@@ -225,9 +347,23 @@ export class LocalTeamControlPlane {
             requireScopedPermission(state, actor, "scenario.publish", projectId, environmentId);
             requireProject(state, actor.organizationId, projectId);
             requireEnvironment(state, actor.organizationId, projectId, environmentId);
-            if (state.scenarios.some((scenario) => scenario.organizationId === actor.organizationId && scenario.projectId === projectId && scenario.environmentId === environmentId && scenario.scenarioId === scenarioId && scenario.version === version))
+            if (state.scenarios.some((scenario) => scenario.organizationId === actor.organizationId &&
+                scenario.projectId === projectId &&
+                scenario.environmentId === environmentId &&
+                scenario.scenarioId === scenarioId &&
+                scenario.version === version))
                 throw new TeamControlPlaneError("Scenario version already exists.");
-            const scenario = { organizationId: actor.organizationId, projectId, environmentId, scenarioId, version, title, metadata, createdBy: actorId(actor), createdAt: now };
+            const scenario = {
+                organizationId: actor.organizationId,
+                projectId,
+                environmentId,
+                scenarioId,
+                version,
+                title,
+                metadata,
+                createdBy: actorId(actor),
+                createdAt: now,
+            };
             state.scenarios.push(scenario);
             appendAudit(state, actor.organizationId, actorId(actor), "scenario.publish", `${scenarioId}@${version}`, now);
             return scenario;
@@ -243,12 +379,30 @@ export class LocalTeamControlPlane {
             requireScopedPermission(state, actor, "evidence.upload", projectId, environmentId);
             requireProject(state, actor.organizationId, projectId);
             requireEnvironment(state, actor.organizationId, projectId, environmentId);
-            if (state.evidence.some((evidence) => evidence.organizationId === actor.organizationId && evidence.id === evidenceId))
+            if (state.evidence.some((evidence) => evidence.organizationId === actor.organizationId &&
+                evidence.id === evidenceId))
                 throw new TeamControlPlaneError("Evidence already exists.");
             const evidence = {
-                id: evidenceId, organizationId: actor.organizationId, projectId, environmentId, runId: runId(report.run.id), evidenceHash: report.artifact.logicalHash, status: report.run.status,
-                passed: report.summary.passed, failCount: report.summary.failCount, warningCount: report.summary.warningCount, providers: list(report.coverage.providers, "Evidence providers"), scenarios: list(report.coverage.scenarios, "Evidence scenarios", true),
-                enforcement: { mode: report.enforcement.mode, isolated: report.enforcement.isolated, degraded: report.enforcement.degraded }, uploadedBy: actorId(actor), uploadedAt: now, expiresAt: addDays(now, EVIDENCE_RETENTION_DAYS)
+                id: evidenceId,
+                organizationId: actor.organizationId,
+                projectId,
+                environmentId,
+                runId: runId(report.run.id),
+                evidenceHash: report.artifact.logicalHash,
+                status: report.run.status,
+                passed: report.summary.passed,
+                failCount: report.summary.failCount,
+                warningCount: report.summary.warningCount,
+                providers: list(report.coverage.providers, "Evidence providers"),
+                scenarios: list(report.coverage.scenarios, "Evidence scenarios", true),
+                enforcement: {
+                    mode: report.enforcement.mode,
+                    isolated: report.enforcement.isolated,
+                    degraded: report.enforcement.degraded,
+                },
+                uploadedBy: actorId(actor),
+                uploadedAt: now,
+                expiresAt: addDays(now, EVIDENCE_RETENTION_DAYS),
             };
             state.evidence.push(evidence);
             appendAudit(state, actor.organizationId, actorId(actor), "evidence.upload", evidenceId, now);
@@ -261,7 +415,9 @@ export class LocalTeamControlPlane {
         await this.mutate((state, now) => {
             requirePermission(state, actor, "data.delete");
             requireProject(state, actor.organizationId, projectId);
-            const index = state.evidence.findIndex((evidence) => evidence.organizationId === actor.organizationId && evidence.projectId === projectId && evidence.id === evidenceId);
+            const index = state.evidence.findIndex((evidence) => evidence.organizationId === actor.organizationId &&
+                evidence.projectId === projectId &&
+                evidence.id === evidenceId);
             if (index === -1)
                 throw new TeamControlPlaneError("Resource not found.");
             state.evidence.splice(index, 1);
@@ -274,9 +430,17 @@ export class LocalTeamControlPlane {
         validatePolicy(policy);
         return this.mutate((state, now) => {
             requirePermission(state, actor, "policy.manage");
-            if (state.policies.some((candidate) => candidate.organizationId === actor.organizationId && candidate.version === version))
+            if (state.policies.some((candidate) => candidate.organizationId === actor.organizationId &&
+                candidate.version === version))
                 throw new TeamControlPlaneError("Policy version already exists.");
-            const distributed = { organizationId: actor.organizationId, version, policy, hash: stableHash(policy), distributedBy: actorId(actor), distributedAt: now };
+            const distributed = {
+                organizationId: actor.organizationId,
+                version,
+                policy,
+                hash: stableHash(policy),
+                distributedBy: actorId(actor),
+                distributedAt: now,
+            };
             state.policies.push(distributed);
             appendAudit(state, actor.organizationId, actorId(actor), "policy.distribute", `policy@${version}`, now);
             return distributed;
@@ -285,20 +449,30 @@ export class LocalTeamControlPlane {
     async listProjects(actor) {
         const state = await this.read();
         requirePermission(state, actor, "project.read");
-        return state.projects.filter((project) => project.organizationId === actor.organizationId && (!isServiceActor(actor) || serviceTokenScopes(state, actor).some((scope) => scope.projectId === project.id && scope.permissions.includes("project.read")))).map((project) => structuredClone(project));
+        return state.projects
+            .filter((project) => project.organizationId === actor.organizationId &&
+            (!isServiceActor(actor) ||
+                serviceTokenScopes(state, actor).some((scope) => scope.projectId === project.id &&
+                    scope.permissions.includes("project.read"))))
+            .map((project) => structuredClone(project));
     }
     async listEvidence(actor, projectId) {
         const id = identifier(projectId, "Project id");
         const state = await this.read();
         if (isServiceActor(actor)) {
-            if (!serviceTokenScopes(state, actor).some((scope) => scope.projectId === id && scope.permissions.includes("evidence.read")))
+            if (!serviceTokenScopes(state, actor).some((scope) => scope.projectId === id &&
+                scope.permissions.includes("evidence.read")))
                 throw new TeamControlPlaneError("Access denied.");
         }
         else {
             requirePermission(state, actor, "evidence.read");
         }
         requireProject(state, actor.organizationId, id);
-        return state.evidence.filter((evidence) => evidence.organizationId === actor.organizationId && evidence.projectId === id && canReadEvidence(state, actor, evidence)).map((evidence) => structuredClone(evidence));
+        return state.evidence
+            .filter((evidence) => evidence.organizationId === actor.organizationId &&
+            evidence.projectId === id &&
+            canReadEvidence(state, actor, evidence))
+            .map((evidence) => structuredClone(evidence));
     }
     async listScenarioVersions(actor, input) {
         const projectId = identifier(input.projectId, "Project id");
@@ -307,18 +481,28 @@ export class LocalTeamControlPlane {
         const state = await this.read();
         requireScopedPermission(state, actor, "scenario.read", projectId, environmentId);
         requireEnvironment(state, actor.organizationId, projectId, environmentId);
-        return state.scenarios.filter((scenario) => scenario.organizationId === actor.organizationId && scenario.projectId === projectId && scenario.environmentId === environmentId && scenario.scenarioId === scenarioId).sort((left, right) => left.version - right.version).map((scenario) => structuredClone(scenario));
+        return state.scenarios
+            .filter((scenario) => scenario.organizationId === actor.organizationId &&
+            scenario.projectId === projectId &&
+            scenario.environmentId === environmentId &&
+            scenario.scenarioId === scenarioId)
+            .sort((left, right) => left.version - right.version)
+            .map((scenario) => structuredClone(scenario));
     }
     async getLatestPolicy(actor) {
         const state = await this.read();
         requirePermission(state, actor, "policy.read");
-        const policy = state.policies.filter((candidate) => candidate.organizationId === actor.organizationId).sort((left, right) => right.version - left.version)[0];
+        const policy = state.policies
+            .filter((candidate) => candidate.organizationId === actor.organizationId)
+            .sort((left, right) => right.version - left.version)[0];
         return policy === undefined ? null : structuredClone(policy);
     }
     async listAudit(actor) {
         const state = await this.read();
         requirePermission(state, actor, "audit.read");
-        return state.audit.filter((record) => record.organizationId === actor.organizationId).map((record) => structuredClone(record));
+        return state.audit
+            .filter((record) => record.organizationId === actor.organizationId)
+            .map((record) => structuredClone(record));
     }
     async exportAudit(actor) {
         const state = await this.read();
@@ -326,8 +510,15 @@ export class LocalTeamControlPlane {
         const anchor = state.auditAnchors.find((candidate) => candidate.organizationId === actor.organizationId);
         if (anchor === undefined)
             throw new TeamControlPlaneError("Resource not found.");
-        const records = state.audit.filter((record) => record.organizationId === actor.organizationId).map((record) => structuredClone(record));
-        return { organizationId: actor.organizationId, anchor: structuredClone(anchor), records, integrity: verifyAuditChain(actor.organizationId, anchor, records) };
+        const records = state.audit
+            .filter((record) => record.organizationId === actor.organizationId)
+            .map((record) => structuredClone(record));
+        return {
+            organizationId: actor.organizationId,
+            anchor: structuredClone(anchor),
+            records,
+            integrity: verifyAuditChain(actor.organizationId, anchor, records),
+        };
     }
     async pruneRetention(actor) {
         return this.mutate((state, now) => {
@@ -337,7 +528,10 @@ export class LocalTeamControlPlane {
             retain(state, now);
             appendAudit(state, actor.organizationId, actorId(actor), "retention.prune", "team-control-plane", now);
             retain(state, now);
-            return { evidenceRemoved: beforeEvidence - state.evidence.length, auditRemoved: beforeAudit + 1 - state.audit.length };
+            return {
+                evidenceRemoved: beforeEvidence - state.evidence.length,
+                auditRemoved: beforeAudit + 1 - state.audit.length,
+            };
         }, false);
     }
     async deleteProject(actor, projectId) {
@@ -346,10 +540,15 @@ export class LocalTeamControlPlane {
             requirePermission(state, actor, "data.delete");
             requireProject(state, actor.organizationId, id);
             state.projects = state.projects.filter((project) => !(project.organizationId === actor.organizationId && project.id === id));
-            state.environments = state.environments.filter((environment) => !(environment.organizationId === actor.organizationId && environment.projectId === id));
-            state.scenarios = state.scenarios.filter((scenario) => !(scenario.organizationId === actor.organizationId && scenario.projectId === id));
-            state.evidence = state.evidence.filter((evidence) => !(evidence.organizationId === actor.organizationId && evidence.projectId === id));
-            state.tokens = state.tokens.filter((token) => !(token.organizationId === actor.organizationId && token.type === "service" && token.scope?.some((scope) => scope.projectId === id)));
+            state.environments = state.environments.filter((environment) => !(environment.organizationId === actor.organizationId &&
+                environment.projectId === id));
+            state.scenarios = state.scenarios.filter((scenario) => !(scenario.organizationId === actor.organizationId &&
+                scenario.projectId === id));
+            state.evidence = state.evidence.filter((evidence) => !(evidence.organizationId === actor.organizationId &&
+                evidence.projectId === id));
+            state.tokens = state.tokens.filter((token) => !(token.organizationId === actor.organizationId &&
+                token.type === "service" &&
+                token.scope?.some((scope) => scope.projectId === id)));
             appendAudit(state, actor.organizationId, actorId(actor), "project.delete", id, now);
         });
     }
@@ -370,7 +569,8 @@ export class LocalTeamControlPlane {
             const state = migrateTeamControlPlane(JSON.parse(source));
             for (const organization of state.organizations) {
                 const anchor = state.auditAnchors.find((candidate) => candidate.organizationId === organization.id);
-                if (anchor === undefined || !verifyAuditChain(organization.id, anchor, state.audit.filter((record) => record.organizationId === organization.id)).valid)
+                if (anchor === undefined ||
+                    !verifyAuditChain(organization.id, anchor, state.audit.filter((record) => record.organizationId === organization.id)).valid)
                     throw new TeamControlPlaneError("Audit integrity verification failed.");
             }
             return state;
@@ -403,13 +603,26 @@ export function verifyAuditExport(value) {
         return verifyAuditChain(organizationId, anchor, records);
     }
     catch (error) {
-        return { valid: false, reason: error instanceof Error ? error.message : "Audit export is invalid." };
+        return {
+            valid: false,
+            reason: error instanceof Error ? error.message : "Audit export is invalid.",
+        };
     }
 }
 export function migrateTeamControlPlane(value) {
     const state = object(value, "Team control-plane store must be an object.");
     if (state.schemaVersion === 1) {
-        exactKeys(state, ["schemaVersion", "organizations", "members", "projects", "environments", "tokens", "scenarios", "evidence", "policies"], "Team control-plane v1 store");
+        exactKeys(state, [
+            "schemaVersion",
+            "organizations",
+            "members",
+            "projects",
+            "environments",
+            "tokens",
+            "scenarios",
+            "evidence",
+            "policies",
+        ], "Team control-plane v1 store");
         return migrateV2State({ ...state, schemaVersion: 2, audit: [] });
     }
     if (state.schemaVersion === 2)
@@ -417,19 +630,44 @@ export function migrateTeamControlPlane(value) {
     return validateState(state);
 }
 function migrateV2State(value) {
-    exactKeys(value, ["schemaVersion", "organizations", "members", "projects", "environments", "tokens", "scenarios", "evidence", "policies", "audit"], "Team control-plane v2 store");
+    exactKeys(value, [
+        "schemaVersion",
+        "organizations",
+        "members",
+        "projects",
+        "environments",
+        "tokens",
+        "scenarios",
+        "evidence",
+        "policies",
+        "audit",
+    ], "Team control-plane v2 store");
     if (value.schemaVersion !== 2)
         throw new TeamControlPlaneError("Unsupported team control-plane schema version.");
     const members = array(value.members, "Members", 1_000).map((raw) => {
         const entry = object(raw, "Member is invalid.");
         exactKeys(entry, ["id", "organizationId", "role", "createdAt"], "Member");
-        if (entry.role !== "owner" && entry.role !== "admin" && entry.role !== "member")
+        if (entry.role !== "owner" &&
+            entry.role !== "admin" &&
+            entry.role !== "member")
             throw new TeamControlPlaneError("Member is invalid.");
-        return { ...entry, role: entry.role === "member" ? "developer" : entry.role };
+        return {
+            ...entry,
+            role: entry.role === "member" ? "developer" : entry.role,
+        };
     });
     const tokens = array(value.tokens, "Tokens", 10_000).map((raw) => {
         const entry = object(raw, "Token is invalid.");
-        exactKeys(entry, ["id", "organizationId", "memberId", "digest", "issuedBy", "issuedAt", "expiresAt", "revokedAt"], "Token", ["revokedAt"]);
+        exactKeys(entry, [
+            "id",
+            "organizationId",
+            "memberId",
+            "digest",
+            "issuedBy",
+            "issuedAt",
+            "expiresAt",
+            "revokedAt",
+        ], "Token", ["revokedAt"]);
         const { memberId, ...rest } = entry;
         return { ...rest, type: "user", subjectId: memberId };
     });
@@ -445,33 +683,71 @@ function migrateV2State(value) {
         evidence: value.evidence,
         policies: value.policies,
         auditAnchors: [],
-        audit: []
+        audit: [],
     };
-    const validatedBase = validateState({ ...base, auditAnchors: array(value.organizations, "Organizations", 100).map((raw) => ({ organizationId: identifier(object(raw, "Organization is invalid.").id, "Organization id"), sequence: 0, hash: auditGenesisHash(identifier(object(raw, "Organization is invalid.").id, "Organization id")) })) });
+    const validatedBase = validateState({
+        ...base,
+        auditAnchors: array(value.organizations, "Organizations", 100).map((raw) => ({
+            organizationId: identifier(object(raw, "Organization is invalid.").id, "Organization id"),
+            sequence: 0,
+            hash: auditGenesisHash(identifier(object(raw, "Organization is invalid.").id, "Organization id")),
+        })),
+    });
     const legacyAudit = array(value.audit, "Audit records", 100_000).map((raw) => legacyAuditRecord(raw, new Set(validatedBase.organizations.map((organization) => organization.id)), validatedBase.members));
     for (const record of legacyAudit)
         appendAudit(validatedBase, record.organizationId, record.actorId, record.action, record.resource, record.timestamp);
     return validateState(validatedBase);
 }
 function emptyState() {
-    return { schemaVersion: 3, organizations: [], members: [], serviceAccounts: [], projects: [], environments: [], tokens: [], scenarios: [], evidence: [], policies: [], auditAnchors: [], audit: [] };
+    return {
+        schemaVersion: 3,
+        organizations: [],
+        members: [],
+        serviceAccounts: [],
+        projects: [],
+        environments: [],
+        tokens: [],
+        scenarios: [],
+        evidence: [],
+        policies: [],
+        auditAnchors: [],
+        audit: [],
+    };
 }
 function validateState(value) {
     const state = object(value, "Team control-plane store must be an object.");
-    exactKeys(state, ["schemaVersion", "organizations", "members", "serviceAccounts", "projects", "environments", "tokens", "scenarios", "evidence", "policies", "auditAnchors", "audit"], "Team control-plane store");
+    exactKeys(state, [
+        "schemaVersion",
+        "organizations",
+        "members",
+        "serviceAccounts",
+        "projects",
+        "environments",
+        "tokens",
+        "scenarios",
+        "evidence",
+        "policies",
+        "auditAnchors",
+        "audit",
+    ], "Team control-plane store");
     if (state.schemaVersion !== SCHEMA_VERSION)
         throw new TeamControlPlaneError("Unsupported team control-plane schema version.");
     const organizations = array(state.organizations, "Organizations", 100).map((entry) => {
         const organization = object(entry, "Organization is invalid.");
         exactKeys(organization, ["id", "name", "createdAt"], "Organization");
-        return { id: identifier(organization.id, "Organization id"), name: text(organization.name, "Organization name", 120), createdAt: timestamp(organization.createdAt, "Organization createdAt") };
+        return {
+            id: identifier(organization.id, "Organization id"),
+            name: text(organization.name, "Organization name", 120),
+            createdAt: timestamp(organization.createdAt, "Organization createdAt"),
+        };
     });
     unique(organizations.map((entry) => entry.id), "Organization ids");
     const organizationIds = new Set(organizations.map((entry) => entry.id));
     const members = array(state.members, "Members", 1_000).map((entry) => member(entry, organizationIds));
     unique(members.map((entry) => scopedKey(entry.organizationId, entry.id)), "Organization member ids");
     for (const organization of organizations)
-        if (!members.some((candidate) => candidate.organizationId === organization.id && candidate.role === "owner"))
+        if (!members.some((candidate) => candidate.organizationId === organization.id &&
+            candidate.role === "owner"))
             throw new TeamControlPlaneError("Each organization requires an owner.");
     const serviceAccounts = array(state.serviceAccounts, "Service accounts", 1_000).map((entry) => serviceAccount(entry, organizationIds, members));
     unique(serviceAccounts.map((entry) => scopedKey(entry.organizationId, entry.id)), "Organization service account ids");
@@ -481,7 +757,10 @@ function validateState(value) {
     const projectOwners = new Set(projects.map((entry) => scopedKey(entry.organizationId, entry.id)));
     const environments = array(state.environments, "Environments", 2_000).map((entry) => environment(entry, organizationIds, projectOwners));
     unique(environments.map((entry) => scopedKey(entry.organizationId, entry.projectId, entry.id)), "Project environment ids");
-    const environmentsById = new Map(environments.map((entry) => [scopedKey(entry.organizationId, entry.projectId, entry.id), entry]));
+    const environmentsById = new Map(environments.map((entry) => [
+        scopedKey(entry.organizationId, entry.projectId, entry.id),
+        entry,
+    ]));
     const tokens = array(state.tokens, "Tokens", 10_000).map((entry) => token(entry, organizationIds, members, serviceAccounts, projects, environments));
     unique(tokens.map((entry) => entry.id), "Token ids");
     const scenarios = array(state.scenarios, "Scenarios", 10_000).map((entry) => scenario(entry, organizationIds, projectOwners, environmentsById, actorIds));
@@ -492,31 +771,68 @@ function validateState(value) {
     unique(policies.map((entry) => scopedKey(entry.organizationId, String(entry.version))), "Policy versions");
     const auditAnchors = array(state.auditAnchors, "Audit anchors", 100).map((entry) => auditAnchor(entry, organizationIds));
     unique(auditAnchors.map((entry) => entry.organizationId), "Audit anchor organization ids");
-    if (auditAnchors.length !== organizations.length || auditAnchors.some((anchor) => !organizationIds.has(anchor.organizationId)))
+    if (auditAnchors.length !== organizations.length ||
+        auditAnchors.some((anchor) => !organizationIds.has(anchor.organizationId)))
         throw new TeamControlPlaneError("Each organization requires an audit anchor.");
     const auditRecords = array(state.audit, "Audit records", 100_000).map((entry) => auditRecord(entry, organizationIds, members, serviceAccounts));
     for (const organization of organizations) {
         const anchor = auditAnchors.find((candidate) => candidate.organizationId === organization.id);
-        if (anchor === undefined || !verifyAuditChain(organization.id, anchor, auditRecords.filter((record) => record.organizationId === organization.id)).valid)
+        if (anchor === undefined ||
+            !verifyAuditChain(organization.id, anchor, auditRecords.filter((record) => record.organizationId === organization.id)).valid)
             throw new TeamControlPlaneError("Audit chain is invalid.");
     }
-    return { schemaVersion: 3, organizations, members, serviceAccounts, projects, environments, tokens, scenarios, evidence, policies, auditAnchors, audit: auditRecords };
+    return {
+        schemaVersion: 3,
+        organizations,
+        members,
+        serviceAccounts,
+        projects,
+        environments,
+        tokens,
+        scenarios,
+        evidence,
+        policies,
+        auditAnchors,
+        audit: auditRecords,
+    };
 }
 function member(value, organizations) {
     const entry = object(value, "Member is invalid.");
     exactKeys(entry, ["id", "organizationId", "role", "createdAt"], "Member");
     const organizationId = identifier(entry.organizationId, "Member organization id");
-    if (!organizations.has(organizationId) || (entry.role !== "owner" && entry.role !== "admin" && entry.role !== "developer" && entry.role !== "viewer"))
+    if (!organizations.has(organizationId) ||
+        (entry.role !== "owner" &&
+            entry.role !== "admin" &&
+            entry.role !== "developer" &&
+            entry.role !== "viewer"))
         throw new TeamControlPlaneError("Member is invalid.");
-    return { id: identifier(entry.id, "Member id"), organizationId, role: entry.role, createdAt: timestamp(entry.createdAt, "Member createdAt") };
+    return {
+        id: identifier(entry.id, "Member id"),
+        organizationId,
+        role: entry.role,
+        createdAt: timestamp(entry.createdAt, "Member createdAt"),
+    };
 }
 function serviceAccount(value, organizations, members) {
     const entry = object(value, "Service account is invalid.");
     exactKeys(entry, ["id", "organizationId", "name", "createdBy", "createdAt", "disabledAt"], "Service account", ["disabledAt"]);
     const organizationId = identifier(entry.organizationId, "Service account organization id");
-    if (!organizations.has(organizationId) || !members.some((member) => member.organizationId === organizationId && member.id === entry.createdBy))
+    if (!organizations.has(organizationId) ||
+        !members.some((member) => member.organizationId === organizationId &&
+            member.id === entry.createdBy))
         throw new TeamControlPlaneError("Service account is invalid.");
-    return { id: identifier(entry.id, "Service account id"), organizationId, name: text(entry.name, "Service account name", 120), createdBy: identifier(entry.createdBy, "Service account creator id"), createdAt: timestamp(entry.createdAt, "Service account createdAt"), ...(entry.disabledAt === undefined ? {} : { disabledAt: timestamp(entry.disabledAt, "Service account disabledAt") }) };
+    return {
+        id: identifier(entry.id, "Service account id"),
+        organizationId,
+        name: text(entry.name, "Service account name", 120),
+        createdBy: identifier(entry.createdBy, "Service account creator id"),
+        createdAt: timestamp(entry.createdAt, "Service account createdAt"),
+        ...(entry.disabledAt === undefined
+            ? {}
+            : {
+                disabledAt: timestamp(entry.disabledAt, "Service account disabledAt"),
+            }),
+    };
 }
 function project(value, organizations) {
     const entry = object(value, "Project is invalid.");
@@ -524,101 +840,277 @@ function project(value, organizations) {
     const organizationId = identifier(entry.organizationId, "Project organization id");
     if (!organizations.has(organizationId))
         throw new TeamControlPlaneError("Project organization is invalid.");
-    return { id: identifier(entry.id, "Project id"), organizationId, name: text(entry.name, "Project name", 120), createdAt: timestamp(entry.createdAt, "Project createdAt") };
+    return {
+        id: identifier(entry.id, "Project id"),
+        organizationId,
+        name: text(entry.name, "Project name", 120),
+        createdAt: timestamp(entry.createdAt, "Project createdAt"),
+    };
 }
 function environment(value, organizations, projects) {
     const entry = object(value, "Environment is invalid.");
     exactKeys(entry, ["id", "organizationId", "projectId", "name", "kind", "createdAt"], "Environment");
     const organizationId = identifier(entry.organizationId, "Environment organization id");
     const projectId = identifier(entry.projectId, "Environment project id");
-    if (!organizations.has(organizationId) || !projects.has(scopedKey(organizationId, projectId)) || (entry.kind !== "development" && entry.kind !== "ci"))
+    if (!organizations.has(organizationId) ||
+        !projects.has(scopedKey(organizationId, projectId)) ||
+        (entry.kind !== "development" && entry.kind !== "ci"))
         throw new TeamControlPlaneError("Environment is invalid.");
-    return { id: identifier(entry.id, "Environment id"), organizationId, projectId, name: text(entry.name, "Environment name", 80), kind: entry.kind, createdAt: timestamp(entry.createdAt, "Environment createdAt") };
+    return {
+        id: identifier(entry.id, "Environment id"),
+        organizationId,
+        projectId,
+        name: text(entry.name, "Environment name", 80),
+        kind: entry.kind,
+        createdAt: timestamp(entry.createdAt, "Environment createdAt"),
+    };
 }
 function token(value, organizations, members, serviceAccounts, projects, environments) {
     const entry = object(value, "Token is invalid.");
-    exactKeys(entry, ["id", "organizationId", "type", "subjectId", "digest", "issuedBy", "issuedAt", "expiresAt", "scope", "revokedAt"], "Token", ["scope", "revokedAt"]);
+    exactKeys(entry, [
+        "id",
+        "organizationId",
+        "type",
+        "subjectId",
+        "digest",
+        "issuedBy",
+        "issuedAt",
+        "expiresAt",
+        "scope",
+        "revokedAt",
+    ], "Token", ["scope", "revokedAt"]);
     const organizationId = identifier(entry.organizationId, "Token organization id");
     const subjectId = identifier(entry.subjectId, "Token subject id");
-    if (!organizations.has(organizationId) || (entry.type !== "user" && entry.type !== "service") || typeof entry.digest !== "string" || !/^[a-f0-9]{64}$/.test(entry.digest))
+    if (!organizations.has(organizationId) ||
+        (entry.type !== "user" && entry.type !== "service") ||
+        typeof entry.digest !== "string" ||
+        !/^[a-f0-9]{64}$/.test(entry.digest))
         throw new TeamControlPlaneError("Token is invalid.");
-    if (entry.type === "user" && !members.some((member) => member.organizationId === organizationId && member.id === subjectId))
+    if (entry.type === "user" &&
+        !members.some((member) => member.organizationId === organizationId && member.id === subjectId))
         throw new TeamControlPlaneError("Token is invalid.");
-    const serviceAccount = entry.type === "service" ? serviceAccounts.find((account) => account.organizationId === organizationId && account.id === subjectId) : undefined;
+    const serviceAccount = entry.type === "service"
+        ? serviceAccounts.find((account) => account.organizationId === organizationId &&
+            account.id === subjectId)
+        : undefined;
     if (entry.type === "service" && serviceAccount === undefined)
         throw new TeamControlPlaneError("Token is invalid.");
-    const scope = entry.type === "service" ? validateTokenScope(entry.scope, { projects, environments }, organizationId) : undefined;
+    const scope = entry.type === "service"
+        ? validateTokenScope(entry.scope, { projects, environments }, organizationId)
+        : undefined;
     if (entry.type === "user" && entry.scope !== undefined)
         throw new TeamControlPlaneError("Token is invalid.");
     if (!actorReferenceExists(organizationId, entry.issuedBy, members, serviceAccounts))
         throw new TeamControlPlaneError("Token is invalid.");
     const issuedAt = timestamp(entry.issuedAt, "Token issuedAt");
     const expiresAt = timestamp(entry.expiresAt, "Token expiresAt");
-    if (new Date(expiresAt).getTime() > new Date(issuedAt).getTime() + 90 * 24 * 60 * 60 * 1000)
+    if (new Date(expiresAt).getTime() >
+        new Date(issuedAt).getTime() + 90 * 24 * 60 * 60 * 1000)
         throw new TeamControlPlaneError("Token is invalid.");
-    const revokedAt = entry.revokedAt === undefined ? undefined : timestamp(entry.revokedAt, "Token revokedAt");
-    if (entry.type === "service" && serviceAccount?.disabledAt !== undefined && revokedAt === undefined)
+    const revokedAt = entry.revokedAt === undefined
+        ? undefined
+        : timestamp(entry.revokedAt, "Token revokedAt");
+    if (entry.type === "service" &&
+        serviceAccount?.disabledAt !== undefined &&
+        revokedAt === undefined)
         throw new TeamControlPlaneError("Token is invalid.");
-    return { id: identifier(entry.id, "Token id"), organizationId, type: entry.type, subjectId, digest: entry.digest, issuedBy: actorReference(entry.issuedBy, "Token issuer id"), issuedAt, expiresAt, ...(scope === undefined ? {} : { scope }), ...(revokedAt === undefined ? {} : { revokedAt }) };
+    return {
+        id: identifier(entry.id, "Token id"),
+        organizationId,
+        type: entry.type,
+        subjectId,
+        digest: entry.digest,
+        issuedBy: actorReference(entry.issuedBy, "Token issuer id"),
+        issuedAt,
+        expiresAt,
+        ...(scope === undefined ? {} : { scope }),
+        ...(revokedAt === undefined ? {} : { revokedAt }),
+    };
 }
 function scenario(value, organizations, projects, environments, actors) {
     const entry = object(value, "Scenario is invalid.");
-    exactKeys(entry, ["organizationId", "projectId", "environmentId", "scenarioId", "version", "title", "metadata", "createdBy", "createdAt"], "Scenario");
+    exactKeys(entry, [
+        "organizationId",
+        "projectId",
+        "environmentId",
+        "scenarioId",
+        "version",
+        "title",
+        "metadata",
+        "createdBy",
+        "createdAt",
+    ], "Scenario");
     const organizationId = identifier(entry.organizationId, "Scenario organization id");
     const projectId = identifier(entry.projectId, "Scenario project id");
     const environmentId = identifier(entry.environmentId, "Scenario environment id");
-    if (!organizations.has(organizationId) || !projects.has(scopedKey(organizationId, projectId)) || environments.get(scopedKey(organizationId, projectId, environmentId)) === undefined || !actors.has(scopedKey(organizationId, actorReference(entry.createdBy, "Scenario creator id"))))
+    if (!organizations.has(organizationId) ||
+        !projects.has(scopedKey(organizationId, projectId)) ||
+        environments.get(scopedKey(organizationId, projectId, environmentId)) ===
+            undefined ||
+        !actors.has(scopedKey(organizationId, actorReference(entry.createdBy, "Scenario creator id"))))
         throw new TeamControlPlaneError("Scenario is invalid.");
-    return { organizationId, projectId, environmentId, scenarioId: identifier(entry.scenarioId, "Scenario id"), version: positiveInteger(entry.version, "Scenario version"), title: text(entry.title, "Scenario title", 160), metadata: safeJson(entry.metadata, "Scenario metadata", 16 * 1024), createdBy: actorReference(entry.createdBy, "Scenario creator id"), createdAt: timestamp(entry.createdAt, "Scenario createdAt") };
+    return {
+        organizationId,
+        projectId,
+        environmentId,
+        scenarioId: identifier(entry.scenarioId, "Scenario id"),
+        version: positiveInteger(entry.version, "Scenario version"),
+        title: text(entry.title, "Scenario title", 160),
+        metadata: safeJson(entry.metadata, "Scenario metadata", 16 * 1024),
+        createdBy: actorReference(entry.createdBy, "Scenario creator id"),
+        createdAt: timestamp(entry.createdAt, "Scenario createdAt"),
+    };
 }
 function evidenceRecord(value, organizations, projects, environments, actors) {
     const entry = object(value, "Evidence is invalid.");
-    exactKeys(entry, ["id", "organizationId", "projectId", "environmentId", "runId", "evidenceHash", "status", "passed", "failCount", "warningCount", "providers", "scenarios", "enforcement", "uploadedBy", "uploadedAt", "expiresAt"], "Evidence");
+    exactKeys(entry, [
+        "id",
+        "organizationId",
+        "projectId",
+        "environmentId",
+        "runId",
+        "evidenceHash",
+        "status",
+        "passed",
+        "failCount",
+        "warningCount",
+        "providers",
+        "scenarios",
+        "enforcement",
+        "uploadedBy",
+        "uploadedAt",
+        "expiresAt",
+    ], "Evidence");
     const organizationId = identifier(entry.organizationId, "Evidence organization id");
     const projectId = identifier(entry.projectId, "Evidence project id");
     const environmentId = identifier(entry.environmentId, "Evidence environment id");
     const enforcement = object(entry.enforcement, "Evidence enforcement is invalid.");
     exactKeys(enforcement, ["mode", "isolated", "degraded"], "Evidence enforcement");
-    if (!organizations.has(organizationId) || !projects.has(scopedKey(organizationId, projectId)) || environments.get(scopedKey(organizationId, projectId, environmentId)) === undefined || !actors.has(scopedKey(organizationId, actorReference(entry.uploadedBy, "Evidence uploader id"))) || typeof entry.evidenceHash !== "string" || !/^[a-f0-9]{64}$/.test(entry.evidenceHash) || !runStatus(entry.status) || typeof entry.passed !== "boolean" || !nonNegativeInteger(entry.failCount) || !nonNegativeInteger(entry.warningCount) || !evidenceMode(enforcement.mode) || typeof enforcement.isolated !== "boolean" || typeof enforcement.degraded !== "boolean")
+    if (!organizations.has(organizationId) ||
+        !projects.has(scopedKey(organizationId, projectId)) ||
+        environments.get(scopedKey(organizationId, projectId, environmentId)) ===
+            undefined ||
+        !actors.has(scopedKey(organizationId, actorReference(entry.uploadedBy, "Evidence uploader id"))) ||
+        typeof entry.evidenceHash !== "string" ||
+        !/^[a-f0-9]{64}$/.test(entry.evidenceHash) ||
+        !runStatus(entry.status) ||
+        typeof entry.passed !== "boolean" ||
+        !nonNegativeInteger(entry.failCount) ||
+        !nonNegativeInteger(entry.warningCount) ||
+        !evidenceMode(enforcement.mode) ||
+        typeof enforcement.isolated !== "boolean" ||
+        typeof enforcement.degraded !== "boolean")
         throw new TeamControlPlaneError("Evidence is invalid.");
-    return { id: identifier(entry.id, "Evidence id"), organizationId, projectId, environmentId, runId: runId(entry.runId), evidenceHash: entry.evidenceHash, status: entry.status, passed: entry.passed, failCount: entry.failCount, warningCount: entry.warningCount, providers: list(entry.providers, "Evidence providers"), scenarios: list(entry.scenarios, "Evidence scenarios", true), enforcement: { mode: enforcement.mode, isolated: enforcement.isolated, degraded: enforcement.degraded }, uploadedBy: actorReference(entry.uploadedBy, "Evidence uploader id"), uploadedAt: timestamp(entry.uploadedAt, "Evidence uploadedAt"), expiresAt: timestamp(entry.expiresAt, "Evidence expiresAt") };
+    return {
+        id: identifier(entry.id, "Evidence id"),
+        organizationId,
+        projectId,
+        environmentId,
+        runId: runId(entry.runId),
+        evidenceHash: entry.evidenceHash,
+        status: entry.status,
+        passed: entry.passed,
+        failCount: entry.failCount,
+        warningCount: entry.warningCount,
+        providers: list(entry.providers, "Evidence providers"),
+        scenarios: list(entry.scenarios, "Evidence scenarios", true),
+        enforcement: {
+            mode: enforcement.mode,
+            isolated: enforcement.isolated,
+            degraded: enforcement.degraded,
+        },
+        uploadedBy: actorReference(entry.uploadedBy, "Evidence uploader id"),
+        uploadedAt: timestamp(entry.uploadedAt, "Evidence uploadedAt"),
+        expiresAt: timestamp(entry.expiresAt, "Evidence expiresAt"),
+    };
 }
 function policyVersion(value, organizations, actors) {
     const entry = object(value, "Policy is invalid.");
-    exactKeys(entry, ["organizationId", "version", "policy", "hash", "distributedBy", "distributedAt"], "Policy");
+    exactKeys(entry, [
+        "organizationId",
+        "version",
+        "policy",
+        "hash",
+        "distributedBy",
+        "distributedAt",
+    ], "Policy");
     const organizationId = identifier(entry.organizationId, "Policy organization id");
     const policy = safeJson(entry.policy, "Team policy", 32 * 1024);
     validatePolicy(policy);
-    if (!organizations.has(organizationId) || !actors.has(scopedKey(organizationId, actorReference(entry.distributedBy, "Policy distributor id"))) || typeof entry.hash !== "string" || entry.hash !== stableHash(policy))
+    if (!organizations.has(organizationId) ||
+        !actors.has(scopedKey(organizationId, actorReference(entry.distributedBy, "Policy distributor id"))) ||
+        typeof entry.hash !== "string" ||
+        entry.hash !== stableHash(policy))
         throw new TeamControlPlaneError("Policy is invalid.");
-    return { organizationId, version: positiveInteger(entry.version, "Policy version"), policy, hash: entry.hash, distributedBy: actorReference(entry.distributedBy, "Policy distributor id"), distributedAt: timestamp(entry.distributedAt, "Policy distributedAt") };
+    return {
+        organizationId,
+        version: positiveInteger(entry.version, "Policy version"),
+        policy,
+        hash: entry.hash,
+        distributedBy: actorReference(entry.distributedBy, "Policy distributor id"),
+        distributedAt: timestamp(entry.distributedAt, "Policy distributedAt"),
+    };
 }
 function auditAnchor(value, organizations) {
     const entry = object(value, "Audit anchor is invalid.");
     exactKeys(entry, ["organizationId", "sequence", "hash"], "Audit anchor");
     const organizationId = identifier(entry.organizationId, "Audit anchor organization id");
-    if (!organizations.has(organizationId) || !nonNegativeInteger(entry.sequence) || typeof entry.hash !== "string" || !/^[a-f0-9]{64}$/.test(entry.hash))
+    if (!organizations.has(organizationId) ||
+        !nonNegativeInteger(entry.sequence) ||
+        typeof entry.hash !== "string" ||
+        !/^[a-f0-9]{64}$/.test(entry.hash))
         throw new TeamControlPlaneError("Audit anchor is invalid.");
     return { organizationId, sequence: entry.sequence, hash: entry.hash };
 }
 function auditRecord(value, organizations, members, serviceAccounts) {
     const entry = object(value, "Audit record is invalid.");
-    exactKeys(entry, ["organizationId", "sequence", "actorId", "action", "resource", "timestamp", "previousHash", "recordHash"], "Audit record");
+    exactKeys(entry, [
+        "organizationId",
+        "sequence",
+        "actorId",
+        "action",
+        "resource",
+        "timestamp",
+        "previousHash",
+        "recordHash",
+    ], "Audit record");
     const organizationId = identifier(entry.organizationId, "Audit organization id");
     const actorIdValue = actorReference(entry.actorId, "Audit actor id");
     const sequence = positiveInteger(entry.sequence, "Audit sequence");
-    if (!organizations.has(organizationId) || ((members.length > 0 || serviceAccounts.length > 0) && !actorReferenceExists(organizationId, actorIdValue, members, serviceAccounts)) || typeof entry.previousHash !== "string" || !/^[a-f0-9]{64}$/.test(entry.previousHash) || typeof entry.recordHash !== "string" || !/^[a-f0-9]{64}$/.test(entry.recordHash))
+    if (!organizations.has(organizationId) ||
+        ((members.length > 0 || serviceAccounts.length > 0) &&
+            !actorReferenceExists(organizationId, actorIdValue, members, serviceAccounts)) ||
+        typeof entry.previousHash !== "string" ||
+        !/^[a-f0-9]{64}$/.test(entry.previousHash) ||
+        typeof entry.recordHash !== "string" ||
+        !/^[a-f0-9]{64}$/.test(entry.recordHash))
         throw new TeamControlPlaneError("Audit record is invalid.");
-    return { organizationId, sequence, actorId: actorIdValue, action: text(entry.action, "Audit action", 80), resource: text(entry.resource, "Audit resource", 160), timestamp: timestamp(entry.timestamp, "Audit timestamp"), previousHash: entry.previousHash, recordHash: entry.recordHash };
+    return {
+        organizationId,
+        sequence,
+        actorId: actorIdValue,
+        action: text(entry.action, "Audit action", 80),
+        resource: text(entry.resource, "Audit resource", 160),
+        timestamp: timestamp(entry.timestamp, "Audit timestamp"),
+        previousHash: entry.previousHash,
+        recordHash: entry.recordHash,
+    };
 }
 function legacyAuditRecord(value, organizations, members) {
     const entry = object(value, "Audit record is invalid.");
     exactKeys(entry, ["organizationId", "actorId", "action", "resource", "timestamp"], "Audit record");
     const organizationId = identifier(entry.organizationId, "Audit organization id");
     const actorIdValue = identifier(entry.actorId, "Audit actor id");
-    if (!organizations.has(organizationId) || !members.some((member) => member.organizationId === organizationId && member.id === actorIdValue))
+    if (!organizations.has(organizationId) ||
+        !members.some((member) => member.organizationId === organizationId && member.id === actorIdValue))
         throw new TeamControlPlaneError("Audit record is invalid.");
-    return { organizationId, actorId: actorIdValue, action: text(entry.action, "Audit action", 80), resource: text(entry.resource, "Audit resource", 160), timestamp: timestamp(entry.timestamp, "Audit timestamp") };
+    return {
+        organizationId,
+        actorId: actorIdValue,
+        action: text(entry.action, "Audit action", 80),
+        resource: text(entry.resource, "Audit resource", 160),
+        timestamp: timestamp(entry.timestamp, "Audit timestamp"),
+    };
 }
 function requirePermission(state, actor, permission) {
     const role = actorRole(state, actor);
@@ -627,17 +1119,21 @@ function requirePermission(state, actor, permission) {
 }
 function requireScopedPermission(state, actor, permission, projectId, environmentId) {
     requirePermission(state, actor, permission);
-    if (isServiceActor(actor) && !serviceTokenScopes(state, actor).some((scope) => scope.projectId === projectId && scope.environmentId === environmentId && scope.permissions.includes(permission)))
+    if (isServiceActor(actor) &&
+        !serviceTokenScopes(state, actor).some((scope) => scope.projectId === projectId &&
+            scope.environmentId === environmentId &&
+            scope.permissions.includes(permission)))
         throw new TeamControlPlaneError("Access denied.");
 }
 const MEMBER_TOKEN_MANAGEMENT_MATRIX = Object.freeze({
     owner: ["owner", "admin", "developer", "viewer"],
     admin: ["admin", "developer", "viewer"],
     developer: [],
-    viewer: []
+    viewer: [],
 });
 function canManageMemberToken(actor, subject) {
-    return actor !== "service_account" && MEMBER_TOKEN_MANAGEMENT_MATRIX[actor].includes(subject);
+    return (actor !== "service_account" &&
+        MEMBER_TOKEN_MANAGEMENT_MATRIX[actor].includes(subject));
 }
 function actorRole(state, actor) {
     const organizationId = identifier(actor.organizationId, "Organization id");
@@ -645,7 +1141,9 @@ function actorRole(state, actor) {
         if (!authenticatedServiceActors.has(actor))
             throw new TeamControlPlaneError("Access denied.");
         const serviceAccountId = identifier(actor.serviceAccountId, "Service account id");
-        const account = state.serviceAccounts.find((candidate) => candidate.organizationId === organizationId && candidate.id === serviceAccountId && candidate.disabledAt === undefined);
+        const account = state.serviceAccounts.find((candidate) => candidate.organizationId === organizationId &&
+            candidate.id === serviceAccountId &&
+            candidate.disabledAt === undefined);
         if (account === undefined)
             throw new TeamControlPlaneError("Access denied.");
         serviceTokenScopes(state, actor);
@@ -666,17 +1164,22 @@ function requireMember(state, actor) {
     return member;
 }
 function requireServiceAccount(state, organizationId, serviceAccountId) {
-    const account = state.serviceAccounts.find((candidate) => candidate.organizationId === organizationId && candidate.id === serviceAccountId && candidate.disabledAt === undefined);
+    const account = state.serviceAccounts.find((candidate) => candidate.organizationId === organizationId &&
+        candidate.id === serviceAccountId &&
+        candidate.disabledAt === undefined);
     if (account === undefined)
         throw new TeamControlPlaneError("Resource not found.");
     return account;
 }
 function requireProject(state, organizationId, projectId) {
-    if (!state.projects.some((candidate) => candidate.organizationId === organizationId && candidate.id === projectId))
+    if (!state.projects.some((candidate) => candidate.organizationId === organizationId &&
+        candidate.id === projectId))
         throw new TeamControlPlaneError("Resource not found.");
 }
 function requireEnvironment(state, organizationId, projectId, environmentId) {
-    if (!state.environments.some((candidate) => candidate.organizationId === organizationId && candidate.projectId === projectId && candidate.id === environmentId))
+    if (!state.environments.some((candidate) => candidate.organizationId === organizationId &&
+        candidate.projectId === projectId &&
+        candidate.id === environmentId))
         throw new TeamControlPlaneError("Resource not found.");
 }
 function issueTokenRecord(state, input, issuedAt, random) {
@@ -686,7 +1189,19 @@ function issueTokenRecord(state, input, issuedAt, random) {
         const digest = hash(token);
         if (state.tokens.some((candidate) => candidate.id === tokenId || equalHash(candidate.digest, digest)))
             continue;
-        state.tokens.push({ id: tokenId, organizationId: input.organizationId, type: input.type, subjectId: input.subjectId, digest, issuedBy: input.issuedBy, issuedAt, expiresAt: input.expiresAt, ...(input.scope === undefined ? {} : { scope: structuredClone(input.scope) }) });
+        state.tokens.push({
+            id: tokenId,
+            organizationId: input.organizationId,
+            type: input.type,
+            subjectId: input.subjectId,
+            digest,
+            issuedBy: input.issuedBy,
+            issuedAt,
+            expiresAt: input.expiresAt,
+            ...(input.scope === undefined
+                ? {}
+                : { scope: structuredClone(input.scope) }),
+        });
         return { tokenId, token, expiresAt: input.expiresAt };
     }
     throw new TeamControlPlaneError("Unable to allocate a unique token.");
@@ -699,19 +1214,46 @@ function appendAudit(state, organizationId, actorIdValue, action, resource, time
     const previous = records.at(-1);
     const sequence = previous === undefined ? anchor.sequence + 1 : previous.sequence + 1;
     const previousHash = previous === undefined ? anchor.hash : previous.recordHash;
-    const recordWithoutHash = { organizationId, sequence, actorId: actorIdValue, action, resource, timestamp: timestampValue, previousHash };
-    state.audit.push({ ...recordWithoutHash, recordHash: stableHash(recordWithoutHash) });
+    const recordWithoutHash = {
+        organizationId,
+        sequence,
+        actorId: actorIdValue,
+        action,
+        resource,
+        timestamp: timestampValue,
+        previousHash,
+    };
+    state.audit.push({
+        ...recordWithoutHash,
+        recordHash: stableHash(recordWithoutHash),
+    });
 }
 function verifyAuditChain(organizationId, anchor, records) {
     try {
         if (anchor.organizationId !== organizationId)
-            return { valid: false, reason: "Audit anchor organization does not match." };
+            return {
+                valid: false,
+                reason: "Audit anchor organization does not match.",
+            };
         let expectedSequence = anchor.sequence + 1;
         let previousHash = anchor.hash;
         for (const record of records) {
-            if (record.organizationId !== organizationId || record.sequence !== expectedSequence || record.previousHash !== previousHash)
-                return { valid: false, reason: "Audit sequence or previous hash is invalid." };
-            const expectedHash = stableHash({ organizationId: record.organizationId, sequence: record.sequence, actorId: record.actorId, action: record.action, resource: record.resource, timestamp: record.timestamp, previousHash: record.previousHash });
+            if (record.organizationId !== organizationId ||
+                record.sequence !== expectedSequence ||
+                record.previousHash !== previousHash)
+                return {
+                    valid: false,
+                    reason: "Audit sequence or previous hash is invalid.",
+                };
+            const expectedHash = stableHash({
+                organizationId: record.organizationId,
+                sequence: record.sequence,
+                actorId: record.actorId,
+                action: record.action,
+                resource: record.resource,
+                timestamp: record.timestamp,
+                previousHash: record.previousHash,
+            });
             if (!equalHash(record.recordHash, expectedHash))
                 return { valid: false, reason: "Audit record hash is invalid." };
             expectedSequence += 1;
@@ -732,8 +1274,12 @@ function retain(state, now) {
 }
 function pruneAudit(state, organizationId, now) {
     const cutoff = addDays(now, -AUDIT_RETENTION_DAYS);
-    const all = state.audit.filter((entry) => entry.organizationId === organizationId).sort((left, right) => left.sequence - right.sequence);
-    const retained = all.filter((entry) => entry.timestamp >= cutoff).slice(-MAX_AUDIT_PER_ORGANIZATION);
+    const all = state.audit
+        .filter((entry) => entry.organizationId === organizationId)
+        .sort((left, right) => left.sequence - right.sequence);
+    const retained = all
+        .filter((entry) => entry.timestamp >= cutoff)
+        .slice(-MAX_AUDIT_PER_ORGANIZATION);
     if (retained.length === all.length)
         return;
     const removed = all.slice(0, all.length - retained.length);
@@ -748,7 +1294,10 @@ function pruneAudit(state, organizationId, now) {
     state.audit = state.audit.filter((entry) => entry.organizationId !== organizationId || retained.includes(entry));
 }
 function newest(entries, organizationId, max, key) {
-    const allowed = new Set(entries.filter((entry) => entry.organizationId === organizationId).sort((left, right) => key(right).localeCompare(key(left))).slice(0, max));
+    const allowed = new Set(entries
+        .filter((entry) => entry.organizationId === organizationId)
+        .sort((left, right) => key(right).localeCompare(key(left)))
+        .slice(0, max));
     return entries.filter((entry) => entry.organizationId !== organizationId || allowed.has(entry));
 }
 function validateTokenScope(value, state, organizationId) {
@@ -757,10 +1306,15 @@ function validateTokenScope(value, state, organizationId) {
         exactKeys(entry, ["projectId", "environmentId", "permissions"], "Service token scope");
         const projectId = identifier(entry.projectId, "Service token scope project id");
         const environmentId = identifier(entry.environmentId, "Service token scope environment id");
-        if (!state.projects.some((project) => project.organizationId === organizationId && project.id === projectId) || !state.environments.some((environment) => environment.organizationId === organizationId && environment.projectId === projectId && environment.id === environmentId))
+        if (!state.projects.some((project) => project.organizationId === organizationId && project.id === projectId) ||
+            !state.environments.some((environment) => environment.organizationId === organizationId &&
+                environment.projectId === projectId &&
+                environment.id === environmentId))
             throw new TeamControlPlaneError("Service token scope is invalid.");
         const permissions = array(entry.permissions, "Service token permissions", SERVICE_ACCOUNT_PERMISSIONS.length).map((permission) => {
-            if (typeof permission !== "string" || !isScopedPermission(permission) || !SERVICE_ACCOUNT_PERMISSIONS.includes(permission))
+            if (typeof permission !== "string" ||
+                !isScopedPermission(permission) ||
+                !SERVICE_ACCOUNT_PERMISSIONS.includes(permission))
                 throw new TeamControlPlaneError("Service token permissions are invalid.");
             return permission;
         });
@@ -775,7 +1329,10 @@ function validateTokenScope(value, state, organizationId) {
     return scopes.sort((left, right) => scopedKey(left.projectId, left.environmentId).localeCompare(scopedKey(right.projectId, right.environmentId)));
 }
 function canReadEvidence(state, actor, evidence) {
-    return !isServiceActor(actor) || serviceTokenScopes(state, actor).some((scope) => scope.projectId === evidence.projectId && scope.environmentId === evidence.environmentId && scope.permissions.includes("evidence.read"));
+    return (!isServiceActor(actor) ||
+        serviceTokenScopes(state, actor).some((scope) => scope.projectId === evidence.projectId &&
+            scope.environmentId === evidence.environmentId &&
+            scope.permissions.includes("evidence.read")));
 }
 function isServiceActor(actor) {
     return actor.actorType === "service_account";
@@ -785,13 +1342,20 @@ function serviceTokenScopes(state, actor) {
     if (clock === undefined)
         throw new TeamControlPlaneError("Access denied.");
     const tokenId = identifier(actor.tokenId, "Token id");
-    const token = state.tokens.find((candidate) => candidate.id === tokenId && candidate.organizationId === actor.organizationId && candidate.type === "service" && candidate.subjectId === actor.serviceAccountId);
-    if (token === undefined || token.revokedAt !== undefined || new Date(token.expiresAt).getTime() <= clock().getTime())
+    const token = state.tokens.find((candidate) => candidate.id === tokenId &&
+        candidate.organizationId === actor.organizationId &&
+        candidate.type === "service" &&
+        candidate.subjectId === actor.serviceAccountId);
+    if (token === undefined ||
+        token.revokedAt !== undefined ||
+        new Date(token.expiresAt).getTime() <= clock().getTime())
         throw new TeamControlPlaneError("Access denied.");
     return validateTokenScope(token.scope, state, actor.organizationId);
 }
 function actorId(actor) {
-    return isServiceActor(actor) ? `service:${identifier(actor.serviceAccountId, "Service account id")}` : identifier(actor.memberId, "Member id");
+    return isServiceActor(actor)
+        ? `service:${identifier(actor.serviceAccountId, "Service account id")}`
+        : identifier(actor.memberId, "Member id");
 }
 function userActorId(actor) {
     if (isServiceActor(actor))
@@ -806,17 +1370,28 @@ function actorReference(value, label) {
     return identifier(value, label);
 }
 function actorReferenceIds(members, serviceAccounts) {
-    return new Set([...members.map((member) => scopedKey(member.organizationId, member.id)), ...serviceAccounts.map((account) => scopedKey(account.organizationId, `service:${account.id}`))]);
+    return new Set([
+        ...members.map((member) => scopedKey(member.organizationId, member.id)),
+        ...serviceAccounts.map((account) => scopedKey(account.organizationId, `service:${account.id}`)),
+    ]);
 }
 function actorReferenceExists(organizationId, actorIdValue, members, serviceAccounts) {
     const id = actorReference(actorIdValue, "Actor id");
-    return members.some((member) => member.organizationId === organizationId && member.id === id) || (id.startsWith("service:") && serviceAccounts.some((account) => account.organizationId === organizationId && account.id === id.slice("service:".length)));
+    return (members.some((member) => member.organizationId === organizationId && member.id === id) ||
+        (id.startsWith("service:") &&
+            serviceAccounts.some((account) => account.organizationId === organizationId &&
+                account.id === id.slice("service:".length))));
 }
 function rejectRawEvidence(report) {
     const encoded = JSON.stringify(report);
     if (Buffer.byteLength(encoded, "utf8") > 512 * 1024)
         throw new TeamControlPlaneError("Evidence artifact exceeds 524288 bytes.");
-    const prohibited = new Set(["authorization", "cookie", "set-cookie", "rawbody"]);
+    const prohibited = new Set([
+        "authorization",
+        "cookie",
+        "set-cookie",
+        "rawbody",
+    ]);
     const visit = (value, key) => {
         if (key !== undefined && prohibited.has(key.toLowerCase()))
             throw new TeamControlPlaneError("Evidence artifact contains an unsafe raw field.");
@@ -867,52 +1442,149 @@ function inspectJson(value, label, depth, key) {
 }
 function validatePolicy(policy) {
     const candidate = policy;
-    if (candidate.version !== 1 || !plainObject(candidate.network) || !plainObject(candidate.credentials) || !Array.isArray(candidate.requiredScenarios) || !plainObject(candidate.enforcement) || !plainObject(candidate.reports))
+    if (candidate.version !== 1 ||
+        !plainObject(candidate.network) ||
+        !plainObject(candidate.credentials) ||
+        !Array.isArray(candidate.requiredScenarios) ||
+        !plainObject(candidate.enforcement) ||
+        !plainObject(candidate.reports))
         throw new TeamControlPlaneError("Team policy does not match GhostAPI policy schema v1.");
 }
-function hash(value) { return createHash("sha256").update(value).digest("hex"); }
-function stableHash(value) { return createHash("sha256").update(stableStringify(value)).digest("hex"); }
-function auditGenesisHash(organizationId) { return hash(`ghostapi-team-audit-v3:${organizationId}`); }
-function equalHash(left, right) { return /^[a-f0-9]{64}$/.test(left) && /^[a-f0-9]{64}$/.test(right) && timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex")); }
+function hash(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function stableHash(value) {
+    return createHash("sha256").update(stableStringify(value)).digest("hex");
+}
+function auditGenesisHash(organizationId) {
+    return hash(`ghostapi-team-audit-v3:${organizationId}`);
+}
+function equalHash(left, right) {
+    return (/^[a-f0-9]{64}$/.test(left) &&
+        /^[a-f0-9]{64}$/.test(right) &&
+        timingSafeEqual(Buffer.from(left, "hex"), Buffer.from(right, "hex")));
+}
 function stableStringify(value) {
     if (value === null || typeof value !== "object")
         return JSON.stringify(value);
     if (Array.isArray(value))
         return `[${value.map(stableStringify).join(",")}]`;
-    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
-}
-function scopedKey(...parts) { return parts.join("\u0000"); }
-function identifier(value, label) { if (typeof value !== "string" || !IDENTIFIER.test(value))
-    throw new TeamControlPlaneError(`${label} must be 1-64 lowercase letters, numbers, underscores, or hyphens.`); return value; }
-function runId(value) { if (typeof value !== "string" || value.length === 0 || value.length > 128 || /[\u0000-\u001f]/.test(value) || sanitizeSecretString(value) !== value)
-    throw new TeamControlPlaneError("Evidence run id is invalid."); return value; }
-function text(value, label, max) { if (typeof value !== "string" || value.trim() === "" || value.length > max || /[\u0000-\u001f]/.test(value) || sanitizeSecretString(value) !== value)
-    throw new TeamControlPlaneError(`${label} is invalid.`); return value.trim(); }
-function timestamp(value, label) { if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) || Number.isNaN(new Date(value).getTime()))
-    throw new TeamControlPlaneError(`${label} is invalid.`); return value; }
-function futureTimestamp(value, now) { const result = timestamp(value, "Token expiry"); const milliseconds = new Date(result).getTime(); if (milliseconds <= now.getTime() || milliseconds > now.getTime() + 90 * 24 * 60 * 60 * 1000)
-    throw new TeamControlPlaneError("Token expiry must be within the next 90 days."); return result; }
-function positiveInteger(value, label) { if (!nonNegativeInteger(value) || value < 1 || value > 100_000)
-    throw new TeamControlPlaneError(`${label} is invalid.`); return value; }
-function nonNegativeInteger(value) { return typeof value === "number" && Number.isInteger(value) && value >= 0; }
-function list(value, label, dotted = false) { if (!Array.isArray(value) || value.length > 100)
-    throw new TeamControlPlaneError(`${label} are invalid.`); const result = value.map((entry) => { if (typeof entry !== "string" || (dotted ? !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(entry) : !IDENTIFIER.test(entry)))
-    throw new TeamControlPlaneError(`${label} are invalid.`); return entry; }); unique(result, label); return result.sort(); }
-function object(value, message) { if (!plainObject(value))
-    throw new TeamControlPlaneError(message); return value; }
-function plainObject(value) { return value !== null && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype; }
-function array(value, label, max) { if (!Array.isArray(value) || value.length > max)
-    throw new TeamControlPlaneError(`${label} are invalid.`); return value; }
-function exactKeys(value, allowed, label, optional = []) { for (const key of Object.keys(value))
-    if (!allowed.includes(key))
-        throw new TeamControlPlaneError(`${label} contains unsupported field: ${key}.`); for (const key of allowed)
-    if (!optional.includes(key) && !(key in value))
-        throw new TeamControlPlaneError(`${label} is missing field: ${key}.`); }
-function unique(values, label) { if (new Set(values).size !== values.length)
-    throw new TeamControlPlaneError(`${label} must be unique.`); }
-function runStatus(value) { return value === "unknown" || value === "preparing" || value === "running" || value === "failed-to-start" || value === "finished"; }
-function evidenceMode(value) { return value === "linux-network-namespace" || value === "proxy-guidance" || value === "unknown"; }
-function isScopedPermission(value) { return READ_PERMISSIONS.includes(value) || PUBLISH_PERMISSIONS.includes(value); }
-function addDays(value, days) { return new Date(new Date(value).getTime() + days * 24 * 60 * 60 * 1000).toISOString(); }
-function isErrorCode(error, code) { return error instanceof Error && "code" in error && error.code === code; }
+    return `{${Object.keys(value)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`)
+        .join(",")}}`;
+}
+function scopedKey(...parts) {
+    return parts.join("\u0000");
+}
+function identifier(value, label) {
+    if (typeof value !== "string" || !IDENTIFIER.test(value))
+        throw new TeamControlPlaneError(`${label} must be 1-64 lowercase letters, numbers, underscores, or hyphens.`);
+    return value;
+}
+function runId(value) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > 128 ||
+        /[\u0000-\u001f]/.test(value) ||
+        sanitizeSecretString(value) !== value)
+        throw new TeamControlPlaneError("Evidence run id is invalid.");
+    return value;
+}
+function text(value, label, max) {
+    if (typeof value !== "string" ||
+        value.trim() === "" ||
+        value.length > max ||
+        /[\u0000-\u001f]/.test(value) ||
+        sanitizeSecretString(value) !== value)
+        throw new TeamControlPlaneError(`${label} is invalid.`);
+    return value.trim();
+}
+function timestamp(value, label) {
+    if (typeof value !== "string" ||
+        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) ||
+        Number.isNaN(new Date(value).getTime()))
+        throw new TeamControlPlaneError(`${label} is invalid.`);
+    return value;
+}
+function futureTimestamp(value, now) {
+    const result = timestamp(value, "Token expiry");
+    const milliseconds = new Date(result).getTime();
+    if (milliseconds <= now.getTime() ||
+        milliseconds > now.getTime() + 90 * 24 * 60 * 60 * 1000)
+        throw new TeamControlPlaneError("Token expiry must be within the next 90 days.");
+    return result;
+}
+function positiveInteger(value, label) {
+    if (!nonNegativeInteger(value) || value < 1 || value > 100_000)
+        throw new TeamControlPlaneError(`${label} is invalid.`);
+    return value;
+}
+function nonNegativeInteger(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function list(value, label, dotted = false) {
+    if (!Array.isArray(value) || value.length > 100)
+        throw new TeamControlPlaneError(`${label} are invalid.`);
+    const result = value.map((entry) => {
+        if (typeof entry !== "string" ||
+            (dotted
+                ? !/^[a-z0-9][a-z0-9._-]{0,127}$/.test(entry)
+                : !IDENTIFIER.test(entry)))
+            throw new TeamControlPlaneError(`${label} are invalid.`);
+        return entry;
+    });
+    unique(result, label);
+    return result.sort();
+}
+function object(value, message) {
+    if (!plainObject(value))
+        throw new TeamControlPlaneError(message);
+    return value;
+}
+function plainObject(value) {
+    return (value !== null &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        Object.getPrototypeOf(value) === Object.prototype);
+}
+function array(value, label, max) {
+    if (!Array.isArray(value) || value.length > max)
+        throw new TeamControlPlaneError(`${label} are invalid.`);
+    return value;
+}
+function exactKeys(value, allowed, label, optional = []) {
+    for (const key of Object.keys(value))
+        if (!allowed.includes(key))
+            throw new TeamControlPlaneError(`${label} contains unsupported field: ${key}.`);
+    for (const key of allowed)
+        if (!optional.includes(key) && !(key in value))
+            throw new TeamControlPlaneError(`${label} is missing field: ${key}.`);
+}
+function unique(values, label) {
+    if (new Set(values).size !== values.length)
+        throw new TeamControlPlaneError(`${label} must be unique.`);
+}
+function runStatus(value) {
+    return (value === "unknown" ||
+        value === "preparing" ||
+        value === "running" ||
+        value === "failed-to-start" ||
+        value === "finished");
+}
+function evidenceMode(value) {
+    return (value === "linux-network-namespace" ||
+        value === "proxy-guidance" ||
+        value === "unknown");
+}
+function isScopedPermission(value) {
+    return (READ_PERMISSIONS.includes(value) ||
+        PUBLISH_PERMISSIONS.includes(value));
+}
+function addDays(value, days) {
+    return new Date(new Date(value).getTime() + days * 24 * 60 * 60 * 1000).toISOString();
+}
+function isErrorCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
 //# sourceMappingURL=controlPlane.js.map