@atlasent/sdk 1.5.0

package/dist/hono.cjs

@@ -0,0 +1,580 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/hono.ts
+var hono_exports = {};
+__export(hono_exports, {
+  AtlaSentDeniedError: () => AtlaSentDeniedError,
+  AtlaSentError: () => AtlaSentError,
+  atlaSentErrorHandler: () => atlaSentErrorHandler,
+  atlaSentGuard: () => atlaSentGuard
+});
+module.exports = __toCommonJS(hono_exports);
+
+// src/errors.ts
+var AtlaSentError = class extends Error {
+  // Subclasses override to their own literal (e.g. "AtlaSentDeniedError");
+  // keep this assignable rather than pinned to a single literal.
+  name = "AtlaSentError";
+  /** HTTP status code, when the error originated from an API response. */
+  status;
+  /** Coarse category — useful for `switch` statements at call sites. */
+  code;
+  /** Correlation ID echoed from the `X-Request-ID` header the SDK sent. */
+  requestId;
+  /** Parsed `Retry-After` header value, in milliseconds. Only set for 429. */
+  retryAfterMs;
+  constructor(message, init = {}) {
+    super(
+      message,
+      init.cause !== void 0 ? { cause: init.cause } : void 0
+    );
+    this.status = init.status;
+    this.code = init.code;
+    this.requestId = init.requestId;
+    this.retryAfterMs = init.retryAfterMs;
+  }
+};
+var AtlaSentDeniedError = class extends AtlaSentError {
+  name = "AtlaSentDeniedError";
+  /** Policy decision — `"deny"` today; `"hold"` / `"escalate"` reserved. */
+  decision;
+  /** Opaque permit/decision id from `/v1-evaluate`. */
+  evaluationId;
+  /** Human-readable explanation from the policy engine, if provided. */
+  reason;
+  /** Hash-chained audit-trail entry associated with the decision. */
+  auditHash;
+  constructor(init) {
+    const msg = init.reason ? `AtlaSent ${init.decision}: ${init.reason}` : `AtlaSent ${init.decision}`;
+    const errInit = { status: 200 };
+    if (init.requestId !== void 0) errInit.requestId = init.requestId;
+    super(msg, errInit);
+    this.decision = init.decision;
+    this.evaluationId = init.evaluationId;
+    this.reason = init.reason;
+    this.auditHash = init.auditHash;
+  }
+};
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.atlasent.io";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var SDK_VERSION = "0.1.0";
+var AtlaSentClient = class {
+  apiKey;
+  baseUrl;
+  timeoutMs;
+  fetchImpl;
+  constructor(options) {
+    if (!options.apiKey || typeof options.apiKey !== "string") {
+      throw new AtlaSentError("apiKey is required", {
+        code: "invalid_api_key"
+      });
+    }
+    this.apiKey = options.apiKey;
+    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+  /**
+   * Ask the policy engine whether an agent action is permitted.
+   *
+   * A "DENY" is **not** thrown — it is returned in
+   * `response.decision`. Network errors, invalid API key, rate
+   * limits, timeouts, and malformed responses throw
+   * {@link AtlaSentError}.
+   */
+  async evaluate(input) {
+    const body = {
+      action: input.action,
+      agent: input.agent,
+      context: input.context ?? {},
+      api_key: this.apiKey
+    };
+    const { body: wire, rateLimit } = await this.post("/v1-evaluate", body);
+    if (typeof wire.permitted !== "boolean" || typeof wire.decision_id !== "string") {
+      throw new AtlaSentError(
+        "Malformed response from /v1-evaluate: missing `permitted` or `decision_id`",
+        { code: "bad_response" }
+      );
+    }
+    return {
+      decision: wire.permitted ? "ALLOW" : "DENY",
+      permitId: wire.decision_id,
+      reason: wire.reason ?? "",
+      auditHash: wire.audit_hash ?? "",
+      timestamp: wire.timestamp ?? "",
+      rateLimit
+    };
+  }
+  /**
+   * Verify that a previously issued permit is still valid.
+   *
+   * A `verified: false` response is **not** thrown — inspect the
+   * returned object. Only transport / server errors throw.
+   */
+  async verifyPermit(input) {
+    const body = {
+      decision_id: input.permitId,
+      action: input.action ?? "",
+      agent: input.agent ?? "",
+      context: input.context ?? {},
+      api_key: this.apiKey
+    };
+    const { body: wire, rateLimit } = await this.post(
+      "/v1-verify-permit",
+      body
+    );
+    if (typeof wire.verified !== "boolean") {
+      throw new AtlaSentError(
+        "Malformed response from /v1-verify-permit: missing `verified`",
+        { code: "bad_response" }
+      );
+    }
+    return {
+      verified: wire.verified,
+      outcome: wire.outcome ?? "",
+      permitHash: wire.permit_hash ?? "",
+      timestamp: wire.timestamp ?? "",
+      rateLimit
+    };
+  }
+  /**
+   * Self-introspection: ask the server to describe the API key this
+   * client was constructed with. Returns the key's ID, organization,
+   * environment, scopes, IP allowlist, per-minute rate limit, the
+   * client IP the server observed, and the expiry (if any).
+   *
+   * Never includes the raw key or its hash. Safe to surface in operator
+   * dashboards. Useful for `IP_NOT_ALLOWED` debugging (the server tells
+   * you exactly which IP it saw) and for proactive expiry warnings.
+   *
+   * Throws {@link AtlaSentError} on transport / auth failures — same
+   * taxonomy as {@link AtlaSentClient.evaluate}.
+   */
+  async keySelf() {
+    const { body: wire, rateLimit } = await this.get(
+      "/v1-api-key-self"
+    );
+    if (typeof wire.key_id !== "string" || typeof wire.organization_id !== "string") {
+      throw new AtlaSentError(
+        "Malformed response from /v1-api-key-self: missing `key_id` or `organization_id`",
+        { code: "bad_response" }
+      );
+    }
+    return {
+      keyId: wire.key_id,
+      organizationId: wire.organization_id,
+      environment: wire.environment,
+      scopes: wire.scopes ?? [],
+      allowedCidrs: wire.allowed_cidrs ?? null,
+      rateLimitPerMinute: wire.rate_limit_per_minute,
+      clientIp: wire.client_ip ?? null,
+      expiresAt: wire.expires_at ?? null,
+      rateLimit
+    };
+  }
+  /**
+   * List persisted audit events for the authenticated organization
+   * (`GET /v1-audit/events`). Returned rows are wire-identical with
+   * the server: snake_case field names, including `previous_hash` and
+   * the `hash` chain, so the response can be fed straight into the
+   * offline verifier when paired with a signed export.
+   *
+   * `query.types` is a comma-joined list (e.g.
+   * `"evaluate.allow,policy.updated"`). `cursor` is the opaque
+   * `next_cursor` from the prior page. All fields are optional; the
+   * server defaults `limit` to 50 (capped at 500).
+   *
+   * Throws {@link AtlaSentError} on transport / auth failures — same
+   * taxonomy as {@link AtlaSentClient.evaluate}.
+   */
+  async listAuditEvents(query = {}) {
+    const { body: wire, rateLimit } = await this.get(
+      "/v1-audit/events",
+      buildAuditEventsQuery(query)
+    );
+    if (!Array.isArray(wire.events) || typeof wire.total !== "number") {
+      throw new AtlaSentError(
+        "Malformed response from /v1-audit/events: missing `events` or `total`",
+        { code: "bad_response" }
+      );
+    }
+    return { ...wire, rateLimit };
+  }
+  /**
+   * Request a signed audit export bundle
+   * (`POST /v1-audit/exports`). The returned object is wire-identical
+   * with the server — `signature`, `chain_head_hash`, `events`, and
+   * friends survive untouched so the bundle can be persisted to disk
+   * and handed to the offline verifier (`verifyBundle` /
+   * `verifyAuditBundle`) without any reshaping.
+   *
+   * Pass `filter.types`, `filter.from`, `filter.to`, or `filter.actor_id`
+   * to narrow the export; omit for a full-org bundle. `rateLimit` is
+   * attached alongside the wire fields for observability.
+   *
+   * Throws {@link AtlaSentError} on transport / auth failures — same
+   * taxonomy as {@link AtlaSentClient.evaluate}.
+   */
+  async createAuditExport(filter = {}) {
+    const { body: wire, rateLimit } = await this.post(
+      "/v1-audit/exports",
+      filter
+    );
+    if (typeof wire.export_id !== "string" || typeof wire.chain_head_hash !== "string" || !Array.isArray(wire.events)) {
+      throw new AtlaSentError(
+        "Malformed response from /v1-audit/exports: missing `export_id`, `chain_head_hash`, or `events`",
+        { code: "bad_response" }
+      );
+    }
+    return { ...wire, rateLimit };
+  }
+  async post(path, body) {
+    return this.request(path, "POST", body, void 0);
+  }
+  async get(path, query) {
+    return this.request(path, "GET", void 0, query);
+  }
+  async request(path, method, body, query) {
+    const qs = query && Array.from(query).length > 0 ? `?${query.toString()}` : "";
+    const url = `${this.baseUrl}${path}${qs}`;
+    const requestId = globalThis.crypto.randomUUID();
+    const headers = {
+      Accept: "application/json",
+      Authorization: `Bearer ${this.apiKey}`,
+      "User-Agent": `@atlasent/sdk/${SDK_VERSION} node/${process.version}`,
+      "X-Request-ID": requestId
+    };
+    if (method === "POST") headers["Content-Type"] = "application/json";
+    const init = {
+      method,
+      headers,
+      signal: AbortSignal.timeout(this.timeoutMs)
+    };
+    if (method === "POST") init.body = JSON.stringify(body);
+    let response;
+    try {
+      response = await this.fetchImpl(url, init);
+    } catch (err) {
+      throw mapFetchError(err, requestId);
+    }
+    if (!response.ok) {
+      throw await buildHttpError(response, requestId);
+    }
+    let parsed;
+    try {
+      parsed = await response.json();
+    } catch (err) {
+      throw new AtlaSentError("Invalid JSON response from AtlaSent API", {
+        code: "bad_response",
+        status: response.status,
+        requestId,
+        cause: err
+      });
+    }
+    if (parsed === null || typeof parsed !== "object") {
+      throw new AtlaSentError("Expected a JSON object from AtlaSent API", {
+        code: "bad_response",
+        status: response.status,
+        requestId
+      });
+    }
+    return {
+      body: parsed,
+      rateLimit: parseRateLimitHeaders(response.headers)
+    };
+  }
+};
+function parseRateLimitHeaders(headers) {
+  const rawLimit = headers.get("x-ratelimit-limit");
+  const rawRemaining = headers.get("x-ratelimit-remaining");
+  const rawReset = headers.get("x-ratelimit-reset");
+  if (rawLimit === null || rawRemaining === null || rawReset === null) {
+    return null;
+  }
+  const limit = Number(rawLimit);
+  const remaining = Number(rawRemaining);
+  if (!Number.isFinite(limit) || !Number.isFinite(remaining)) {
+    return null;
+  }
+  const resetAt = parseResetHeader(rawReset);
+  if (resetAt === null) {
+    return null;
+  }
+  return { limit, remaining, resetAt };
+}
+function parseResetHeader(raw) {
+  const seconds = Number(raw);
+  if (Number.isFinite(seconds)) {
+    return new Date(seconds * 1e3);
+  }
+  const ms = Date.parse(raw);
+  if (Number.isFinite(ms)) {
+    return new Date(ms);
+  }
+  return null;
+}
+function mapFetchError(err, requestId) {
+  if (err instanceof AtlaSentError) return err;
+  if (err instanceof DOMException && err.name === "TimeoutError") {
+    return new AtlaSentError("Request to AtlaSent API timed out", {
+      code: "timeout",
+      requestId,
+      cause: err
+    });
+  }
+  if (err instanceof Error && err.name === "AbortError") {
+    return new AtlaSentError("Request to AtlaSent API timed out", {
+      code: "timeout",
+      requestId,
+      cause: err
+    });
+  }
+  const message = err instanceof Error ? err.message : "network error";
+  return new AtlaSentError(`Failed to reach AtlaSent API: ${message}`, {
+    code: "network",
+    requestId,
+    cause: err
+  });
+}
+async function buildHttpError(response, requestId) {
+  const status = response.status;
+  const classified = await classifyHttpStatus(response);
+  const init = {
+    status,
+    code: classified.code,
+    requestId
+  };
+  if (classified.retryAfterMs !== void 0) {
+    init.retryAfterMs = classified.retryAfterMs;
+  }
+  return new AtlaSentError(classified.message, init);
+}
+async function classifyHttpStatus(response) {
+  const status = response.status;
+  const serverMessage = await readServerMessage(response);
+  if (status === 401) {
+    return {
+      message: serverMessage ?? "Invalid API key",
+      code: "invalid_api_key",
+      retryAfterMs: void 0
+    };
+  }
+  if (status === 403) {
+    return {
+      message: serverMessage ?? "Access forbidden \u2014 check your API key permissions",
+      code: "forbidden",
+      retryAfterMs: void 0
+    };
+  }
+  if (status === 429) {
+    return {
+      message: serverMessage ?? "Rate limited by AtlaSent API",
+      code: "rate_limited",
+      retryAfterMs: parseRetryAfter(response.headers.get("retry-after"))
+    };
+  }
+  if (status >= 500) {
+    return {
+      message: serverMessage ?? `AtlaSent API returned HTTP ${status}`,
+      code: "server_error",
+      retryAfterMs: void 0
+    };
+  }
+  return {
+    message: serverMessage ?? `AtlaSent API returned HTTP ${status}`,
+    code: "bad_request",
+    retryAfterMs: void 0
+  };
+}
+async function readServerMessage(response) {
+  try {
+    const text = await response.text();
+    if (!text) return null;
+    try {
+      const parsed = JSON.parse(text);
+      if (parsed && typeof parsed === "object") {
+        const msg = parsed.message;
+        const reason = parsed.reason;
+        if (typeof msg === "string" && msg.length > 0) return msg;
+        if (typeof reason === "string" && reason.length > 0) return reason;
+      }
+    } catch {
+    }
+    return text.length > 500 ? `${text.slice(0, 500)}\u2026` : text;
+  } catch {
+    return null;
+  }
+}
+function buildAuditEventsQuery(query) {
+  const params = new URLSearchParams();
+  if (query.types !== void 0 && query.types !== "") {
+    params.set("types", query.types);
+  }
+  if (query.actor_id !== void 0 && query.actor_id !== "") {
+    params.set("actor_id", query.actor_id);
+  }
+  if (query.from !== void 0 && query.from !== "") {
+    params.set("from", query.from);
+  }
+  if (query.to !== void 0 && query.to !== "") {
+    params.set("to", query.to);
+  }
+  if (query.limit !== void 0) {
+    params.set("limit", String(query.limit));
+  }
+  if (query.cursor !== void 0 && query.cursor !== "") {
+    params.set("cursor", query.cursor);
+  }
+  return params;
+}
+function parseRetryAfter(raw) {
+  if (!raw) return void 0;
+  const seconds = Number(raw);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const date = Date.parse(raw);
+  if (Number.isFinite(date)) {
+    const delta = date - Date.now();
+    return delta > 0 ? delta : 0;
+  }
+  return void 0;
+}
+
+// src/protect.ts
+var sharedClient = null;
+var overrides = {};
+function getClient() {
+  if (sharedClient) return sharedClient;
+  const apiKey = overrides.apiKey ?? process.env.ATLASENT_API_KEY;
+  if (!apiKey) {
+    throw new AtlaSentError(
+      "AtlaSent is not configured. Set ATLASENT_API_KEY in the environment, or call atlasent.configure({ apiKey }).",
+      { code: "invalid_api_key" }
+    );
+  }
+  const options = { apiKey };
+  if (overrides.baseUrl !== void 0) options.baseUrl = overrides.baseUrl;
+  if (overrides.timeoutMs !== void 0) options.timeoutMs = overrides.timeoutMs;
+  if (overrides.fetch !== void 0) options.fetch = overrides.fetch;
+  sharedClient = new AtlaSentClient(options);
+  return sharedClient;
+}
+function wireDecisionToDenied(serverDecision) {
+  const lower = serverDecision.toLowerCase();
+  if (lower === "hold" || lower === "escalate") return lower;
+  return "deny";
+}
+async function protect(request) {
+  const client = getClient();
+  const evaluation = await client.evaluate(request);
+  if (evaluation.decision !== "ALLOW") {
+    throw new AtlaSentDeniedError({
+      decision: wireDecisionToDenied(evaluation.decision),
+      evaluationId: evaluation.permitId,
+      reason: evaluation.reason,
+      auditHash: evaluation.auditHash
+    });
+  }
+  const verifyRequest = {
+    permitId: evaluation.permitId,
+    agent: request.agent,
+    action: request.action
+  };
+  if (request.context !== void 0) verifyRequest.context = request.context;
+  const verification = await client.verifyPermit(verifyRequest);
+  if (!verification.verified) {
+    throw new AtlaSentDeniedError({
+      decision: "deny",
+      evaluationId: evaluation.permitId,
+      reason: `Permit failed verification (${verification.outcome})`,
+      auditHash: evaluation.auditHash
+    });
+  }
+  return {
+    permitId: evaluation.permitId,
+    permitHash: verification.permitHash,
+    auditHash: evaluation.auditHash,
+    reason: evaluation.reason,
+    timestamp: verification.timestamp
+  };
+}
+
+// src/hono.ts
+var DEFAULT_CONTEXT_KEY = "atlasent";
+async function resolve(value, c) {
+  return typeof value === "function" ? await value(c) : value;
+}
+function atlaSentGuard(options) {
+  const contextKey = options.key ?? DEFAULT_CONTEXT_KEY;
+  return async (c, next) => {
+    const [agent, action, ctx] = await Promise.all([
+      resolve(options.agent, c),
+      resolve(options.action, c),
+      options.context ? options.context(c) : Promise.resolve(void 0)
+    ]);
+    const request = { agent, action };
+    if (ctx !== void 0) request.context = ctx;
+    const permit = await protect(request);
+    c.set(contextKey, permit);
+    await next();
+  };
+}
+function defaultRenderDeny(err) {
+  const body = {
+    error: "denied",
+    decision: err.decision,
+    evaluationId: err.evaluationId
+  };
+  if (err.reason !== void 0) body.reason = err.reason;
+  if (err.requestId !== void 0) body.requestId = err.requestId;
+  return body;
+}
+function defaultRenderError(err) {
+  const body = {
+    error: "unavailable",
+    code: err.code ?? "unknown"
+  };
+  if (err.requestId !== void 0) body.requestId = err.requestId;
+  return body;
+}
+function atlaSentErrorHandler(options = {}) {
+  const denyStatus = options.denyStatus ?? 403;
+  const errorStatus = options.errorStatus ?? 503;
+  const renderDeny = options.renderDeny ?? defaultRenderDeny;
+  const renderError = options.renderError ?? defaultRenderError;
+  return (err, c) => {
+    if (err instanceof AtlaSentDeniedError) {
+      return c.json(renderDeny(err), denyStatus);
+    }
+    if (err instanceof AtlaSentError) {
+      return c.json(renderError(err), errorStatus);
+    }
+    throw err;
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AtlaSentDeniedError,
+  AtlaSentError,
+  atlaSentErrorHandler,
+  atlaSentGuard
+});
+//# sourceMappingURL=hono.cjs.map

package/dist/hono.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hono.ts","../src/errors.ts","../src/client.ts","../src/protect.ts"],"sourcesContent":["/**\n * Hono middleware for AtlaSent execution-time authorization.\n *\n * ```ts\n * import { Hono } from \"hono\";\n * import { atlaSentGuard, atlaSentErrorHandler } from \"@atlasent/sdk/hono\";\n *\n * const app = new Hono();\n *\n * // One-line drop-in protection for a sensitive route.\n * app.post(\n *   \"/deploy\",\n *   atlaSentGuard({\n *     action: \"deploy_to_production\",\n *     agent: (c) => c.req.header(\"x-agent-id\") ?? \"anonymous\",\n *     context: async (c) => ({ commit: (await c.req.json()).commit }),\n *   }),\n *   (c) => {\n *     // If we got here, AtlaSent allowed the action end-to-end.\n *     const permit = c.get(\"atlasent\");\n *     return c.json({ ok: true, permitId: permit.permitId });\n *   },\n * );\n *\n * // One place to map AtlaSent errors to HTTP responses.\n * app.onError(atlaSentErrorHandler());\n * ```\n *\n * The guard calls {@link protect} under the hood — same fail-closed\n * semantics. On allow, it stashes the {@link Permit} on the Hono\n * context (default key: `\"atlasent\"`) and calls `next()`. On anything\n * else, it **throws**: {@link AtlaSentDeniedError} for policy denials\n * and verification failures, {@link AtlaSentError} for transport /\n * auth / server failures. Attach {@link atlaSentErrorHandler} via\n * `app.onError(...)` to turn those into HTTP responses once, at the\n * app level, rather than wrap every guarded route.\n *\n * `hono` is an optional peer dependency — this module is only pulled\n * in when you import from the `@atlasent/sdk/hono` subpath.\n */\n\nimport type { Context, ErrorHandler, MiddlewareHandler } from \"hono\";\n\nimport {\n  AtlaSentDeniedError,\n  AtlaSentError,\n} from \"./errors.js\";\nimport { protect, type Permit, type ProtectRequest } from \"./protect.js\";\n\n/** Resolver: a literal string, or a function deriving one from the request. */\ntype Resolver<T extends string | Record<string, unknown>> =\n  | T\n  | ((c: Context) => T | Promise<T>);\n\n/** Options for {@link atlaSentGuard}. */\nexport interface AtlaSentGuardOptions {\n  /**\n   * Action being authorized (e.g. `\"deploy_to_production\"`). A string\n   * fixes the action; a function lets you derive it per-request (e.g.\n   * from route params or the HTTP verb).\n   */\n  action: Resolver<string>;\n  /**\n   * Agent identifier. A string fixes the caller; a function lets you\n   * read it from an auth header, JWT claim, session, etc.\n   */\n  agent: Resolver<string>;\n  /**\n   * Build the policy context dict for the decision. Defaults to `{}`.\n   * Receives the Hono context so you can reach into headers, body,\n   * route params, or previously-set middleware values.\n   */\n  context?: (c: Context) => Record<string, unknown> | Promise<Record<string, unknown>>;\n  /**\n   * Key used to stash the resulting {@link Permit} on the Hono\n   * context via `c.set(...)`. Callers read it back with\n   * `c.get(options.key)`. Default: `\"atlasent\"`.\n   */\n  key?: string;\n}\n\nconst DEFAULT_CONTEXT_KEY = \"atlasent\";\n\nasync function resolve<T>(\n  value: T | ((c: Context) => T | Promise<T>),\n  c: Context,\n): Promise<T> {\n  return typeof value === \"function\"\n    ? await (value as (c: Context) => T | Promise<T>)(c)\n    : value;\n}\n\n/**\n * Hono middleware that calls {@link protect} before the wrapped\n * handler runs. On allow, stores the {@link Permit} on the context;\n * on deny or error, throws. Use {@link atlaSentErrorHandler} with\n * `app.onError(...)` to turn those throws into HTTP responses.\n */\nexport function atlaSentGuard(\n  options: AtlaSentGuardOptions,\n): MiddlewareHandler {\n  const contextKey = options.key ?? DEFAULT_CONTEXT_KEY;\n  return async (c, next) => {\n    const [agent, action, ctx] = await Promise.all([\n      resolve(options.agent, c),\n      resolve(options.action, c),\n      options.context ? options.context(c) : Promise.resolve(undefined),\n    ]);\n\n    const request: ProtectRequest = { agent, action };\n    if (ctx !== undefined) request.context = ctx;\n\n    const permit: Permit = await protect(request);\n    c.set(contextKey, permit);\n    await next();\n  };\n}\n\n/** Options for {@link atlaSentErrorHandler}. */\nexport interface AtlaSentErrorHandlerOptions {\n  /** HTTP status returned on policy denial. Default: 403. */\n  denyStatus?: 401 | 403 | 409 | 422;\n  /** HTTP status returned on transport / auth / server failure. Default: 503. */\n  errorStatus?: 502 | 503 | 500;\n  /**\n   * Hook to customize the JSON body returned on denial. Receives the\n   * error; must return a JSON-serializable object. Defaults to a\n   * minimal `{ error, decision, evaluationId, reason?, requestId? }`.\n   */\n  renderDeny?: (err: AtlaSentDeniedError) => Record<string, unknown>;\n  /** Hook for transport/auth/server errors. Defaults to `{ error, code, requestId? }`. */\n  renderError?: (err: AtlaSentError) => Record<string, unknown>;\n}\n\nfunction defaultRenderDeny(err: AtlaSentDeniedError): Record<string, unknown> {\n  const body: Record<string, unknown> = {\n    error: \"denied\",\n    decision: err.decision,\n    evaluationId: err.evaluationId,\n  };\n  if (err.reason !== undefined) body.reason = err.reason;\n  if (err.requestId !== undefined) body.requestId = err.requestId;\n  return body;\n}\n\nfunction defaultRenderError(err: AtlaSentError): Record<string, unknown> {\n  const body: Record<string, unknown> = {\n    error: \"unavailable\",\n    code: err.code ?? \"unknown\",\n  };\n  if (err.requestId !== undefined) body.requestId = err.requestId;\n  return body;\n}\n\n/**\n * Hono error handler that converts AtlaSent exceptions into\n * appropriate HTTP responses. Install once at the app level:\n *\n * ```ts\n * app.onError(atlaSentErrorHandler());\n * ```\n *\n * Non-AtlaSent errors re-throw so other `onError` chains (or Hono's\n * default 500 handler) still see them.\n */\nexport function atlaSentErrorHandler(\n  options: AtlaSentErrorHandlerOptions = {},\n): ErrorHandler {\n  const denyStatus = options.denyStatus ?? 403;\n  const errorStatus = options.errorStatus ?? 503;\n  const renderDeny = options.renderDeny ?? defaultRenderDeny;\n  const renderError = options.renderError ?? defaultRenderError;\n\n  return (err, c) => {\n    if (err instanceof AtlaSentDeniedError) {\n      return c.json(renderDeny(err), denyStatus);\n    }\n    if (err instanceof AtlaSentError) {\n      return c.json(renderError(err), errorStatus);\n    }\n    throw err;\n  };\n}\n\n// Re-export the types callers need in one place so the subpath is\n// self-contained.\nexport type { Permit, ProtectRequest } from \"./protect.js\";\nexport { AtlaSentDeniedError, AtlaSentError } from \"./errors.js\";\n","/**\n * Error types for the AtlaSent TypeScript SDK.\n *\n * The SDK follows a fail-closed design: a clean policy DENY is\n * returned as `EvaluateResponse.decision === \"DENY\"` (not thrown),\n * but any failure to confirm authorization — network, timeout,\n * bad response, invalid key, rate limit — throws an\n * {@link AtlaSentError}.\n */\n\n/** Discriminator for {@link AtlaSentError.code}. */\nexport type AtlaSentErrorCode =\n  | \"invalid_api_key\"\n  | \"forbidden\"\n  | \"rate_limited\"\n  | \"timeout\"\n  | \"network\"\n  | \"bad_response\"\n  | \"bad_request\"\n  | \"server_error\";\n\n/** Initialization options for {@link AtlaSentError}. */\nexport interface AtlaSentErrorInit {\n  status?: number;\n  code?: AtlaSentErrorCode;\n  requestId?: string;\n  retryAfterMs?: number;\n  cause?: unknown;\n}\n\n/**\n * The only error type this SDK throws.\n *\n * Flat top-level properties mirror the convention used by Stripe,\n * Octokit, and Supabase. `cause` is forwarded to the standard\n * ES2022 `Error` constructor.\n */\nexport class AtlaSentError extends Error {\n  // Subclasses override to their own literal (e.g. \"AtlaSentDeniedError\");\n  // keep this assignable rather than pinned to a single literal.\n  override name: string = \"AtlaSentError\";\n\n  /** HTTP status code, when the error originated from an API response. */\n  readonly status: number | undefined;\n  /** Coarse category — useful for `switch` statements at call sites. */\n  readonly code: AtlaSentErrorCode | undefined;\n  /** Correlation ID echoed from the `X-Request-ID` header the SDK sent. */\n  readonly requestId: string | undefined;\n  /** Parsed `Retry-After` header value, in milliseconds. Only set for 429. */\n  readonly retryAfterMs: number | undefined;\n\n  constructor(message: string, init: AtlaSentErrorInit = {}) {\n    super(\n      message,\n      init.cause !== undefined ? { cause: init.cause } : undefined,\n    );\n    this.status = init.status;\n    this.code = init.code;\n    this.requestId = init.requestId;\n    this.retryAfterMs = init.retryAfterMs;\n  }\n}\n\n/**\n * Outcome of a denied decision.\n *\n * `\"deny\"` is what the current `/v1-evaluate` API returns. `\"hold\"`\n * and `\"escalate\"` are reserved for forthcoming API decisions that\n * put a permit into a pending state requiring human review; the\n * union is declared now so call sites can `switch` exhaustively\n * from the start and adopt new decisions without a breaking change.\n */\nexport type AtlaSentDecision = \"deny\" | \"hold\" | \"escalate\";\n\n/** Initialization options for {@link AtlaSentDeniedError}. */\nexport interface AtlaSentDeniedErrorInit {\n  decision: AtlaSentDecision;\n  evaluationId: string;\n  reason?: string;\n  requestId?: string;\n  auditHash?: string;\n}\n\n/**\n * Thrown by {@link atlasent.protect} when the policy engine refuses\n * the action, or when a permit fails end-to-end verification.\n *\n * This is the **fail-closed boundary** of the SDK: every code path\n * that short-circuits an action because authorization was not\n * confirmed raises an `AtlaSentDeniedError`. Callers cannot silently\n * proceed on a denial by forgetting to branch on a return value.\n *\n * Extends {@link AtlaSentError} so `instanceof AtlaSentError`\n * catches denials as part of the SDK's single exception family;\n * use `instanceof AtlaSentDeniedError` to distinguish a policy\n * denial from a transport/auth error.\n */\nexport class AtlaSentDeniedError extends AtlaSentError {\n  override name: string = \"AtlaSentDeniedError\";\n\n  /** Policy decision — `\"deny\"` today; `\"hold\"` / `\"escalate\"` reserved. */\n  readonly decision: AtlaSentDecision;\n  /** Opaque permit/decision id from `/v1-evaluate`. */\n  readonly evaluationId: string;\n  /** Human-readable explanation from the policy engine, if provided. */\n  readonly reason: string | undefined;\n  /** Hash-chained audit-trail entry associated with the decision. */\n  readonly auditHash: string | undefined;\n\n  constructor(init: AtlaSentDeniedErrorInit) {\n    const msg = init.reason\n      ? `AtlaSent ${init.decision}: ${init.reason}`\n      : `AtlaSent ${init.decision}`;\n    const errInit: AtlaSentErrorInit = { status: 200 };\n    if (init.requestId !== undefined) errInit.requestId = init.requestId;\n    super(msg, errInit);\n    this.decision = init.decision;\n    this.evaluationId = init.evaluationId;\n    this.reason = init.reason;\n    this.auditHash = init.auditHash;\n  }\n}\n","/**\n * AtlaSent HTTP client.\n *\n * Two public methods, both backed by native `fetch`:\n *   - {@link AtlaSentClient.evaluate}     → POST {baseUrl}/v1-evaluate\n *   - {@link AtlaSentClient.verifyPermit} → POST {baseUrl}/v1-verify-permit\n *\n * Fail-closed: a clean policy DENY is returned (not thrown), but\n * network, timeout, bad response, 4xx/5xx, and rate-limit conditions\n * all throw {@link AtlaSentError}.\n */\n\nimport type {\n  AuditEventsPage,\n  AuditEventsQuery,\n  AuditExport,\n} from \"./audit.js\";\nimport {\n  AtlaSentError,\n  type AtlaSentErrorCode,\n  type AtlaSentErrorInit,\n} from \"./errors.js\";\nimport type {\n  ApiKeySelfResponse,\n  AtlaSentClientOptions,\n  AuditEventsResult,\n  AuditExportRequest,\n  AuditExportResult,\n  EvaluateRequest,\n  EvaluateResponse,\n  RateLimitState,\n  VerifyPermitRequest,\n  VerifyPermitResponse,\n} from \"./types.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.atlasent.io\";\nconst DEFAULT_TIMEOUT_MS = 10_000;\nconst SDK_VERSION = \"0.1.0\";\n\n/** Raw JSON shape received from `POST /v1-evaluate`. */\ninterface EvaluateWire {\n  permitted: boolean;\n  decision_id: string;\n  reason?: string;\n  audit_hash?: string;\n  timestamp?: string;\n}\n\n/** Raw JSON shape received from `GET /v1-api-key-self`. */\ninterface ApiKeySelfWire {\n  key_id: string;\n  organization_id: string;\n  environment: string;\n  scopes?: string[];\n  allowed_cidrs?: string[] | null;\n  rate_limit_per_minute: number;\n  client_ip?: string | null;\n  expires_at?: string | null;\n}\n\n/** Raw JSON shape received from `POST /v1-verify-permit`. */\ninterface VerifyPermitWire {\n  verified: boolean;\n  outcome?: string;\n  permit_hash?: string;\n  timestamp?: string;\n}\n\nexport class AtlaSentClient {\n  private readonly apiKey: string;\n  private readonly baseUrl: string;\n  private readonly timeoutMs: number;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(options: AtlaSentClientOptions) {\n    if (!options.apiKey || typeof options.apiKey !== \"string\") {\n      throw new AtlaSentError(\"apiKey is required\", {\n        code: \"invalid_api_key\",\n      });\n    }\n    this.apiKey = options.apiKey;\n    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);\n  }\n\n  /**\n   * Ask the policy engine whether an agent action is permitted.\n   *\n   * A \"DENY\" is **not** thrown — it is returned in\n   * `response.decision`. Network errors, invalid API key, rate\n   * limits, timeouts, and malformed responses throw\n   * {@link AtlaSentError}.\n   */\n  async evaluate(input: EvaluateRequest): Promise<EvaluateResponse> {\n    const body = {\n      action: input.action,\n      agent: input.agent,\n      context: input.context ?? {},\n      api_key: this.apiKey,\n    };\n    const { body: wire, rateLimit } = await this.post<EvaluateWire>(\"/v1-evaluate\", body);\n\n    if (typeof wire.permitted !== \"boolean\" || typeof wire.decision_id !== \"string\") {\n      throw new AtlaSentError(\n        \"Malformed response from /v1-evaluate: missing `permitted` or `decision_id`\",\n        { code: \"bad_response\" },\n      );\n    }\n\n    return {\n      decision: wire.permitted ? \"ALLOW\" : \"DENY\",\n      permitId: wire.decision_id,\n      reason: wire.reason ?? \"\",\n      auditHash: wire.audit_hash ?? \"\",\n      timestamp: wire.timestamp ?? \"\",\n      rateLimit,\n    };\n  }\n\n  /**\n   * Verify that a previously issued permit is still valid.\n   *\n   * A `verified: false` response is **not** thrown — inspect the\n   * returned object. Only transport / server errors throw.\n   */\n  async verifyPermit(\n    input: VerifyPermitRequest,\n  ): Promise<VerifyPermitResponse> {\n    const body = {\n      decision_id: input.permitId,\n      action: input.action ?? \"\",\n      agent: input.agent ?? \"\",\n      context: input.context ?? {},\n      api_key: this.apiKey,\n    };\n    const { body: wire, rateLimit } = await this.post<VerifyPermitWire>(\n      \"/v1-verify-permit\",\n      body,\n    );\n\n    if (typeof wire.verified !== \"boolean\") {\n      throw new AtlaSentError(\n        \"Malformed response from /v1-verify-permit: missing `verified`\",\n        { code: \"bad_response\" },\n      );\n    }\n\n    return {\n      verified: wire.verified,\n      outcome: wire.outcome ?? \"\",\n      permitHash: wire.permit_hash ?? \"\",\n      timestamp: wire.timestamp ?? \"\",\n      rateLimit,\n    };\n  }\n\n  /**\n   * Self-introspection: ask the server to describe the API key this\n   * client was constructed with. Returns the key's ID, organization,\n   * environment, scopes, IP allowlist, per-minute rate limit, the\n   * client IP the server observed, and the expiry (if any).\n   *\n   * Never includes the raw key or its hash. Safe to surface in operator\n   * dashboards. Useful for `IP_NOT_ALLOWED` debugging (the server tells\n   * you exactly which IP it saw) and for proactive expiry warnings.\n   *\n   * Throws {@link AtlaSentError} on transport / auth failures — same\n   * taxonomy as {@link AtlaSentClient.evaluate}.\n   */\n  async keySelf(): Promise<ApiKeySelfResponse> {\n    const { body: wire, rateLimit } = await this.get<ApiKeySelfWire>(\n      \"/v1-api-key-self\",\n    );\n\n    if (typeof wire.key_id !== \"string\" || typeof wire.organization_id !== \"string\") {\n      throw new AtlaSentError(\n        \"Malformed response from /v1-api-key-self: missing `key_id` or `organization_id`\",\n        { code: \"bad_response\" },\n      );\n    }\n\n    return {\n      keyId: wire.key_id,\n      organizationId: wire.organization_id,\n      environment: wire.environment,\n      scopes: wire.scopes ?? [],\n      allowedCidrs: wire.allowed_cidrs ?? null,\n      rateLimitPerMinute: wire.rate_limit_per_minute,\n      clientIp: wire.client_ip ?? null,\n      expiresAt: wire.expires_at ?? null,\n      rateLimit,\n    };\n  }\n\n  /**\n   * List persisted audit events for the authenticated organization\n   * (`GET /v1-audit/events`). Returned rows are wire-identical with\n   * the server: snake_case field names, including `previous_hash` and\n   * the `hash` chain, so the response can be fed straight into the\n   * offline verifier when paired with a signed export.\n   *\n   * `query.types` is a comma-joined list (e.g.\n   * `\"evaluate.allow,policy.updated\"`). `cursor` is the opaque\n   * `next_cursor` from the prior page. All fields are optional; the\n   * server defaults `limit` to 50 (capped at 500).\n   *\n   * Throws {@link AtlaSentError} on transport / auth failures — same\n   * taxonomy as {@link AtlaSentClient.evaluate}.\n   */\n  async listAuditEvents(\n    query: AuditEventsQuery = {},\n  ): Promise<AuditEventsResult> {\n    const { body: wire, rateLimit } = await this.get<AuditEventsPage>(\n      \"/v1-audit/events\",\n      buildAuditEventsQuery(query),\n    );\n\n    if (!Array.isArray(wire.events) || typeof wire.total !== \"number\") {\n      throw new AtlaSentError(\n        \"Malformed response from /v1-audit/events: missing `events` or `total`\",\n        { code: \"bad_response\" },\n      );\n    }\n\n    return { ...wire, rateLimit };\n  }\n\n  /**\n   * Request a signed audit export bundle\n   * (`POST /v1-audit/exports`). The returned object is wire-identical\n   * with the server — `signature`, `chain_head_hash`, `events`, and\n   * friends survive untouched so the bundle can be persisted to disk\n   * and handed to the offline verifier (`verifyBundle` /\n   * `verifyAuditBundle`) without any reshaping.\n   *\n   * Pass `filter.types`, `filter.from`, `filter.to`, or `filter.actor_id`\n   * to narrow the export; omit for a full-org bundle. `rateLimit` is\n   * attached alongside the wire fields for observability.\n   *\n   * Throws {@link AtlaSentError} on transport / auth failures — same\n   * taxonomy as {@link AtlaSentClient.evaluate}.\n   */\n  async createAuditExport(\n    filter: AuditExportRequest = {},\n  ): Promise<AuditExportResult> {\n    const { body: wire, rateLimit } = await this.post<AuditExport>(\n      \"/v1-audit/exports\",\n      filter,\n    );\n\n    if (\n      typeof wire.export_id !== \"string\" ||\n      typeof wire.chain_head_hash !== \"string\" ||\n      !Array.isArray(wire.events)\n    ) {\n      throw new AtlaSentError(\n        \"Malformed response from /v1-audit/exports: missing `export_id`, `chain_head_hash`, or `events`\",\n        { code: \"bad_response\" },\n      );\n    }\n\n    return { ...wire, rateLimit };\n  }\n\n  private async post<T>(\n    path: string,\n    body: unknown,\n  ): Promise<{ body: T; rateLimit: RateLimitState | null }> {\n    return this.request<T>(path, \"POST\", body, undefined);\n  }\n\n  private async get<T>(\n    path: string,\n    query?: URLSearchParams,\n  ): Promise<{ body: T; rateLimit: RateLimitState | null }> {\n    return this.request<T>(path, \"GET\", undefined, query);\n  }\n\n  private async request<T>(\n    path: string,\n    method: \"GET\" | \"POST\",\n    body: unknown,\n    query: URLSearchParams | undefined,\n  ): Promise<{ body: T; rateLimit: RateLimitState | null }> {\n    const qs = query && Array.from(query).length > 0 ? `?${query.toString()}` : \"\";\n    const url = `${this.baseUrl}${path}${qs}`;\n    const requestId = globalThis.crypto.randomUUID();\n\n    const headers: Record<string, string> = {\n      Accept: \"application/json\",\n      Authorization: `Bearer ${this.apiKey}`,\n      \"User-Agent\": `@atlasent/sdk/${SDK_VERSION} node/${process.version}`,\n      \"X-Request-ID\": requestId,\n    };\n    if (method === \"POST\") headers[\"Content-Type\"] = \"application/json\";\n\n    const init: RequestInit = {\n      method,\n      headers,\n      signal: AbortSignal.timeout(this.timeoutMs),\n    };\n    if (method === \"POST\") init.body = JSON.stringify(body);\n\n    let response: Response;\n    try {\n      response = await this.fetchImpl(url, init);\n    } catch (err) {\n      throw mapFetchError(err, requestId);\n    }\n\n    if (!response.ok) {\n      throw await buildHttpError(response, requestId);\n    }\n\n    let parsed: unknown;\n    try {\n      parsed = await response.json();\n    } catch (err) {\n      throw new AtlaSentError(\"Invalid JSON response from AtlaSent API\", {\n        code: \"bad_response\",\n        status: response.status,\n        requestId,\n        cause: err,\n      });\n    }\n\n    if (parsed === null || typeof parsed !== \"object\") {\n      throw new AtlaSentError(\"Expected a JSON object from AtlaSent API\", {\n        code: \"bad_response\",\n        status: response.status,\n        requestId,\n      });\n    }\n\n    return {\n      body: parsed as T,\n      rateLimit: parseRateLimitHeaders(response.headers),\n    };\n  }\n}\n\n/**\n * Parse the server's `X-RateLimit-*` header triple into a typed\n * {@link RateLimitState}. Returns `null` when any of the three headers\n * is missing or unparseable — callers treat that as \"the server didn't\n * emit rate-limit state\" rather than \"the window is empty\".\n *\n * `X-RateLimit-Reset` is accepted as either unix-seconds (what the\n * AtlaSent edge functions emit today) or an ISO 8601 timestamp.\n */\nfunction parseRateLimitHeaders(headers: Headers): RateLimitState | null {\n  const rawLimit = headers.get(\"x-ratelimit-limit\");\n  const rawRemaining = headers.get(\"x-ratelimit-remaining\");\n  const rawReset = headers.get(\"x-ratelimit-reset\");\n  if (rawLimit === null || rawRemaining === null || rawReset === null) {\n    return null;\n  }\n  const limit = Number(rawLimit);\n  const remaining = Number(rawRemaining);\n  if (!Number.isFinite(limit) || !Number.isFinite(remaining)) {\n    return null;\n  }\n  const resetAt = parseResetHeader(rawReset);\n  if (resetAt === null) {\n    return null;\n  }\n  return { limit, remaining, resetAt };\n}\n\nfunction parseResetHeader(raw: string): Date | null {\n  const seconds = Number(raw);\n  if (Number.isFinite(seconds)) {\n    // Standard shape: unix seconds. 10-digit values are in the valid\n    // range ~2001–2286 so this heuristic won't confuse a tiny\n    // `remaining`-like number for an epoch.\n    return new Date(seconds * 1000);\n  }\n  const ms = Date.parse(raw);\n  if (Number.isFinite(ms)) {\n    return new Date(ms);\n  }\n  return null;\n}\n\nfunction mapFetchError(err: unknown, requestId: string): AtlaSentError {\n  if (err instanceof AtlaSentError) return err;\n  if (err instanceof DOMException && err.name === \"TimeoutError\") {\n    return new AtlaSentError(\"Request to AtlaSent API timed out\", {\n      code: \"timeout\",\n      requestId,\n      cause: err,\n    });\n  }\n  if (err instanceof Error && err.name === \"AbortError\") {\n    return new AtlaSentError(\"Request to AtlaSent API timed out\", {\n      code: \"timeout\",\n      requestId,\n      cause: err,\n    });\n  }\n  const message = err instanceof Error ? err.message : \"network error\";\n  return new AtlaSentError(`Failed to reach AtlaSent API: ${message}`, {\n    code: \"network\",\n    requestId,\n    cause: err,\n  });\n}\n\nasync function buildHttpError(\n  response: Response,\n  requestId: string,\n): Promise<AtlaSentError> {\n  const status = response.status;\n  const classified = await classifyHttpStatus(response);\n  const init: AtlaSentErrorInit = {\n    status,\n    code: classified.code,\n    requestId,\n  };\n  if (classified.retryAfterMs !== undefined) {\n    init.retryAfterMs = classified.retryAfterMs;\n  }\n  return new AtlaSentError(classified.message, init);\n}\n\nasync function classifyHttpStatus(response: Response): Promise<{\n  message: string;\n  code: AtlaSentErrorCode;\n  retryAfterMs: number | undefined;\n}> {\n  const status = response.status;\n  const serverMessage = await readServerMessage(response);\n\n  if (status === 401) {\n    return {\n      message: serverMessage ?? \"Invalid API key\",\n      code: \"invalid_api_key\",\n      retryAfterMs: undefined,\n    };\n  }\n  if (status === 403) {\n    return {\n      message:\n        serverMessage ?? \"Access forbidden — check your API key permissions\",\n      code: \"forbidden\",\n      retryAfterMs: undefined,\n    };\n  }\n  if (status === 429) {\n    return {\n      message: serverMessage ?? \"Rate limited by AtlaSent API\",\n      code: \"rate_limited\",\n      retryAfterMs: parseRetryAfter(response.headers.get(\"retry-after\")),\n    };\n  }\n  if (status >= 500) {\n    return {\n      message: serverMessage ?? `AtlaSent API returned HTTP ${status}`,\n      code: \"server_error\",\n      retryAfterMs: undefined,\n    };\n  }\n  return {\n    message: serverMessage ?? `AtlaSent API returned HTTP ${status}`,\n    code: \"bad_request\",\n    retryAfterMs: undefined,\n  };\n}\n\nasync function readServerMessage(response: Response): Promise<string | null> {\n  try {\n    const text = await response.text();\n    if (!text) return null;\n    try {\n      const parsed = JSON.parse(text);\n      if (parsed && typeof parsed === \"object\") {\n        const msg = (parsed as Record<string, unknown>).message;\n        const reason = (parsed as Record<string, unknown>).reason;\n        if (typeof msg === \"string\" && msg.length > 0) return msg;\n        if (typeof reason === \"string\" && reason.length > 0) return reason;\n      }\n    } catch {\n      // Fall through — treat as plain text.\n    }\n    return text.length > 500 ? `${text.slice(0, 500)}…` : text;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Translate an {@link AuditEventsQuery} into `URLSearchParams`. The\n * server expects snake_case keys (`actor_id`) and accepts\n * comma-joined values for `types`; numeric `limit` serializes via\n * `String(n)`. Undefined / empty fields are dropped so the query\n * string stays minimal.\n */\nfunction buildAuditEventsQuery(query: AuditEventsQuery): URLSearchParams {\n  const params = new URLSearchParams();\n  if (query.types !== undefined && query.types !== \"\") {\n    params.set(\"types\", query.types);\n  }\n  if (query.actor_id !== undefined && query.actor_id !== \"\") {\n    params.set(\"actor_id\", query.actor_id);\n  }\n  if (query.from !== undefined && query.from !== \"\") {\n    params.set(\"from\", query.from);\n  }\n  if (query.to !== undefined && query.to !== \"\") {\n    params.set(\"to\", query.to);\n  }\n  if (query.limit !== undefined) {\n    params.set(\"limit\", String(query.limit));\n  }\n  if (query.cursor !== undefined && query.cursor !== \"\") {\n    params.set(\"cursor\", query.cursor);\n  }\n  return params;\n}\n\nfunction parseRetryAfter(raw: string | null): number | undefined {\n  if (!raw) return undefined;\n  const seconds = Number(raw);\n  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1000);\n  const date = Date.parse(raw);\n  if (Number.isFinite(date)) {\n    const delta = date - Date.now();\n    return delta > 0 ? delta : 0;\n  }\n  return undefined;\n}\n","/**\n * `atlasent.protect(...)` — the one-call, fail-closed execution-time\n * authorization boundary.\n *\n * ```ts\n * import atlasent from \"@atlasent/sdk\";\n *\n * const permit = await atlasent.protect({\n *   agent: \"deploy-bot\",\n *   action: \"deploy_to_production\",\n *   context: { commit, approver },\n * });\n * // …run the action. If we got here, AtlaSent authorized it\n * // end-to-end (evaluate + verifyPermit).\n * ```\n *\n * Unlike {@link AtlaSentClient.evaluate}, `protect` never returns a\n * denied decision. On deny, it throws {@link AtlaSentDeniedError};\n * on transport / auth / server failure it throws\n * {@link AtlaSentError}. The action cannot execute unless a valid\n * {@link Permit} is returned — this is the SDK's category boundary,\n * not a helper.\n */\n\nimport { AtlaSentClient } from \"./client.js\";\nimport {\n  AtlaSentDeniedError,\n  AtlaSentError,\n  type AtlaSentDecision,\n} from \"./errors.js\";\nimport type { AtlaSentClientOptions } from \"./types.js\";\n\n/** Input to {@link protect}. Same shape as `EvaluateRequest`. */\nexport interface ProtectRequest {\n  agent: string;\n  action: string;\n  context?: Record<string, unknown>;\n}\n\n/**\n * Success return from {@link protect}. The action is authorized\n * end-to-end — evaluation allowed AND the resulting permit verified.\n */\nexport interface Permit {\n  /** Opaque permit / decision identifier. */\n  permitId: string;\n  /** Verification hash bound to the permit. */\n  permitHash: string;\n  /** Audit-trail entry associated with the decision (hash-chained). */\n  auditHash: string;\n  /** Human-readable reason from the policy engine. */\n  reason: string;\n  /** ISO 8601 timestamp of the verification. */\n  timestamp: string;\n}\n\n/** Configuration for the process-wide singleton used by {@link protect}. */\nexport interface ConfigureOptions {\n  /** Overrides `ATLASENT_API_KEY` env var. */\n  apiKey?: string;\n  /** Overrides the default `https://api.atlasent.io`. */\n  baseUrl?: string;\n  /** Per-request timeout in ms. */\n  timeoutMs?: number;\n  /** Inject a custom fetch (primarily for tests). */\n  fetch?: typeof fetch;\n}\n\nlet sharedClient: AtlaSentClient | null = null;\nlet overrides: ConfigureOptions = {};\n\n/**\n * Configure the singleton client used by {@link protect}. Optional —\n * if `ATLASENT_API_KEY` is set in the environment, `protect` works\n * without any configuration. Calling `configure` again replaces the\n * singleton; subsequent `protect` calls use the new settings.\n */\nexport function configure(options: ConfigureOptions): void {\n  overrides = { ...overrides, ...options };\n  sharedClient = null;\n}\n\n/** Reset the singleton. Exported for tests; not part of the public API. */\nexport function __resetSharedClientForTests(): void {\n  sharedClient = null;\n  overrides = {};\n}\n\nfunction getClient(): AtlaSentClient {\n  if (sharedClient) return sharedClient;\n\n  const apiKey = overrides.apiKey ?? process.env.ATLASENT_API_KEY;\n  if (!apiKey) {\n    throw new AtlaSentError(\n      \"AtlaSent is not configured. Set ATLASENT_API_KEY in the environment, or call atlasent.configure({ apiKey }).\",\n      { code: \"invalid_api_key\" },\n    );\n  }\n  const options: AtlaSentClientOptions = { apiKey };\n  if (overrides.baseUrl !== undefined) options.baseUrl = overrides.baseUrl;\n  if (overrides.timeoutMs !== undefined) options.timeoutMs = overrides.timeoutMs;\n  if (overrides.fetch !== undefined) options.fetch = overrides.fetch;\n  sharedClient = new AtlaSentClient(options);\n  return sharedClient;\n}\n\nfunction wireDecisionToDenied(serverDecision: string): AtlaSentDecision {\n  // The current /v1-evaluate contract returns \"ALLOW\" | \"DENY\". Map\n  // \"DENY\" → \"deny\"; any future lowercase-or-new value passes through\n  // so forthcoming \"hold\" / \"escalate\" responses don't break callers.\n  const lower = serverDecision.toLowerCase();\n  if (lower === \"hold\" || lower === \"escalate\") return lower;\n  return \"deny\";\n}\n\n/**\n * Authorize an action end-to-end. On allow, returns a verified\n * {@link Permit}. On anything else, throws:\n *\n * - {@link AtlaSentDeniedError} — policy denied, or the permit\n *   failed verification. Fail-closed: if this throws, the action\n *   MUST NOT proceed.\n * - {@link AtlaSentError} — transport, timeout, auth, rate-limit,\n *   or server error. Same fail-closed contract: do not proceed.\n */\nexport async function protect(request: ProtectRequest): Promise<Permit> {\n  const client = getClient();\n  const evaluation = await client.evaluate(request);\n\n  if (evaluation.decision !== \"ALLOW\") {\n    throw new AtlaSentDeniedError({\n      decision: wireDecisionToDenied(evaluation.decision),\n      evaluationId: evaluation.permitId,\n      reason: evaluation.reason,\n      auditHash: evaluation.auditHash,\n    });\n  }\n\n  const verifyRequest: {\n    permitId: string;\n    agent: string;\n    action: string;\n    context?: Record<string, unknown>;\n  } = {\n    permitId: evaluation.permitId,\n    agent: request.agent,\n    action: request.action,\n  };\n  if (request.context !== undefined) verifyRequest.context = request.context;\n  const verification = await client.verifyPermit(verifyRequest);\n\n  if (!verification.verified) {\n    throw new AtlaSentDeniedError({\n      decision: \"deny\",\n      evaluationId: evaluation.permitId,\n      reason: `Permit failed verification (${verification.outcome})`,\n      auditHash: evaluation.auditHash,\n    });\n  }\n\n  return {\n    permitId: evaluation.permitId,\n    permitHash: verification.permitHash,\n    auditHash: evaluation.auditHash,\n    reason: evaluation.reason,\n    timestamp: verification.timestamp,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACqCO,IAAM,gBAAN,cAA4B,MAAM;AAAA;AAAA;AAAA,EAG9B,OAAe;AAAA;AAAA,EAGf;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,SAAiB,OAA0B,CAAC,GAAG;AACzD;AAAA,MACE;AAAA,MACA,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI;AAAA,IACrD;AACA,SAAK,SAAS,KAAK;AACnB,SAAK,OAAO,KAAK;AACjB,SAAK,YAAY,KAAK;AACtB,SAAK,eAAe,KAAK;AAAA,EAC3B;AACF;AAoCO,IAAM,sBAAN,cAAkC,cAAc;AAAA,EAC5C,OAAe;AAAA;AAAA,EAGf;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,MAA+B;AACzC,UAAM,MAAM,KAAK,SACb,YAAY,KAAK,QAAQ,KAAK,KAAK,MAAM,KACzC,YAAY,KAAK,QAAQ;AAC7B,UAAM,UAA6B,EAAE,QAAQ,IAAI;AACjD,QAAI,KAAK,cAAc,OAAW,SAAQ,YAAY,KAAK;AAC3D,UAAM,KAAK,OAAO;AAClB,SAAK,WAAW,KAAK;AACrB,SAAK,eAAe,KAAK;AACzB,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AAAA,EACxB;AACF;;;ACtFA,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAC3B,IAAM,cAAc;AA+Bb,IAAM,iBAAN,MAAqB;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAgC;AAC1C,QAAI,CAAC,QAAQ,UAAU,OAAO,QAAQ,WAAW,UAAU;AACzD,YAAM,IAAI,cAAc,sBAAsB;AAAA,QAC5C,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,SAAK,SAAS,QAAQ;AACtB,SAAK,WAAW,QAAQ,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AACvE,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,YAAY,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,SAAS,OAAmD;AAChE,UAAM,OAAO;AAAA,MACX,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,MACb,SAAS,MAAM,WAAW,CAAC;AAAA,MAC3B,SAAS,KAAK;AAAA,IAChB;AACA,UAAM,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,KAAK,KAAmB,gBAAgB,IAAI;AAEpF,QAAI,OAAO,KAAK,cAAc,aAAa,OAAO,KAAK,gBAAgB,UAAU;AAC/E,YAAM,IAAI;AAAA,QACR;AAAA,QACA,EAAE,MAAM,eAAe;AAAA,MACzB;AAAA,IACF;AAEA,WAAO;AAAA,MACL,UAAU,KAAK,YAAY,UAAU;AAAA,MACrC,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK,UAAU;AAAA,MACvB,WAAW,KAAK,cAAc;AAAA,MAC9B,WAAW,KAAK,aAAa;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,aACJ,OAC+B;AAC/B,UAAM,OAAO;AAAA,MACX,aAAa,MAAM;AAAA,MACnB,QAAQ,MAAM,UAAU;AAAA,MACxB,OAAO,MAAM,SAAS;AAAA,MACtB,SAAS,MAAM,WAAW,CAAC;AAAA,MAC3B,SAAS,KAAK;AAAA,IAChB;AACA,UAAM,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,KAAK;AAAA,MAC3C;AAAA,MACA;AAAA,IACF;AAEA,QAAI,OAAO,KAAK,aAAa,WAAW;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,EAAE,MAAM,eAAe;AAAA,MACzB;AAAA,IACF;AAEA,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,SAAS,KAAK,WAAW;AAAA,MACzB,YAAY,KAAK,eAAe;AAAA,MAChC,WAAW,KAAK,aAAa;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,UAAuC;AAC3C,UAAM,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,KAAK;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,OAAO,KAAK,WAAW,YAAY,OAAO,KAAK,oBAAoB,UAAU;AAC/E,YAAM,IAAI;AAAA,QACR;AAAA,QACA,EAAE,MAAM,eAAe;AAAA,MACzB;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,gBAAgB,KAAK;AAAA,MACrB,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK,UAAU,CAAC;AAAA,MACxB,cAAc,KAAK,iBAAiB;AAAA,MACpC,oBAAoB,KAAK;AAAA,MACzB,UAAU,KAAK,aAAa;AAAA,MAC5B,WAAW,KAAK,cAAc;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,gBACJ,QAA0B,CAAC,GACC;AAC5B,UAAM,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,KAAK;AAAA,MAC3C;AAAA,MACA,sBAAsB,KAAK;AAAA,IAC7B;AAEA,QAAI,CAAC,MAAM,QAAQ,KAAK,MAAM,KAAK,OAAO,KAAK,UAAU,UAAU;AACjE,YAAM,IAAI;AAAA,QACR;AAAA,QACA,EAAE,MAAM,eAAe;AAAA,MACzB;AAAA,IACF;AAEA,WAAO,EAAE,GAAG,MAAM,UAAU;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,kBACJ,SAA6B,CAAC,GACF;AAC5B,UAAM,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,KAAK;AAAA,MAC3C;AAAA,MACA;AAAA,IACF;AAEA,QACE,OAAO,KAAK,cAAc,YAC1B,OAAO,KAAK,oBAAoB,YAChC,CAAC,MAAM,QAAQ,KAAK,MAAM,GAC1B;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,EAAE,MAAM,eAAe;AAAA,MACzB;AAAA,IACF;AAEA,WAAO,EAAE,GAAG,MAAM,UAAU;AAAA,EAC9B;AAAA,EAEA,MAAc,KACZ,MACA,MACwD;AACxD,WAAO,KAAK,QAAW,MAAM,QAAQ,MAAM,MAAS;AAAA,EACtD;AAAA,EAEA,MAAc,IACZ,MACA,OACwD;AACxD,WAAO,KAAK,QAAW,MAAM,OAAO,QAAW,KAAK;AAAA,EACtD;AAAA,EAEA,MAAc,QACZ,MACA,QACA,MACA,OACwD;AACxD,UAAM,KAAK,SAAS,MAAM,KAAK,KAAK,EAAE,SAAS,IAAI,IAAI,MAAM,SAAS,CAAC,KAAK;AAC5E,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI,GAAG,EAAE;AACvC,UAAM,YAAY,WAAW,OAAO,WAAW;AAE/C,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA,MACR,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,cAAc,iBAAiB,WAAW,SAAS,QAAQ,OAAO;AAAA,MAClE,gBAAgB;AAAA,IAClB;AACA,QAAI,WAAW,OAAQ,SAAQ,cAAc,IAAI;AAEjD,UAAM,OAAoB;AAAA,MACxB;AAAA,MACA;AAAA,MACA,QAAQ,YAAY,QAAQ,KAAK,SAAS;AAAA,IAC5C;AACA,QAAI,WAAW,OAAQ,MAAK,OAAO,KAAK,UAAU,IAAI;AAEtD,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,KAAK,IAAI;AAAA,IAC3C,SAAS,KAAK;AACZ,YAAM,cAAc,KAAK,SAAS;AAAA,IACpC;AAEA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,MAAM,eAAe,UAAU,SAAS;AAAA,IAChD;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,KAAK;AAAA,IAC/B,SAAS,KAAK;AACZ,YAAM,IAAI,cAAc,2CAA2C;AAAA,QACjE,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,QACjB;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAEA,QAAI,WAAW,QAAQ,OAAO,WAAW,UAAU;AACjD,YAAM,IAAI,cAAc,4CAA4C;AAAA,QAClE,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,QACjB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,WAAW,sBAAsB,SAAS,OAAO;AAAA,IACnD;AAAA,EACF;AACF;AAWA,SAAS,sBAAsB,SAAyC;AACtE,QAAM,WAAW,QAAQ,IAAI,mBAAmB;AAChD,QAAM,eAAe,QAAQ,IAAI,uBAAuB;AACxD,QAAM,WAAW,QAAQ,IAAI,mBAAmB;AAChD,MAAI,aAAa,QAAQ,iBAAiB,QAAQ,aAAa,MAAM;AACnE,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,OAAO,QAAQ;AAC7B,QAAM,YAAY,OAAO,YAAY;AACrC,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,CAAC,OAAO,SAAS,SAAS,GAAG;AAC1D,WAAO;AAAA,EACT;AACA,QAAM,UAAU,iBAAiB,QAAQ;AACzC,MAAI,YAAY,MAAM;AACpB,WAAO;AAAA,EACT;AACA,SAAO,EAAE,OAAO,WAAW,QAAQ;AACrC;AAEA,SAAS,iBAAiB,KAA0B;AAClD,QAAM,UAAU,OAAO,GAAG;AAC1B,MAAI,OAAO,SAAS,OAAO,GAAG;AAI5B,WAAO,IAAI,KAAK,UAAU,GAAI;AAAA,EAChC;AACA,QAAM,KAAK,KAAK,MAAM,GAAG;AACzB,MAAI,OAAO,SAAS,EAAE,GAAG;AACvB,WAAO,IAAI,KAAK,EAAE;AAAA,EACpB;AACA,SAAO;AACT;AAEA,SAAS,cAAc,KAAc,WAAkC;AACrE,MAAI,eAAe,cAAe,QAAO;AACzC,MAAI,eAAe,gBAAgB,IAAI,SAAS,gBAAgB;AAC9D,WAAO,IAAI,cAAc,qCAAqC;AAAA,MAC5D,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,eAAe,SAAS,IAAI,SAAS,cAAc;AACrD,WAAO,IAAI,cAAc,qCAAqC;AAAA,MAC5D,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,SAAO,IAAI,cAAc,iCAAiC,OAAO,IAAI;AAAA,IACnE,MAAM;AAAA,IACN;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AACH;AAEA,eAAe,eACb,UACA,WACwB;AACxB,QAAM,SAAS,SAAS;AACxB,QAAM,aAAa,MAAM,mBAAmB,QAAQ;AACpD,QAAM,OAA0B;AAAA,IAC9B;AAAA,IACA,MAAM,WAAW;AAAA,IACjB;AAAA,EACF;AACA,MAAI,WAAW,iBAAiB,QAAW;AACzC,SAAK,eAAe,WAAW;AAAA,EACjC;AACA,SAAO,IAAI,cAAc,WAAW,SAAS,IAAI;AACnD;AAEA,eAAe,mBAAmB,UAI/B;AACD,QAAM,SAAS,SAAS;AACxB,QAAM,gBAAgB,MAAM,kBAAkB,QAAQ;AAEtD,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,MACL,SAAS,iBAAiB;AAAA,MAC1B,MAAM;AAAA,MACN,cAAc;AAAA,IAChB;AAAA,EACF;AACA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,MACL,SACE,iBAAiB;AAAA,MACnB,MAAM;AAAA,MACN,cAAc;AAAA,IAChB;AAAA,EACF;AACA,MAAI,WAAW,KAAK;AAClB,WAAO;AAAA,MACL,SAAS,iBAAiB;AAAA,MAC1B,MAAM;AAAA,MACN,cAAc,gBAAgB,SAAS,QAAQ,IAAI,aAAa,CAAC;AAAA,IACnE;AAAA,EACF;AACA,MAAI,UAAU,KAAK;AACjB,WAAO;AAAA,MACL,SAAS,iBAAiB,8BAA8B,MAAM;AAAA,MAC9D,MAAM;AAAA,MACN,cAAc;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AAAA,IACL,SAAS,iBAAiB,8BAA8B,MAAM;AAAA,IAC9D,MAAM;AAAA,IACN,cAAc;AAAA,EAChB;AACF;AAEA,eAAe,kBAAkB,UAA4C;AAC3E,MAAI;AACF,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,UAAI,UAAU,OAAO,WAAW,UAAU;AACxC,cAAM,MAAO,OAAmC;AAChD,cAAM,SAAU,OAAmC;AACnD,YAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,EAAG,QAAO;AACtD,YAAI,OAAO,WAAW,YAAY,OAAO,SAAS,EAAG,QAAO;AAAA,MAC9D;AAAA,IACF,QAAQ;AAAA,IAER;AACA,WAAO,KAAK,SAAS,MAAM,GAAG,KAAK,MAAM,GAAG,GAAG,CAAC,WAAM;AAAA,EACxD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,SAAS,sBAAsB,OAA0C;AACvE,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,MAAM,UAAU,UAAa,MAAM,UAAU,IAAI;AACnD,WAAO,IAAI,SAAS,MAAM,KAAK;AAAA,EACjC;AACA,MAAI,MAAM,aAAa,UAAa,MAAM,aAAa,IAAI;AACzD,WAAO,IAAI,YAAY,MAAM,QAAQ;AAAA,EACvC;AACA,MAAI,MAAM,SAAS,UAAa,MAAM,SAAS,IAAI;AACjD,WAAO,IAAI,QAAQ,MAAM,IAAI;AAAA,EAC/B;AACA,MAAI,MAAM,OAAO,UAAa,MAAM,OAAO,IAAI;AAC7C,WAAO,IAAI,MAAM,MAAM,EAAE;AAAA,EAC3B;AACA,MAAI,MAAM,UAAU,QAAW;AAC7B,WAAO,IAAI,SAAS,OAAO,MAAM,KAAK,CAAC;AAAA,EACzC;AACA,MAAI,MAAM,WAAW,UAAa,MAAM,WAAW,IAAI;AACrD,WAAO,IAAI,UAAU,MAAM,MAAM;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,KAAwC;AAC/D,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,OAAO,GAAG;AAC1B,MAAI,OAAO,SAAS,OAAO,EAAG,QAAO,KAAK,IAAI,GAAG,UAAU,GAAI;AAC/D,QAAM,OAAO,KAAK,MAAM,GAAG;AAC3B,MAAI,OAAO,SAAS,IAAI,GAAG;AACzB,UAAM,QAAQ,OAAO,KAAK,IAAI;AAC9B,WAAO,QAAQ,IAAI,QAAQ;AAAA,EAC7B;AACA,SAAO;AACT;;;AC/cA,IAAI,eAAsC;AAC1C,IAAI,YAA8B,CAAC;AAmBnC,SAAS,YAA4B;AACnC,MAAI,aAAc,QAAO;AAEzB,QAAM,SAAS,UAAU,UAAU,QAAQ,IAAI;AAC/C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA,EAAE,MAAM,kBAAkB;AAAA,IAC5B;AAAA,EACF;AACA,QAAM,UAAiC,EAAE,OAAO;AAChD,MAAI,UAAU,YAAY,OAAW,SAAQ,UAAU,UAAU;AACjE,MAAI,UAAU,cAAc,OAAW,SAAQ,YAAY,UAAU;AACrE,MAAI,UAAU,UAAU,OAAW,SAAQ,QAAQ,UAAU;AAC7D,iBAAe,IAAI,eAAe,OAAO;AACzC,SAAO;AACT;AAEA,SAAS,qBAAqB,gBAA0C;AAItE,QAAM,QAAQ,eAAe,YAAY;AACzC,MAAI,UAAU,UAAU,UAAU,WAAY,QAAO;AACrD,SAAO;AACT;AAYA,eAAsB,QAAQ,SAA0C;AACtE,QAAM,SAAS,UAAU;AACzB,QAAM,aAAa,MAAM,OAAO,SAAS,OAAO;AAEhD,MAAI,WAAW,aAAa,SAAS;AACnC,UAAM,IAAI,oBAAoB;AAAA,MAC5B,UAAU,qBAAqB,WAAW,QAAQ;AAAA,MAClD,cAAc,WAAW;AAAA,MACzB,QAAQ,WAAW;AAAA,MACnB,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,QAAM,gBAKF;AAAA,IACF,UAAU,WAAW;AAAA,IACrB,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,EAClB;AACA,MAAI,QAAQ,YAAY,OAAW,eAAc,UAAU,QAAQ;AACnE,QAAM,eAAe,MAAM,OAAO,aAAa,aAAa;AAE5D,MAAI,CAAC,aAAa,UAAU;AAC1B,UAAM,IAAI,oBAAoB;AAAA,MAC5B,UAAU;AAAA,MACV,cAAc,WAAW;AAAA,MACzB,QAAQ,+BAA+B,aAAa,OAAO;AAAA,MAC3D,WAAW,WAAW;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,UAAU,WAAW;AAAA,IACrB,YAAY,aAAa;AAAA,IACzB,WAAW,WAAW;AAAA,IACtB,QAAQ,WAAW;AAAA,IACnB,WAAW,aAAa;AAAA,EAC1B;AACF;;;AHtFA,IAAM,sBAAsB;AAE5B,eAAe,QACb,OACA,GACY;AACZ,SAAO,OAAO,UAAU,aACpB,MAAO,MAAyC,CAAC,IACjD;AACN;AAQO,SAAS,cACd,SACmB;AACnB,QAAM,aAAa,QAAQ,OAAO;AAClC,SAAO,OAAO,GAAG,SAAS;AACxB,UAAM,CAAC,OAAO,QAAQ,GAAG,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC7C,QAAQ,QAAQ,OAAO,CAAC;AAAA,MACxB,QAAQ,QAAQ,QAAQ,CAAC;AAAA,MACzB,QAAQ,UAAU,QAAQ,QAAQ,CAAC,IAAI,QAAQ,QAAQ,MAAS;AAAA,IAClE,CAAC;AAED,UAAM,UAA0B,EAAE,OAAO,OAAO;AAChD,QAAI,QAAQ,OAAW,SAAQ,UAAU;AAEzC,UAAM,SAAiB,MAAM,QAAQ,OAAO;AAC5C,MAAE,IAAI,YAAY,MAAM;AACxB,UAAM,KAAK;AAAA,EACb;AACF;AAkBA,SAAS,kBAAkB,KAAmD;AAC5E,QAAM,OAAgC;AAAA,IACpC,OAAO;AAAA,IACP,UAAU,IAAI;AAAA,IACd,cAAc,IAAI;AAAA,EACpB;AACA,MAAI,IAAI,WAAW,OAAW,MAAK,SAAS,IAAI;AAChD,MAAI,IAAI,cAAc,OAAW,MAAK,YAAY,IAAI;AACtD,SAAO;AACT;AAEA,SAAS,mBAAmB,KAA6C;AACvE,QAAM,OAAgC;AAAA,IACpC,OAAO;AAAA,IACP,MAAM,IAAI,QAAQ;AAAA,EACpB;AACA,MAAI,IAAI,cAAc,OAAW,MAAK,YAAY,IAAI;AACtD,SAAO;AACT;AAaO,SAAS,qBACd,UAAuC,CAAC,GAC1B;AACd,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,cAAc,QAAQ,eAAe;AAE3C,SAAO,CAAC,KAAK,MAAM;AACjB,QAAI,eAAe,qBAAqB;AACtC,aAAO,EAAE,KAAK,WAAW,GAAG,GAAG,UAAU;AAAA,IAC3C;AACA,QAAI,eAAe,eAAe;AAChC,aAAO,EAAE,KAAK,YAAY,GAAG,GAAG,WAAW;AAAA,IAC7C;AACA,UAAM;AAAA,EACR;AACF;","names":[]}