@volidator/node 1.0.0 → 1.0.1

package/dist/{chunk-KEXIKZGN.js → chunk-UUUKNFQ6.js}

@@ -53,4 +53,4 @@ function withVolidator(client, handler) {
 export {
   withVolidator
 };
-//# sourceMappingURL=chunk-KEXIKZGN.js.map
+//# sourceMappingURL=chunk-UUUKNFQ6.js.map

package/dist/chunk-UUUKNFQ6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middleware/next.ts"],"sourcesContent":["import { VolidatorClient, LogPayload } from \"../index\";\n\n/**\n * Next.js App Router Middleware for Volidator.\n * Automatically extracts telemetry context (IP, User Agent, Location)\n * from the Next.js standard Request object and injects it into every\n * `volidator.log()` and `volidator.compliance.*()` call made inside\n * the wrapped handler.\n */\nexport function withVolidator<T extends Function>(\n  client: VolidatorClient,\n  handler: T\n): (req: Request, ctx?: any, ...args: any[]) => Promise<any> {\n  return async (req: Request, ctx: any = {}, ...args: any[]) => {\n    const extractedContext = VolidatorClient.extractContext(req);\n\n    // ---------------------------------------------------------------------------\n    // Scoped log — merges request-level IP/UA context into every log call.\n    // ---------------------------------------------------------------------------\n    const scopedLog = async (payload: LogPayload) => {\n      return client.log({\n        ...payload,\n        context: {\n          ...extractedContext,\n          ...payload.context,\n          location: {\n            ...extractedContext.location,\n            ...(payload.context?.location || {}),\n          },\n          device: {\n            ...extractedContext.device,\n            ...(payload.context?.device || {}),\n          },\n        },\n      });\n    };\n\n    // ---------------------------------------------------------------------------\n    // Scoped compliance — mirrors VolidatorCompliance but routes through\n    // scopedLog so that IP/UA telemetry is preserved in compliance events.\n    //\n    // Previously this passed client.compliance directly, which called\n    // client.log() without the request context — silently dropping telemetry\n    // from every compliance audit event.\n    // ---------------------------------------------------------------------------\n    const withControl = (\n      action: string,\n      soc2Control: string,\n      isoControl: string,\n      payload: Omit<LogPayload, \"action\">\n    ) =>\n      scopedLog({\n        ...payload,\n        action,\n        metadata: {\n          ...payload.metadata,\n          soc2_control: soc2Control,\n          iso27001: isoControl,\n        },\n      });\n\n    const scopedCompliance = {\n      accessRevoked: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"access.revoked\", \"CC6.1\", \"A.9.2.6\", p),\n      accessGranted: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"access.granted\", \"CC6.1\", \"A.9.2.1\", p),\n      dataExported: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"data.exported\", \"CC6.6\", \"A.12.4.1\", p),\n      systemConfigChanged: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"system.config_changed\", \"CC6.2\", \"A.12.1.2\", p),\n      mfaEnabled: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"mfa.enabled\", \"CC6.3\", \"A.9.4.2\", p),\n    };\n\n    const newCtx = {\n      ...ctx,\n      volidator: {\n        log: scopedLog,\n        compliance: scopedCompliance,\n      },\n    };\n\n    return handler(req, newCtx, ...args);\n  };\n}\n"],"mappings":";;;;;AASO,SAAS,cACd,QACA,SAC2D;AAC3D,SAAO,OAAO,KAAc,MAAW,CAAC,MAAM,SAAgB;AAC5D,UAAM,mBAAmB,gBAAgB,eAAe,GAAG;AAK3D,UAAM,YAAY,OAAO,YAAwB;AAC/C,aAAO,OAAO,IAAI;AAAA,QAChB,GAAG;AAAA,QACH,SAAS;AAAA,UACP,GAAG;AAAA,UACH,GAAG,QAAQ;AAAA,UACX,UAAU;AAAA,YACR,GAAG,iBAAiB;AAAA,YACpB,GAAI,QAAQ,SAAS,YAAY,CAAC;AAAA,UACpC;AAAA,UACA,QAAQ;AAAA,YACN,GAAG,iBAAiB;AAAA,YACpB,GAAI,QAAQ,SAAS,UAAU,CAAC;AAAA,UAClC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAUA,UAAM,cAAc,CAClB,QACA,aACA,YACA,YAEA,UAAU;AAAA,MACR,GAAG;AAAA,MACH;AAAA,MACA,UAAU;AAAA,QACR,GAAG,QAAQ;AAAA,QACX,cAAc;AAAA,QACd,UAAU;AAAA,MACZ;AAAA,IACF,CAAC;AAEH,UAAM,mBAAmB;AAAA,MACvB,eAAe,CAAC,MACd,YAAY,kBAAkB,SAAS,WAAW,CAAC;AAAA,MACrD,eAAe,CAAC,MACd,YAAY,kBAAkB,SAAS,WAAW,CAAC;AAAA,MACrD,cAAc,CAAC,MACb,YAAY,iBAAiB,SAAS,YAAY,CAAC;AAAA,MACrD,qBAAqB,CAAC,MACpB,YAAY,yBAAyB,SAAS,YAAY,CAAC;AAAA,MAC7D,YAAY,CAAC,MACX,YAAY,eAAe,SAAS,WAAW,CAAC;AAAA,IACpD;AAEA,UAAM,SAAS;AAAA,MACb,GAAG;AAAA,MACH,WAAW;AAAA,QACT,KAAK;AAAA,QACL,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO,QAAQ,KAAK,QAAQ,GAAG,IAAI;AAAA,EACrC;AACF;","names":[]}

package/dist/middleware/next.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/middleware/next.ts","../../src/index.ts"],"sourcesContent":["import { VolidatorClient, LogPayload } from \"../index\";\n\n/**\n * Next.js App Router Middleware for Volidator.\n * Automatically extracts telemetry context (IP, User Agent, Location)\n * from the Next.js standard Request object and injects it into every\n * `volidator.log()` and `volidator.compliance.*()` call made inside\n * the wrapped handler.\n */\nexport function withVolidator<T extends Function>(client: VolidatorClient, handler: T) {\n  return async (req: Request, ctx: any = {}, ...args: any[]) => {\n    const extractedContext = VolidatorClient.extractContext(req);\n\n    // ---------------------------------------------------------------------------\n    // Scoped log — merges request-level IP/UA context into every log call.\n    // ---------------------------------------------------------------------------\n    const scopedLog = async (payload: LogPayload) => {\n      return client.log({\n        ...payload,\n        context: {\n          ...extractedContext,\n          ...payload.context,\n          location: {\n            ...extractedContext.location,\n            ...(payload.context?.location || {}),\n          },\n          device: {\n            ...extractedContext.device,\n            ...(payload.context?.device || {}),\n          },\n        },\n      });\n    };\n\n    // ---------------------------------------------------------------------------\n    // Scoped compliance — mirrors VolidatorCompliance but routes through\n    // scopedLog so that IP/UA telemetry is preserved in compliance events.\n    //\n    // Previously this passed client.compliance directly, which called\n    // client.log() without the request context — silently dropping telemetry\n    // from every compliance audit event.\n    // ---------------------------------------------------------------------------\n    const withControl = (\n      action: string,\n      soc2Control: string,\n      isoControl: string,\n      payload: Omit<LogPayload, \"action\">\n    ) =>\n      scopedLog({\n        ...payload,\n        action,\n        metadata: {\n          ...payload.metadata,\n          soc2_control: soc2Control,\n          iso27001: isoControl,\n        },\n      });\n\n    const scopedCompliance = {\n      accessRevoked: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"access.revoked\", \"CC6.1\", \"A.9.2.6\", p),\n      accessGranted: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"access.granted\", \"CC6.1\", \"A.9.2.1\", p),\n      dataExported: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"data.exported\", \"CC6.6\", \"A.12.4.1\", p),\n      systemConfigChanged: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"system.config_changed\", \"CC6.2\", \"A.12.1.2\", p),\n      mfaEnabled: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"mfa.enabled\", \"CC6.3\", \"A.9.4.2\", p),\n    };\n\n    const newCtx = {\n      ...ctx,\n      volidator: {\n        log: scopedLog,\n        compliance: scopedCompliance,\n      },\n    };\n\n    return handler(req, newCtx, ...args);\n  };\n}\n","// ---------------------------------------------------------------------------\r\n// Reference-Based Redaction Types\r\n// ---------------------------------------------------------------------------\r\n\r\n/**\r\n * A structured payload for fields listed in `referenceKeys`.\r\n * - `id`  — the non-sensitive internal identifier stored in Volidator as [REF:id].\r\n * - `pii` — the real value used ONLY to compute the blind index, then discarded.\r\n *\r\n * @example\r\n *   actor: { id: \"usr_890\", pii: \"john@company.com\" }\r\n *   // stored:      \"[REF:usr_890]\"\r\n *   // blind index: HMAC(\"john@company.com\")\r\n *   // telemetry:  extracted automatically or passed in context\r\n */\r\nexport type ReferencePayload = { id: string; pii: string };\r\n\r\n/**\r\n * Utility type that enforces { id, pii } shape on any LogPayload fields\r\n * whose key appears in the `referenceKeys` constructor option.\r\n * Gives a compile-time error if a developer passes a raw string instead.\r\n */\r\nexport type EnforceReference<TData, TRefKeys extends keyof TData> =\r\n  Omit<TData, TRefKeys> & { [K in TRefKeys]: ReferencePayload };\r\n\r\nexport interface TelemetryConfig {\r\n  preset?: \"strict\" | \"standard\" | \"full\";\r\n  ip?: \"track\" | \"anonymize\" | \"skip\";\r\n  userAgent?: \"track\" | \"parse\" | \"skip\";\r\n  location?: boolean;\r\n}\r\n\r\nexport interface TelemetryContext {\r\n  ip?: string;\r\n  userAgent?: string;\r\n  location?: {\r\n    country?: string;\r\n    region?: string;\r\n    city?: string;\r\n  };\r\n  device?: {\r\n    browser?: string;\r\n    os?: string;\r\n    type?: string;\r\n  };\r\n  [key: string]: any;\r\n}\r\n\r\nexport interface LogPayload {\r\n  /**\r\n   * The actor performing the action. Pass a plain string for normal logs.\r\n   * Pass a `ReferencePayload` when this field is listed in `referenceKeys`:\r\n   *   actor: { id: \"usr_890\", pii: \"john@company.com\" }\r\n   */\r\n  actor?: string | ReferencePayload;\r\n  actorId?: string; // support actorId as alias (plain string only)\r\n  action: string;\r\n  /**\r\n   * The target of the action. Pass a plain string for normal logs.\r\n   * Pass a `ReferencePayload` when this field is listed in `referenceKeys`.\r\n   */\r\n  target?: string | ReferencePayload;\r\n  targetId?: string; // support targetId as alias (plain string only)\r\n  /**\r\n   * The tenant or client identifier (e.g. B2B company name/ID).\r\n   * Pass a plain string for normal logs, or a `ReferencePayload`.\r\n   */\r\n  tenant?: string | ReferencePayload;\r\n  tenantId?: string; // support tenantId as alias (plain string only)\r\n  /**\r\n   * Groups all events belonging to a single agent run, workflow execution,\r\n   * or request trace. Passed through as a blind index so the server can\r\n   * filter by run without decrypting payloads.\r\n   */\r\n  traceId?: string;\r\n  /**\r\n   * Identifies this specific event within the trace (analogous to OTel spanId).\r\n   */\r\n  spanId?: string;\r\n  /**\r\n   * The spanId of the event that caused this one (parentSpanId).\r\n   */\r\n  parentSpanId?: string;\r\n  /**\r\n   * Arbitrary metadata. Values for keys listed in `referenceKeys` must be\r\n   * `ReferencePayload` objects: { id: \"ref_id\", pii: \"sensitive_value\" }.\r\n   */\r\n  metadata?: Record<string, any>;\r\n  context?: TelemetryContext;\r\n  telemetry?: TelemetryConfig;\r\n  req?: any; // support passing the HTTP request object directly\r\n}\r\n\r\ninterface EmbedTokenViewConfig {\r\n  /** The columns to show in the table, e.g. [\"actor\", \"action\", \"metadata.region\", \"createdAt\"] */\r\n  columns?: string[];\r\n  /** Default search filters loaded on mount */\r\n  defaultFilter?: {\r\n    search?: string;\r\n    action?: string;\r\n  };\r\n}\r\n\r\ninterface EmbedTokenConfig {\r\n  /** The plaintext actor identifier (e.g. \"usr_123\") */\r\n  actorId?: string;\r\n  /** The plaintext target identifier (e.g. \"usr_123\") */\r\n  targetId?: string;\r\n  /** The plaintext tenant identifier (e.g. \"johnsbakery\") */\r\n  tenantId?: string;\r\n  /** Scopes the logs to query. If not provided, defaults to 'actor' if actorId is provided, or 'tenant' if tenantId is provided. */\r\n  scope?: \"actor\" | \"target\" | \"tenant\" | \"all\" | \"auditor\";\r\n  /** Duration string: \"30m\", \"2h\", \"7d\". Defaults to \"2h\". */\r\n  expiresIn?: string;\r\n  /** Custom dashboard origin URL override */\r\n  dashboardUrl?: string;\r\n  /** Optional origin of host app for iframe postMessage domain validation */\r\n  hostOrigin?: string;\r\n  /** Custom column presentation and default filters */\r\n  view?: EmbedTokenViewConfig;\r\n}\r\n\r\ninterface EmbedTokenResult {\r\n  token: string;\r\n  embedUrl: string;\r\n}\r\n\r\nexport class VolidatorClient {\r\n  private apiKey: string;\r\n  private endpoint: string;\r\n  private telemetryConfig: Required<Omit<TelemetryConfig, \"preset\">>;\r\n\r\n  // Optional fields required only for generateEmbedToken()\r\n  private projectId?: string;\r\n  private clientSecret?: string;\r\n\r\n  private redactKeys: string[];\r\n  private referenceKeys: string[];\r\n\r\n  // Keyring properties\r\n  private activeKeyId: string;\r\n  private keyring: Record<string, string>;\r\n  private hashedKeyring: Record<string, Uint8Array>;\r\n  \r\n  // Custom limit for metadata object serialization size\r\n  private maxMetadataSize: number;\r\n\r\n  public compliance: VolidatorCompliance;\r\n  public agent: VolidatorAgent;\r\n\r\n  constructor(config: {\r\n    apiKey: string;\r\n    encryptionKey?: string;\r\n    activeEncryptionKeyId?: string;\r\n    keyring?: Record<string, string>;\r\n    endpoint?: string;\r\n    // Provide these when you need to generate embed tokens server-side\r\n    projectId?: string;\r\n    clientSecret?: string;\r\n    telemetry?: TelemetryConfig;\r\n    /**\r\n     * Fields to replace with [REDACTED:key] before encryption.\r\n     */\r\n    redactKeys?: string[];\r\n    /**\r\n     * Fields to replace with [REF:id] before encryption (JIT Hydration).\r\n     */\r\n    referenceKeys?: string[];\r\n    /**\r\n     * Custom maximum size for serialized metadata in bytes. Defaults to 10240 (10KB).\r\n     */\r\n    maxMetadataSize?: number;\r\n  }) {\r\n    this.apiKey = config.apiKey;\r\n    this.endpoint = config.endpoint || \"https://ingestion.volidator.com\";\r\n    this.projectId = config.projectId;\r\n    this.clientSecret = config.clientSecret;\r\n    this.redactKeys = config.redactKeys || [];\r\n    this.referenceKeys = config.referenceKeys || [];\r\n    this.maxMetadataSize = config.maxMetadataSize || 10240;\r\n\r\n    // Parse encryption keys & keyring\r\n    if (config.keyring && config.activeEncryptionKeyId) {\r\n      this.keyring = config.keyring;\r\n      this.activeKeyId = config.activeEncryptionKeyId;\r\n    } else if (config.encryptionKey) {\r\n      this.activeKeyId = \"v1\";\r\n      this.keyring = { \"v1\": config.encryptionKey };\r\n    } else {\r\n      throw new Error(\"Either encryptionKey OR (keyring AND activeEncryptionKeyId) must be provided in VolidatorClient constructor.\");\r\n    }\r\n\r\n    // Limit keyring size to 5 for performance & security\r\n    if (Object.keys(this.keyring).length > 5) {\r\n      throw new Error(\"Keyring size cannot exceed 5 keys.\");\r\n    }\r\n\r\n    if (!this.keyring[this.activeKeyId]) {\r\n      throw new Error(`Active key ID '${this.activeKeyId}' must exist in the keyring.`);\r\n    }\r\n\r\n    // Keys will be hashed lazily via WebCrypto in _getHashedKey\r\n    this.hashedKeyring = {};\r\n\r\n    // Default to 'standard' preset if nothing is provided\r\n    this.telemetryConfig = VolidatorClient.resolveTelemetryConfig(config.telemetry || { preset: \"standard\" });\r\n    this.compliance = new VolidatorCompliance(this);\r\n    this.agent = new VolidatorAgent(this);\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // Telemetry Context Parser (Zero-latency header parsing)\r\n  // ---------------------------------------------------------------------------\r\n  static extractContext(req: any): TelemetryContext {\r\n    const getHeader = (name: string): string => {\r\n      if (!req) return \"\";\r\n      // Handle standard Web API Request/Headers\r\n      if (typeof req.headers?.get === \"function\") {\r\n        return req.headers.get(name) || \"\";\r\n      }\r\n      // Handle Node.js IncomingMessage request headers\r\n      if (req.headers && typeof req.headers === \"object\") {\r\n        return req.headers[name] || req.headers[name.toLowerCase()] || \"\";\r\n      }\r\n      return \"\";\r\n    };\r\n\r\n    const rawIp = getHeader(\"cf-connecting-ip\") ||\r\n      getHeader(\"x-real-ip\") ||\r\n      getHeader(\"x-forwarded-for\");\r\n\r\n    const ip = rawIp ? rawIp.split(\",\")[0].trim() : (req?.socket?.remoteAddress || \"\");\r\n    const userAgent = getHeader(\"user-agent\");\r\n\r\n    return {\r\n      ip,\r\n      userAgent,\r\n      location: {\r\n        country: getHeader(\"cf-ipcountry\") || getHeader(\"x-vercel-ip-country\") || \"\",\r\n        region: getHeader(\"cf-region-code\") || getHeader(\"x-vercel-ip-country-region\") || \"\",\r\n        city: getHeader(\"cf-ipcity\") || getHeader(\"x-vercel-ip-city\") || \"\",\r\n      }\r\n    };\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // OpenTelemetry W3C traceparent context parser\r\n  // ---------------------------------------------------------------------------\r\n  static extractTraceContext(req: any): { traceId?: string; spanId?: string } {\r\n    if (!req) return {};\r\n    const getHeader = (name: string): string => {\r\n      if (typeof req.headers?.get === \"function\") {\r\n        return req.headers.get(name) || \"\";\r\n      }\r\n      if (req.headers && typeof req.headers === \"object\") {\r\n        return req.headers[name] || req.headers[name.toLowerCase()] || \"\";\r\n      }\r\n      return \"\";\r\n    };\r\n\r\n    const traceparent = getHeader(\"traceparent\");\r\n    if (!traceparent) return {};\r\n    const parts = traceparent.split(\"-\");\r\n    if (parts.length !== 4) return {};\r\n    return { traceId: parts[1], spanId: parts[2] };\r\n  }\r\n\r\n  private static resolveTelemetryConfig(config: TelemetryConfig): Required<Omit<TelemetryConfig, \"preset\">> {\r\n    const preset = config.preset || \"standard\";\r\n\r\n    let ip: \"track\" | \"anonymize\" | \"skip\" = \"anonymize\";\r\n    let userAgent: \"track\" | \"parse\" | \"skip\" = \"parse\";\r\n    let location = true;\r\n\r\n    if (preset === \"strict\") {\r\n      ip = \"skip\";\r\n      userAgent = \"skip\";\r\n      location = false;\r\n    } else if (preset === \"full\") {\r\n      ip = \"track\";\r\n      userAgent = \"track\";\r\n      location = true;\r\n    }\r\n\r\n    if (config.ip !== undefined) ip = config.ip;\r\n    if (config.userAgent !== undefined) userAgent = config.userAgent;\r\n    if (config.location !== undefined) location = config.location;\r\n\r\n    return { ip, userAgent, location };\r\n  }\r\n\r\n  private parseUserAgent(ua: string) {\r\n    let browser = \"Unknown Browser\";\r\n    let os = \"Unknown OS\";\r\n    let type = \"Desktop\";\r\n\r\n    if (/Volidator-Ingest-Worker/i.test(ua)) {\r\n      return {\r\n        browser: \"Volidator Ingest Worker\",\r\n        os: \"Linux Server\",\r\n        type: \"Server\"\r\n      };\r\n    }\r\n\r\n    // Simple Device Type detection\r\n    if (/mobile/i.test(ua)) {\r\n      type = \"Mobile\";\r\n    } else if (/tablet|ipad/i.test(ua)) {\r\n      type = \"Tablet\";\r\n    } else if (/server|bot/i.test(ua)) {\r\n      type = \"Server\";\r\n    }\r\n\r\n    // Simple Browser detection\r\n    if (/chrome|crios/i.test(ua) && !/edge|edg/i.test(ua) && !/opr/i.test(ua)) {\r\n      const match = ua.match(/(?:chrome|crios)\\/([0-9\\.]+)/i);\r\n      browser = `Chrome ${match ? match[1].split('.')[0] : \"\"}`.trim();\r\n    } else if (/safari/i.test(ua) && !/chrome|crios/i.test(ua) && !/android/i.test(ua)) {\r\n      browser = /mobile/i.test(ua) ? \"Safari Mobile\" : \"Safari\";\r\n    } else if (/firefox|fxios/i.test(ua)) {\r\n      browser = \"Firefox\";\r\n    } else if (/edge|edg/i.test(ua)) {\r\n      browser = \"Edge\";\r\n    }\r\n\r\n    // Simple OS detection\r\n    if (/windows/i.test(ua)) {\r\n      os = \"Windows\";\r\n    } else if (/macintosh|mac os x/i.test(ua)) {\r\n      os = \"macOS\";\r\n    } else if (/iphone|ipad|ipod/i.test(ua)) {\r\n      os = \"iOS\";\r\n    } else if (/android/i.test(ua)) {\r\n      os = \"Android\";\r\n    } else if (/linux/i.test(ua)) {\r\n      os = \"Linux\";\r\n    }\r\n\r\n    return { browser, os, type };\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // Blind Index & Key Hashing (WebCrypto)\r\n  // ---------------------------------------------------------------------------\r\n  private async _getHashedKey(id: string): Promise<Uint8Array> {\r\n    if (this.hashedKeyring[id]) return this.hashedKeyring[id];\r\n    const rawKey = this.keyring[id];\r\n    const buf = new TextEncoder().encode(rawKey);\r\n    const hash = await globalThis.crypto.subtle.digest(\"SHA-256\", buf);\r\n    this.hashedKeyring[id] = new Uint8Array(hash);\r\n    return this.hashedKeyring[id];\r\n  }\r\n\r\n  private async generateBlindIndex(value: string, keyBuffer: Uint8Array): Promise<string> {\r\n    const key = await globalThis.crypto.subtle.importKey(\r\n      \"raw\", keyBuffer as unknown as BufferSource, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]\r\n    );\r\n    const signature = await globalThis.crypto.subtle.sign(\r\n      \"HMAC\", key, new TextEncoder().encode(value)\r\n    );\r\n    return Array.from(new Uint8Array(signature))\r\n      .map(b => b.toString(16).padStart(2, \"0\"))\r\n      .join(\"\");\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // Payload Encryption — AES-256-GCM with prepended 12-byte IV\r\n  // Layout: [IV (12B)] [Ciphertext] [Auth Tag (16B)]\r\n  // ---------------------------------------------------------------------------\r\n  private async encryptPayload(payload: object): Promise<string> {\r\n    const text = JSON.stringify(payload);\r\n    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));\r\n    const activeHashedKey = await this._getHashedKey(this.activeKeyId);\r\n\r\n    const cryptoKey = await globalThis.crypto.subtle.importKey(\r\n      \"raw\", activeHashedKey as unknown as BufferSource, { name: \"AES-GCM\" }, false, [\"encrypt\"]\r\n    );\r\n\r\n    const encryptedBuffer = await globalThis.crypto.subtle.encrypt(\r\n      { name: \"AES-GCM\", iv }, cryptoKey, new TextEncoder().encode(text)\r\n    );\r\n\r\n    const finalBuffer = new Uint8Array(iv.length + encryptedBuffer.byteLength);\r\n    finalBuffer.set(iv, 0);\r\n    finalBuffer.set(new Uint8Array(encryptedBuffer), iv.length);\r\n\r\n    // Convert to base64 safely for edges\r\n    let binary = '';\r\n    const len = finalBuffer.byteLength;\r\n    for (let i = 0; i < len; i++) {\r\n      binary += String.fromCharCode(finalBuffer[i]);\r\n    }\r\n    const base64 = btoa(binary);\r\n    return `${this.activeKeyId}:${base64}`;\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // prepareLogEntry() — Prepares, redacts, and encrypts a single log entry payload\r\n  // ---------------------------------------------------------------------------\r\n  private async prepareLogEntry(payload: LogPayload, maxMetaOverride?: number) {\r\n    const actorRaw = payload.actor || payload.actorId || \"unknown\";\r\n    const targetRaw = payload.target || payload.targetId || \"unknown\";\r\n    const tenantRaw = payload.tenant || payload.tenantId || \"\";\r\n\r\n    const truncate = (str: string, maxLen: number): string => {\r\n      if (str.length > maxLen) {\r\n        return str.slice(0, maxLen) + \"...\";\r\n      }\r\n      return str;\r\n    };\r\n\r\n    const extractPii = (v: string | ReferencePayload): string =>\r\n      typeof v === \"object\" ? v.pii : v;\r\n    const extractId = (v: string | ReferencePayload): string =>\r\n      typeof v === \"object\" ? v.id : v;\r\n\r\n    const actor = truncate(extractPii(actorRaw), 255);\r\n    const target = truncate(extractPii(targetRaw), 255);\r\n    const tenant = tenantRaw ? truncate(extractPii(tenantRaw), 255) : \"\";\r\n    const action = truncate(payload.action, 255);\r\n\r\n    const logTelemetry = payload.telemetry\r\n      ? VolidatorClient.resolveTelemetryConfig({ ...this.telemetryConfig, ...payload.telemetry })\r\n      : this.telemetryConfig;\r\n\r\n    let payloadCtx = payload.context || {};\r\n    if (payload.req) {\r\n      const extracted = VolidatorClient.extractContext(payload.req);\r\n      payloadCtx = {\r\n        ...extracted,\r\n        ...payloadCtx,\r\n        location: {\r\n          ...extracted.location,\r\n          ...payloadCtx.location,\r\n        },\r\n        device: {\r\n          ...extracted.device,\r\n          ...payloadCtx.device,\r\n        },\r\n      };\r\n    }\r\n\r\n    const context: TelemetryContext = {};\r\n    const rawIp = payloadCtx.ip || \"\";\r\n    const rawUa = payloadCtx.userAgent || \"\";\r\n\r\n    if (logTelemetry.location) {\r\n      context.location = {};\r\n      if (payloadCtx.location) {\r\n        context.location.country = payloadCtx.location.country || \"\";\r\n        context.location.region = payloadCtx.location.region || \"\";\r\n        const isFull = payload.telemetry?.preset === \"full\" || (!payload.telemetry && this.telemetryConfig.ip === \"track\");\r\n        if (logTelemetry.ip === \"track\" || isFull) {\r\n          context.location.city = payloadCtx.location.city || \"\";\r\n        }\r\n      }\r\n    }\r\n\r\n    if (logTelemetry.ip === \"anonymize\" && rawIp) {\r\n      context.ip = await this.generateBlindIndex(rawIp, await this._getHashedKey(this.activeKeyId));\r\n    } else if (logTelemetry.ip === \"track\" && rawIp) {\r\n      context.ip = rawIp;\r\n    }\r\n\r\n    if (logTelemetry.userAgent !== \"skip\") {\r\n      if (rawUa) {\r\n        context.device = this.parseUserAgent(rawUa);\r\n        if (logTelemetry.userAgent === \"track\") {\r\n          context.userAgent = truncate(rawUa, 1000);\r\n        }\r\n      } else if (payloadCtx.device) {\r\n        context.device = payloadCtx.device;\r\n      }\r\n    }\r\n\r\n    const scrub = (value: string, key: string): string =>\r\n      this.redactKeys.includes(key) ? `[REDACTED:${key}]` : value;\r\n\r\n    const applyRef = (rawValue: string | ReferencePayload, key: string): string => {\r\n      if (this.referenceKeys.includes(key)) {\r\n        const id = extractId(rawValue);\r\n        return `[REF:${id}]`;\r\n      }\r\n      return scrub(extractPii(rawValue), key);\r\n    };\r\n\r\n    const rawMetadata = payload.metadata || {};\r\n    const safeMetadata: Record<string, any> = {};\r\n    for (const [k, v] of Object.entries(rawMetadata)) {\r\n      const metaKey = `metadata.${k}`;\r\n      if (this.referenceKeys.includes(metaKey) && typeof v === \"object\" && v !== null && \"id\" in v) {\r\n        safeMetadata[k] = `[REF:${(v as ReferencePayload).id}]`;\r\n      } else if (this.redactKeys.includes(metaKey) && typeof v === \"string\") {\r\n        safeMetadata[k] = `[REDACTED:${k}]`;\r\n      } else {\r\n        safeMetadata[k] = v;\r\n      }\r\n    }\r\n\r\n    const limitDepth = (obj: any, currentDepth = 1): any => {\r\n      if (currentDepth > 5) {\r\n        return \"[Truncated - Depth Exceeded]\";\r\n      }\r\n      if (typeof obj !== \"object\" || obj === null) {\r\n        if (typeof obj === \"string\") {\r\n          return truncate(obj, 1000);\r\n        }\r\n        return obj;\r\n      }\r\n      if (Array.isArray(obj)) {\r\n        return obj.map(item => limitDepth(item, currentDepth + 1));\r\n      }\r\n      const result: Record<string, any> = {};\r\n      for (const [key, val] of Object.entries(obj)) {\r\n        result[key] = limitDepth(val, currentDepth + 1);\r\n      }\r\n      return result;\r\n    };\r\n\r\n    const processedMetadata = limitDepth(safeMetadata);\r\n    const serializedMeta = JSON.stringify(processedMetadata);\r\n    const maxMetaLimit = maxMetaOverride || this.maxMetadataSize;\r\n    if (serializedMeta.length > maxMetaLimit) {\r\n      throw new Error(`Metadata size exceeds maximum allowed limit of ${maxMetaLimit / 1024}KB.`);\r\n    }\r\n\r\n    const safeActor = applyRef(actorRaw, \"actor\");\r\n    const safeTarget = applyRef(targetRaw, \"target\");\r\n    const safeTenant = tenantRaw ? applyRef(tenantRaw, \"tenant\") : undefined;\r\n\r\n    const enrichedPayload: any = {\r\n      actor: safeActor,\r\n      action,\r\n      target: safeTarget,\r\n      metadata: processedMetadata,\r\n    };\r\n\r\n    if (safeTenant) {\r\n      enrichedPayload.tenant = safeTenant;\r\n    }\r\n\r\n    if (Object.keys(context).length > 0) {\r\n      enrichedPayload.context = context;\r\n    }\r\n\r\n    // Auto-extract trace contexts\r\n    let traceId = payload.traceId;\r\n    let spanId = payload.spanId;\r\n    let parentSpanId = payload.parentSpanId;\r\n\r\n    if (payload.req) {\r\n      const extractedTrace = VolidatorClient.extractTraceContext(payload.req);\r\n      if (!traceId && extractedTrace.traceId) {\r\n        traceId = extractedTrace.traceId;\r\n      }\r\n      if (!spanId && extractedTrace.spanId) {\r\n        spanId = extractedTrace.spanId;\r\n      }\r\n    }\r\n\r\n    if (spanId) {\r\n      enrichedPayload.spanId = spanId;\r\n    }\r\n    if (parentSpanId) {\r\n      enrichedPayload.parentSpanId = parentSpanId;\r\n    }\r\n\r\n    const activeKeyBuffer = await this._getHashedKey(this.activeKeyId);\r\n    const actorBlindIndex = await this.generateBlindIndex(actor, activeKeyBuffer);\r\n    const actionBlindIndex = await this.generateBlindIndex(action, activeKeyBuffer);\r\n    const targetBlindIndex = await this.generateBlindIndex(target, activeKeyBuffer);\r\n    const tenantBlindIndex = tenant ? await this.generateBlindIndex(tenant, activeKeyBuffer) : undefined;\r\n    const traceBlindIndex = traceId ? await this.generateBlindIndex(traceId, activeKeyBuffer) : undefined;\r\n\r\n    const encryptedPayload = await this.encryptPayload(enrichedPayload);\r\n\r\n    return {\r\n      actorBlindIndex,\r\n      actionBlindIndex,\r\n      targetBlindIndex,\r\n      tenantBlindIndex,\r\n      traceBlindIndex,\r\n      encryptedPayload,\r\n    };\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // log() — Encrypt and ingest a single audit event\r\n  // ---------------------------------------------------------------------------\r\n  async log(payload: LogPayload, maxMetaOverride?: number): Promise<boolean> {\r\n    const entry = await this.prepareLogEntry(payload, maxMetaOverride);\r\n    try {\r\n      const res = await fetch(`${this.endpoint}/v1/log`, {\r\n        method: \"POST\",\r\n        headers: {\r\n          Authorization: `Bearer ${this.apiKey}`,\r\n          \"Content-Type\": \"application/json\",\r\n        },\r\n        body: JSON.stringify(entry),\r\n      });\r\n\r\n      return res.ok;\r\n    } catch (err: any) {\r\n      console.error(`[Volidator] Failed to send log: ${err.message}`);\r\n      return false;\r\n    }\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // logBatch() — Bulk encrypt and ingest a batch of up to 100 audit events\r\n  // ---------------------------------------------------------------------------\r\n  async logBatch(payloads: LogPayload[], maxMetaOverride?: number): Promise<{ accepted: number; rejected: number }> {\r\n    if (!Array.isArray(payloads) || payloads.length === 0) {\r\n      return { accepted: 0, rejected: 0 };\r\n    }\r\n\r\n    // Cap batch size at 100\r\n    const batch = payloads.slice(0, 100);\r\n    const preparedEntries: any[] = [];\r\n    let rejected = payloads.length - batch.length;\r\n\r\n    const results = await Promise.allSettled(\r\n      batch.map(p => this.prepareLogEntry(p, maxMetaOverride))\r\n    );\r\n\r\n    for (const res of results) {\r\n      if (res.status === \"fulfilled\") {\r\n        preparedEntries.push(res.value);\r\n      } else {\r\n        rejected++;\r\n        console.error(`[Volidator] Failed to prepare batch entry: ${res.reason?.message}`);\r\n      }\r\n    }\r\n\r\n    if (preparedEntries.length === 0) {\r\n      return { accepted: 0, rejected };\r\n    }\r\n\r\n    try {\r\n      const res = await fetch(`${this.endpoint}/v1/logs/batch`, {\r\n        method: \"POST\",\r\n        headers: {\r\n          Authorization: `Bearer ${this.apiKey}`,\r\n          \"Content-Type\": \"application/json\",\r\n        },\r\n        body: JSON.stringify({ logs: preparedEntries }),\r\n      });\r\n\r\n      if (res.ok) {\r\n        return { accepted: preparedEntries.length, rejected };\r\n      } else {\r\n        console.error(`[Volidator] Batch ingestion endpoint returned status: ${res.status}`);\r\n        return { accepted: 0, rejected: rejected + preparedEntries.length };\r\n      }\r\n    } catch (err: any) {\r\n      console.error(`[Volidator] Failed to send log batch: ${err.message}`);\r\n      return { accepted: 0, rejected: rejected + preparedEntries.length };\r\n    }\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // generateEmbedToken() — Sign a HS256 JWT for the embeddable dashboard widget\r\n  // ---------------------------------------------------------------------------\r\n  async generateEmbedToken(config: EmbedTokenConfig): Promise<EmbedTokenResult> {\r\n    if (!this.projectId || !this.clientSecret) {\r\n      throw new Error(\r\n        \"generateEmbedToken() requires projectId and clientSecret in the VolidatorClient constructor.\"\r\n      );\r\n    }\r\n\r\n    const {\r\n      actorId,\r\n      targetId,\r\n      tenantId,\r\n      scope,\r\n      expiresIn = \"2h\",\r\n      dashboardUrl = \"https://dash.volidator.com\",\r\n      hostOrigin,\r\n      view,\r\n    } = config;\r\n\r\n    // Determine default query scope based on parameters\r\n    const defaultScope = scope || (tenantId ? \"tenant\" : \"actor\");\r\n\r\n    // Check if at least one identity parameter is provided (bypassed for auditor scope)\r\n    if (defaultScope !== \"auditor\" && !actorId && !targetId && !tenantId) {\r\n      throw new Error(\r\n        \"At least one of actorId, targetId, or tenantId must be provided to generateEmbedToken().\"\r\n      );\r\n    }\r\n\r\n    // 1. Compute blind indexes for all keys in the keyring\r\n    const actorBlindIndexes = actorId\r\n      ? await Promise.all(Object.keys(this.keyring).map(async id => this.generateBlindIndex(actorId, await this._getHashedKey(id))))\r\n      : undefined;\r\n    const targetBlindIndexes = targetId\r\n      ? await Promise.all(Object.keys(this.keyring).map(async id => this.generateBlindIndex(targetId, await this._getHashedKey(id))))\r\n      : undefined;\r\n    const tenantBlindIndexes = tenantId\r\n      ? await Promise.all(Object.keys(this.keyring).map(async id => this.generateBlindIndex(tenantId, await this._getHashedKey(id))))\r\n      : undefined;\r\n\r\n    // 2. Resolve expiry to seconds, capping it at 1 hour (3600s) for security.\r\n    const parsedExpiry = this.parseExpiry(expiresIn);\r\n    const maxExpiry = defaultScope === \"auditor\" ? 604800 : 3600;\r\n    const expiresInSeconds = Math.min(parsedExpiry, maxExpiry);\r\n    const now = Math.floor(Date.now() / 1000);\r\n\r\n    // 3. Build the JWT payload\r\n    const payload: Record<string, any> = {\r\n      pid: this.projectId,\r\n      scope: defaultScope,\r\n      iat: now,\r\n      exp: now + expiresInSeconds,\r\n    };\r\n\r\n    if (actorBlindIndexes) payload.abi = actorBlindIndexes;\r\n    if (targetBlindIndexes) payload.tgb = targetBlindIndexes;\r\n    if (tenantBlindIndexes) payload.tbi = tenantBlindIndexes;\r\n\r\n    // Compresses presentation config to minimize cookie/header footprint\r\n    if (view) {\r\n      const compressed: Record<string, any> = {};\r\n      if (Array.isArray(view.columns)) {\r\n        compressed.cols = view.columns.map((col) => {\r\n          if (col === \"createdAt\") return \"cat\";\r\n          if (col === \"actor\") return \"act\";\r\n          if (col === \"action\") return \"acn\";\r\n          if (col === \"target\") return \"tgt\";\r\n          if (col.startsWith(\"metadata.\")) {\r\n            return `m.${col.slice(9)}`;\r\n          }\r\n          return col;\r\n        });\r\n      }\r\n      if (view.defaultFilter) {\r\n        compressed.flt = {};\r\n        if (view.defaultFilter.search !== undefined) {\r\n          compressed.flt.q = view.defaultFilter.search;\r\n        }\r\n        if (view.defaultFilter.action !== undefined) {\r\n          compressed.flt.act = view.defaultFilter.action;\r\n        }\r\n      }\r\n      payload.view = compressed;\r\n    }\r\n\r\n    // 4. Sign as HS256 JWT using the project's clientSecret\r\n    const token = await this.signHS256JWT(payload, this.clientSecret);\r\n\r\n    // 5. Append the keyring as the URL hash fragment\r\n    const keyringString = Object.entries(this.keyring)\r\n      .map(([id, key]) => `${id}:${key}`)\r\n      .join(\",\");\r\n    const hostParam = hostOrigin\r\n      ? `?host=${encodeURIComponent(hostOrigin)}`\r\n      : \"\";\r\n    const embedUrl = `${dashboardUrl}/embed/${token}${hostParam}#${keyringString}`;\r\n\r\n    return { token, embedUrl };\r\n  }\r\n\r\n  private async signHS256JWT(payload: object, secret: string): Promise<string> {\r\n    const header = { alg: \"HS256\", typ: \"JWT\" };\r\n\r\n    const encode = (obj: object) =>\r\n      btoa(JSON.stringify(obj))\r\n        .replace(/\\+/g, \"-\")\r\n        .replace(/\\//g, \"_\")\r\n        .replace(/=/g, \"\");\r\n\r\n    const unsigned = `${encode(header)}.${encode(payload)}`;\r\n\r\n    const key = await globalThis.crypto.subtle.importKey(\r\n      \"raw\", new TextEncoder().encode(secret) as unknown as BufferSource, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]\r\n    );\r\n    const signatureBuffer = await globalThis.crypto.subtle.sign(\r\n      \"HMAC\", key, new TextEncoder().encode(unsigned)\r\n    );\r\n\r\n    let binary = '';\r\n    const arr = new Uint8Array(signatureBuffer);\r\n    for (let i = 0; i < arr.byteLength; i++) {\r\n      binary += String.fromCharCode(arr[i]);\r\n    }\r\n    const signature = btoa(binary)\r\n      .replace(/\\+/g, \"-\")\r\n      .replace(/\\//g, \"_\")\r\n      .replace(/=/g, \"\");\r\n\r\n    return `${unsigned}.${signature}`;\r\n  }\r\n\r\n  private parseExpiry(expiry: string): number {\r\n    const match = expiry.match(/^(\\d+)(s|m|h|d)$/);\r\n    if (!match) return 7200;\r\n    const [, num, unit] = match;\r\n    const n = parseInt(num, 10);\r\n    switch (unit) {\r\n      case \"s\": return n;\r\n      case \"m\": return n * 60;\r\n      case \"h\": return n * 3600;\r\n      case \"d\": return n * 86400;\r\n      default: return 7200;\r\n    }\r\n  }\r\n}\r\n\r\n// ---------------------------------------------------------------------------\r\n// Standard Compliance Logging Helper Class\r\n// ---------------------------------------------------------------------------\r\nexport class VolidatorCompliance {\r\n  private client: VolidatorClient;\r\n\r\n  constructor(client: VolidatorClient) {\r\n    this.client = client;\r\n  }\r\n\r\n  private async logWithControl(\r\n    action: string,\r\n    soc2Control: string,\r\n    isoControl: string,\r\n    payload: Omit<LogPayload, \"action\">\r\n  ): Promise<boolean> {\r\n    const metadata = {\r\n      ...payload.metadata,\r\n      soc2_control: soc2Control,\r\n      iso27001: isoControl,\r\n    };\r\n    return this.client.log({\r\n      ...payload,\r\n      action,\r\n      metadata,\r\n    });\r\n  }\r\n\r\n  async accessRevoked(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"access.revoked\", \"CC6.1\", \"A.9.2.6\", payload);\r\n  }\r\n\r\n  async accessGranted(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"access.granted\", \"CC6.1\", \"A.9.2.1\", payload);\r\n  }\r\n\r\n  async dataExported(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"data.exported\", \"CC6.6\", \"A.12.4.1\", payload);\r\n  }\r\n\r\n  async systemConfigChanged(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"system.config_changed\", \"CC6.2\", \"A.12.1.2\", payload);\r\n  }\r\n\r\n  async mfaEnabled(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"mfa.enabled\", \"CC6.3\", \"A.9.4.2\", payload);\r\n  }\r\n}\r\n\r\n// ---------------------------------------------------------------------------\r\n// AI & Autonomous Agent Compliance Audit Taxonomy Class\r\n// ---------------------------------------------------------------------------\r\nexport class VolidatorAgent {\r\n  private client: VolidatorClient;\r\n\r\n  constructor(client: VolidatorClient) {\r\n    this.client = client;\r\n  }\r\n\r\n  private async logAgent(\r\n    action: string,\r\n    euAiAct: string,\r\n    nistAiRmf: string,\r\n    soc2Control: string,\r\n    isoControl: string,\r\n    payload: Omit<LogPayload, \"action\"> & Record<string, any>\r\n  ): Promise<boolean> {\r\n    const {\r\n      actor,\r\n      actorId,\r\n      target,\r\n      targetId,\r\n      tenant,\r\n      tenantId,\r\n      metadata,\r\n      context,\r\n      telemetry,\r\n      req,\r\n      traceId,\r\n      spanId,\r\n      parentSpanId,\r\n      ...agentData\r\n    } = payload;\r\n\r\n    const enrichedMetadata = {\r\n      ...metadata,\r\n      ...agentData,\r\n      eu_ai_act: euAiAct,\r\n      nist_ai_rmf: nistAiRmf,\r\n      soc2_control: soc2Control,\r\n      iso27001: isoControl,\r\n    };\r\n\r\n    // Use 64KB metadata limit for AI events\r\n    return this.client.log(\r\n      {\r\n        actor,\r\n        actorId,\r\n        target,\r\n        targetId,\r\n        tenant,\r\n        tenantId,\r\n        action,\r\n        metadata: enrichedMetadata,\r\n        context,\r\n        telemetry,\r\n        req,\r\n        traceId,\r\n        spanId,\r\n        parentSpanId,\r\n      },\r\n      65536\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Logs a tool call or external API invocation by an agent.\r\n   * Maps to EU AI Act Article 12, NIST AI RMF MANAGE 2.2, SOC2 CC6.6, ISO 27001 A.12.4.1.\r\n   */\r\n  async toolCall(payload: Omit<LogPayload, \"action\"> & {\r\n    toolName: string;\r\n    toolInput?: Record<string, any>;\r\n    toolOutput?: Record<string, any>;\r\n    latencyMs?: number;\r\n    success: boolean;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.tool_call\", \"Article 12\", \"MANAGE 2.2\", \"CC6.6\", \"A.12.4.1\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs a key decision made autonomously by an AI agent model.\r\n   * Maps to EU AI Act Article 12 & 13, NIST AI RMF GOVERN 1.7, SOC2 CC6.2, ISO 27001 A.18.1.3.\r\n   */\r\n  async decision(payload: Omit<LogPayload, \"action\"> & {\r\n    decision: string;\r\n    alternatives?: string[];\r\n    rationale?: string;\r\n    confidenceScore?: number;\r\n    modelId?: string;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.decision\", \"Article 12 & 13\", \"GOVERN 1.7\", \"CC6.2\", \"A.18.1.3\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs a request for human review or permission escalation.\r\n   * Maps to EU AI Act Article 14, NIST AI RMF GOVERN 5.1, SOC2 CC6.3, ISO 27001 A.6.1.2.\r\n   */\r\n  async escalation(payload: Omit<LogPayload, \"action\"> & {\r\n    reason: string;\r\n    urgency?: \"low\" | \"medium\" | \"high\";\r\n    blockedAction?: string;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.escalation\", \"Article 14\", \"GOVERN 5.1\", \"CC6.3\", \"A.6.1.2\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs anomalous environment inputs, potential prompt injections, or policy violations.\r\n   * Maps to EU AI Act Article 9, NIST AI RMF MANAGE 2.4, SOC2 CC7.2, ISO 27001 A.16.1.2.\r\n   */\r\n  async anomaly(payload: Omit<LogPayload, \"action\"> & {\r\n    description: string;\r\n    severity?: \"low\" | \"medium\" | \"high\" | \"critical\";\r\n    anomalyType?: \"prompt_injection\" | \"unexpected_input\" | \"policy_violation\" | \"other\";\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.anomaly\", \"Article 9\", \"MANAGE 2.4\", \"CC7.2\", \"A.16.1.2\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs a model refusal to execute a user prompt or command due to alignment safety.\r\n   * Maps to EU AI Act Article 5, NIST AI RMF GOVERN 1.1, SOC2 CC6.8, ISO 27001 A.18.1.3.\r\n   */\r\n  async refusal(payload: Omit<LogPayload, \"action\"> & {\r\n    refusedInstruction: string;\r\n    reason: string;\r\n    policyViolated?: string;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.refusal\", \"Article 5\", \"GOVERN 1.1\", \"CC6.8\", \"A.18.1.3\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs an execution context handoff from one agent to another.\r\n   * Maps to EU AI Act Article 12, NIST AI RMF MAP 1.6, SOC2 CC6.6, ISO 27001 A.12.4.1.\r\n   */\r\n  async handoff(payload: Omit<LogPayload, \"action\"> & {\r\n    toAgentId: string;\r\n    instruction: string;\r\n    agentContext?: Record<string, any>;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.handoff\", \"Article 12\", \"MAP 1.6\", \"CC6.6\", \"A.12.4.1\", payload);\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC+HO,IAAM,kBAAN,MAAM,iBAAgB;AAAA,EAuB3B,YAAY,QAsBT;AACD,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,OAAO,YAAY;AACnC,SAAK,YAAY,OAAO;AACxB,SAAK,eAAe,OAAO;AAC3B,SAAK,aAAa,OAAO,cAAc,CAAC;AACxC,SAAK,gBAAgB,OAAO,iBAAiB,CAAC;AAC9C,SAAK,kBAAkB,OAAO,mBAAmB;AAGjD,QAAI,OAAO,WAAW,OAAO,uBAAuB;AAClD,WAAK,UAAU,OAAO;AACtB,WAAK,cAAc,OAAO;AAAA,IAC5B,WAAW,OAAO,eAAe;AAC/B,WAAK,cAAc;AACnB,WAAK,UAAU,EAAE,MAAM,OAAO,cAAc;AAAA,IAC9C,OAAO;AACL,YAAM,IAAI,MAAM,8GAA8G;AAAA,IAChI;AAGA,QAAI,OAAO,KAAK,KAAK,OAAO,EAAE,SAAS,GAAG;AACxC,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AAEA,QAAI,CAAC,KAAK,QAAQ,KAAK,WAAW,GAAG;AACnC,YAAM,IAAI,MAAM,kBAAkB,KAAK,WAAW,8BAA8B;AAAA,IAClF;AAGA,SAAK,gBAAgB,CAAC;AAGtB,SAAK,kBAAkB,iBAAgB,uBAAuB,OAAO,aAAa,EAAE,QAAQ,WAAW,CAAC;AACxG,SAAK,aAAa,IAAI,oBAAoB,IAAI;AAC9C,SAAK,QAAQ,IAAI,eAAe,IAAI;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,eAAe,KAA4B;AAChD,UAAM,YAAY,CAAC,SAAyB;AAC1C,UAAI,CAAC,IAAK,QAAO;AAEjB,UAAI,OAAO,IAAI,SAAS,QAAQ,YAAY;AAC1C,eAAO,IAAI,QAAQ,IAAI,IAAI,KAAK;AAAA,MAClC;AAEA,UAAI,IAAI,WAAW,OAAO,IAAI,YAAY,UAAU;AAClD,eAAO,IAAI,QAAQ,IAAI,KAAK,IAAI,QAAQ,KAAK,YAAY,CAAC,KAAK;AAAA,MACjE;AACA,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,UAAU,kBAAkB,KACxC,UAAU,WAAW,KACrB,UAAU,iBAAiB;AAE7B,UAAM,KAAK,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,IAAK,KAAK,QAAQ,iBAAiB;AAC/E,UAAM,YAAY,UAAU,YAAY;AAExC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,UAAU;AAAA,QACR,SAAS,UAAU,cAAc,KAAK,UAAU,qBAAqB,KAAK;AAAA,QAC1E,QAAQ,UAAU,gBAAgB,KAAK,UAAU,4BAA4B,KAAK;AAAA,QAClF,MAAM,UAAU,WAAW,KAAK,UAAU,kBAAkB,KAAK;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,oBAAoB,KAAiD;AAC1E,QAAI,CAAC,IAAK,QAAO,CAAC;AAClB,UAAM,YAAY,CAAC,SAAyB;AAC1C,UAAI,OAAO,IAAI,SAAS,QAAQ,YAAY;AAC1C,eAAO,IAAI,QAAQ,IAAI,IAAI,KAAK;AAAA,MAClC;AACA,UAAI,IAAI,WAAW,OAAO,IAAI,YAAY,UAAU;AAClD,eAAO,IAAI,QAAQ,IAAI,KAAK,IAAI,QAAQ,KAAK,YAAY,CAAC,KAAK;AAAA,MACjE;AACA,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,UAAU,aAAa;AAC3C,QAAI,CAAC,YAAa,QAAO,CAAC;AAC1B,UAAM,QAAQ,YAAY,MAAM,GAAG;AACnC,QAAI,MAAM,WAAW,EAAG,QAAO,CAAC;AAChC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,QAAQ,MAAM,CAAC,EAAE;AAAA,EAC/C;AAAA,EAEA,OAAe,uBAAuB,QAAoE;AACxG,UAAM,SAAS,OAAO,UAAU;AAEhC,QAAI,KAAqC;AACzC,QAAI,YAAwC;AAC5C,QAAI,WAAW;AAEf,QAAI,WAAW,UAAU;AACvB,WAAK;AACL,kBAAY;AACZ,iBAAW;AAAA,IACb,WAAW,WAAW,QAAQ;AAC5B,WAAK;AACL,kBAAY;AACZ,iBAAW;AAAA,IACb;AAEA,QAAI,OAAO,OAAO,OAAW,MAAK,OAAO;AACzC,QAAI,OAAO,cAAc,OAAW,aAAY,OAAO;AACvD,QAAI,OAAO,aAAa,OAAW,YAAW,OAAO;AAErD,WAAO,EAAE,IAAI,WAAW,SAAS;AAAA,EACnC;AAAA,EAEQ,eAAe,IAAY;AACjC,QAAI,UAAU;AACd,QAAI,KAAK;AACT,QAAI,OAAO;AAEX,QAAI,2BAA2B,KAAK,EAAE,GAAG;AACvC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,IAAI;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,UAAU,KAAK,EAAE,GAAG;AACtB,aAAO;AAAA,IACT,WAAW,eAAe,KAAK,EAAE,GAAG;AAClC,aAAO;AAAA,IACT,WAAW,cAAc,KAAK,EAAE,GAAG;AACjC,aAAO;AAAA,IACT;AAGA,QAAI,gBAAgB,KAAK,EAAE,KAAK,CAAC,YAAY,KAAK,EAAE,KAAK,CAAC,OAAO,KAAK,EAAE,GAAG;AACzE,YAAM,QAAQ,GAAG,MAAM,+BAA+B;AACtD,gBAAU,UAAU,QAAQ,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK;AAAA,IACjE,WAAW,UAAU,KAAK,EAAE,KAAK,CAAC,gBAAgB,KAAK,EAAE,KAAK,CAAC,WAAW,KAAK,EAAE,GAAG;AAClF,gBAAU,UAAU,KAAK,EAAE,IAAI,kBAAkB;AAAA,IACnD,WAAW,iBAAiB,KAAK,EAAE,GAAG;AACpC,gBAAU;AAAA,IACZ,WAAW,YAAY,KAAK,EAAE,GAAG;AAC/B,gBAAU;AAAA,IACZ;AAGA,QAAI,WAAW,KAAK,EAAE,GAAG;AACvB,WAAK;AAAA,IACP,WAAW,sBAAsB,KAAK,EAAE,GAAG;AACzC,WAAK;AAAA,IACP,WAAW,oBAAoB,KAAK,EAAE,GAAG;AACvC,WAAK;AAAA,IACP,WAAW,WAAW,KAAK,EAAE,GAAG;AAC9B,WAAK;AAAA,IACP,WAAW,SAAS,KAAK,EAAE,GAAG;AAC5B,WAAK;AAAA,IACP;AAEA,WAAO,EAAE,SAAS,IAAI,KAAK;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAc,IAAiC;AAC3D,QAAI,KAAK,cAAc,EAAE,EAAG,QAAO,KAAK,cAAc,EAAE;AACxD,UAAM,SAAS,KAAK,QAAQ,EAAE;AAC9B,UAAM,MAAM,IAAI,YAAY,EAAE,OAAO,MAAM;AAC3C,UAAM,OAAO,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,GAAG;AACjE,SAAK,cAAc,EAAE,IAAI,IAAI,WAAW,IAAI;AAC5C,WAAO,KAAK,cAAc,EAAE;AAAA,EAC9B;AAAA,EAEA,MAAc,mBAAmB,OAAe,WAAwC;AACtF,UAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,MACzC;AAAA,MAAO;AAAA,MAAsC,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAAG;AAAA,MAAO,CAAC,MAAM;AAAA,IAChG;AACA,UAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,MAC/C;AAAA,MAAQ;AAAA,MAAK,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IAC7C;AACA,WAAO,MAAM,KAAK,IAAI,WAAW,SAAS,CAAC,EACxC,IAAI,OAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,EAAE;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eAAe,SAAkC;AAC7D,UAAM,OAAO,KAAK,UAAU,OAAO;AACnC,UAAM,KAAK,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC/D,UAAM,kBAAkB,MAAM,KAAK,cAAc,KAAK,WAAW;AAEjE,UAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,MAC/C;AAAA,MAAO;AAAA,MAA4C,EAAE,MAAM,UAAU;AAAA,MAAG;AAAA,MAAO,CAAC,SAAS;AAAA,IAC3F;AAEA,UAAM,kBAAkB,MAAM,WAAW,OAAO,OAAO;AAAA,MACrD,EAAE,MAAM,WAAW,GAAG;AAAA,MAAG;AAAA,MAAW,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,IACnE;AAEA,UAAM,cAAc,IAAI,WAAW,GAAG,SAAS,gBAAgB,UAAU;AACzE,gBAAY,IAAI,IAAI,CAAC;AACrB,gBAAY,IAAI,IAAI,WAAW,eAAe,GAAG,GAAG,MAAM;AAG1D,QAAI,SAAS;AACb,UAAM,MAAM,YAAY;AACxB,aAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,gBAAU,OAAO,aAAa,YAAY,CAAC,CAAC;AAAA,IAC9C;AACA,UAAM,SAAS,KAAK,MAAM;AAC1B,WAAO,GAAG,KAAK,WAAW,IAAI,MAAM;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gBAAgB,SAAqB,iBAA0B;AAC3E,UAAM,WAAW,QAAQ,SAAS,QAAQ,WAAW;AACrD,UAAM,YAAY,QAAQ,UAAU,QAAQ,YAAY;AACxD,UAAM,YAAY,QAAQ,UAAU,QAAQ,YAAY;AAExD,UAAM,WAAW,CAAC,KAAa,WAA2B;AACxD,UAAI,IAAI,SAAS,QAAQ;AACvB,eAAO,IAAI,MAAM,GAAG,MAAM,IAAI;AAAA,MAChC;AACA,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,CAAC,MAClB,OAAO,MAAM,WAAW,EAAE,MAAM;AAClC,UAAM,YAAY,CAAC,MACjB,OAAO,MAAM,WAAW,EAAE,KAAK;AAEjC,UAAM,QAAQ,SAAS,WAAW,QAAQ,GAAG,GAAG;AAChD,UAAM,SAAS,SAAS,WAAW,SAAS,GAAG,GAAG;AAClD,UAAM,SAAS,YAAY,SAAS,WAAW,SAAS,GAAG,GAAG,IAAI;AAClE,UAAM,SAAS,SAAS,QAAQ,QAAQ,GAAG;AAE3C,UAAM,eAAe,QAAQ,YACzB,iBAAgB,uBAAuB,EAAE,GAAG,KAAK,iBAAiB,GAAG,QAAQ,UAAU,CAAC,IACxF,KAAK;AAET,QAAI,aAAa,QAAQ,WAAW,CAAC;AACrC,QAAI,QAAQ,KAAK;AACf,YAAM,YAAY,iBAAgB,eAAe,QAAQ,GAAG;AAC5D,mBAAa;AAAA,QACX,GAAG;AAAA,QACH,GAAG;AAAA,QACH,UAAU;AAAA,UACR,GAAG,UAAU;AAAA,UACb,GAAG,WAAW;AAAA,QAChB;AAAA,QACA,QAAQ;AAAA,UACN,GAAG,UAAU;AAAA,UACb,GAAG,WAAW;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAA4B,CAAC;AACnC,UAAM,QAAQ,WAAW,MAAM;AAC/B,UAAM,QAAQ,WAAW,aAAa;AAEtC,QAAI,aAAa,UAAU;AACzB,cAAQ,WAAW,CAAC;AACpB,UAAI,WAAW,UAAU;AACvB,gBAAQ,SAAS,UAAU,WAAW,SAAS,WAAW;AAC1D,gBAAQ,SAAS,SAAS,WAAW,SAAS,UAAU;AACxD,cAAM,SAAS,QAAQ,WAAW,WAAW,UAAW,CAAC,QAAQ,aAAa,KAAK,gBAAgB,OAAO;AAC1G,YAAI,aAAa,OAAO,WAAW,QAAQ;AACzC,kBAAQ,SAAS,OAAO,WAAW,SAAS,QAAQ;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,OAAO,eAAe,OAAO;AAC5C,cAAQ,KAAK,MAAM,KAAK,mBAAmB,OAAO,MAAM,KAAK,cAAc,KAAK,WAAW,CAAC;AAAA,IAC9F,WAAW,aAAa,OAAO,WAAW,OAAO;AAC/C,cAAQ,KAAK;AAAA,IACf;AAEA,QAAI,aAAa,cAAc,QAAQ;AACrC,UAAI,OAAO;AACT,gBAAQ,SAAS,KAAK,eAAe,KAAK;AAC1C,YAAI,aAAa,cAAc,SAAS;AACtC,kBAAQ,YAAY,SAAS,OAAO,GAAI;AAAA,QAC1C;AAAA,MACF,WAAW,WAAW,QAAQ;AAC5B,gBAAQ,SAAS,WAAW;AAAA,MAC9B;AAAA,IACF;AAEA,UAAM,QAAQ,CAAC,OAAe,QAC5B,KAAK,WAAW,SAAS,GAAG,IAAI,aAAa,GAAG,MAAM;AAExD,UAAM,WAAW,CAAC,UAAqC,QAAwB;AAC7E,UAAI,KAAK,cAAc,SAAS,GAAG,GAAG;AACpC,cAAM,KAAK,UAAU,QAAQ;AAC7B,eAAO,QAAQ,EAAE;AAAA,MACnB;AACA,aAAO,MAAM,WAAW,QAAQ,GAAG,GAAG;AAAA,IACxC;AAEA,UAAM,cAAc,QAAQ,YAAY,CAAC;AACzC,UAAM,eAAoC,CAAC;AAC3C,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,WAAW,GAAG;AAChD,YAAM,UAAU,YAAY,CAAC;AAC7B,UAAI,KAAK,cAAc,SAAS,OAAO,KAAK,OAAO,MAAM,YAAY,MAAM,QAAQ,QAAQ,GAAG;AAC5F,qBAAa,CAAC,IAAI,QAAS,EAAuB,EAAE;AAAA,MACtD,WAAW,KAAK,WAAW,SAAS,OAAO,KAAK,OAAO,MAAM,UAAU;AACrE,qBAAa,CAAC,IAAI,aAAa,CAAC;AAAA,MAClC,OAAO;AACL,qBAAa,CAAC,IAAI;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,aAAa,CAAC,KAAU,eAAe,MAAW;AACtD,UAAI,eAAe,GAAG;AACpB,eAAO;AAAA,MACT;AACA,UAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,YAAI,OAAO,QAAQ,UAAU;AAC3B,iBAAO,SAAS,KAAK,GAAI;AAAA,QAC3B;AACA,eAAO;AAAA,MACT;AACA,UAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,eAAO,IAAI,IAAI,UAAQ,WAAW,MAAM,eAAe,CAAC,CAAC;AAAA,MAC3D;AACA,YAAM,SAA8B,CAAC;AACrC,iBAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC5C,eAAO,GAAG,IAAI,WAAW,KAAK,eAAe,CAAC;AAAA,MAChD;AACA,aAAO;AAAA,IACT;AAEA,UAAM,oBAAoB,WAAW,YAAY;AACjD,UAAM,iBAAiB,KAAK,UAAU,iBAAiB;AACvD,UAAM,eAAe,mBAAmB,KAAK;AAC7C,QAAI,eAAe,SAAS,cAAc;AACxC,YAAM,IAAI,MAAM,kDAAkD,eAAe,IAAI,KAAK;AAAA,IAC5F;AAEA,UAAM,YAAY,SAAS,UAAU,OAAO;AAC5C,UAAM,aAAa,SAAS,WAAW,QAAQ;AAC/C,UAAM,aAAa,YAAY,SAAS,WAAW,QAAQ,IAAI;AAE/D,UAAM,kBAAuB;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA,QAAQ;AAAA,MACR,UAAU;AAAA,IACZ;AAEA,QAAI,YAAY;AACd,sBAAgB,SAAS;AAAA,IAC3B;AAEA,QAAI,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG;AACnC,sBAAgB,UAAU;AAAA,IAC5B;AAGA,QAAI,UAAU,QAAQ;AACtB,QAAI,SAAS,QAAQ;AACrB,QAAI,eAAe,QAAQ;AAE3B,QAAI,QAAQ,KAAK;AACf,YAAM,iBAAiB,iBAAgB,oBAAoB,QAAQ,GAAG;AACtE,UAAI,CAAC,WAAW,eAAe,SAAS;AACtC,kBAAU,eAAe;AAAA,MAC3B;AACA,UAAI,CAAC,UAAU,eAAe,QAAQ;AACpC,iBAAS,eAAe;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,QAAQ;AACV,sBAAgB,SAAS;AAAA,IAC3B;AACA,QAAI,cAAc;AAChB,sBAAgB,eAAe;AAAA,IACjC;AAEA,UAAM,kBAAkB,MAAM,KAAK,cAAc,KAAK,WAAW;AACjE,UAAM,kBAAkB,MAAM,KAAK,mBAAmB,OAAO,eAAe;AAC5E,UAAM,mBAAmB,MAAM,KAAK,mBAAmB,QAAQ,eAAe;AAC9E,UAAM,mBAAmB,MAAM,KAAK,mBAAmB,QAAQ,eAAe;AAC9E,UAAM,mBAAmB,SAAS,MAAM,KAAK,mBAAmB,QAAQ,eAAe,IAAI;AAC3F,UAAM,kBAAkB,UAAU,MAAM,KAAK,mBAAmB,SAAS,eAAe,IAAI;AAE5F,UAAM,mBAAmB,MAAM,KAAK,eAAe,eAAe;AAElE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,SAAqB,iBAA4C;AACzE,UAAM,QAAQ,MAAM,KAAK,gBAAgB,SAAS,eAAe;AACjE,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,KAAK,QAAQ,WAAW;AAAA,QACjD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,MAAM;AAAA,UACpC,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,KAAK;AAAA,MAC5B,CAAC;AAED,aAAO,IAAI;AAAA,IACb,SAAS,KAAU;AACjB,cAAQ,MAAM,mCAAmC,IAAI,OAAO,EAAE;AAC9D,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,UAAwB,iBAA2E;AAChH,QAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,GAAG;AACrD,aAAO,EAAE,UAAU,GAAG,UAAU,EAAE;AAAA,IACpC;AAGA,UAAM,QAAQ,SAAS,MAAM,GAAG,GAAG;AACnC,UAAM,kBAAyB,CAAC;AAChC,QAAI,WAAW,SAAS,SAAS,MAAM;AAEvC,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,MAAM,IAAI,OAAK,KAAK,gBAAgB,GAAG,eAAe,CAAC;AAAA,IACzD;AAEA,eAAW,OAAO,SAAS;AACzB,UAAI,IAAI,WAAW,aAAa;AAC9B,wBAAgB,KAAK,IAAI,KAAK;AAAA,MAChC,OAAO;AACL;AACA,gBAAQ,MAAM,8CAA8C,IAAI,QAAQ,OAAO,EAAE;AAAA,MACnF;AAAA,IACF;AAEA,QAAI,gBAAgB,WAAW,GAAG;AAChC,aAAO,EAAE,UAAU,GAAG,SAAS;AAAA,IACjC;AAEA,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,KAAK,QAAQ,kBAAkB;AAAA,QACxD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,MAAM;AAAA,UACpC,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAAA,MAChD,CAAC;AAED,UAAI,IAAI,IAAI;AACV,eAAO,EAAE,UAAU,gBAAgB,QAAQ,SAAS;AAAA,MACtD,OAAO;AACL,gBAAQ,MAAM,yDAAyD,IAAI,MAAM,EAAE;AACnF,eAAO,EAAE,UAAU,GAAG,UAAU,WAAW,gBAAgB,OAAO;AAAA,MACpE;AAAA,IACF,SAAS,KAAU;AACjB,cAAQ,MAAM,yCAAyC,IAAI,OAAO,EAAE;AACpE,aAAO,EAAE,UAAU,GAAG,UAAU,WAAW,gBAAgB,OAAO;AAAA,IACpE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAAqD;AAC5E,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,eAAe;AAAA,MACf;AAAA,MACA;AAAA,IACF,IAAI;AAGJ,UAAM,eAAe,UAAU,WAAW,WAAW;AAGrD,QAAI,iBAAiB,aAAa,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU;AACpE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,UAAM,oBAAoB,UACtB,MAAM,QAAQ,IAAI,OAAO,KAAK,KAAK,OAAO,EAAE,IAAI,OAAM,OAAM,KAAK,mBAAmB,SAAS,MAAM,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,IAC3H;AACJ,UAAM,qBAAqB,WACvB,MAAM,QAAQ,IAAI,OAAO,KAAK,KAAK,OAAO,EAAE,IAAI,OAAM,OAAM,KAAK,mBAAmB,UAAU,MAAM,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,IAC5H;AACJ,UAAM,qBAAqB,WACvB,MAAM,QAAQ,IAAI,OAAO,KAAK,KAAK,OAAO,EAAE,IAAI,OAAM,OAAM,KAAK,mBAAmB,UAAU,MAAM,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,IAC5H;AAGJ,UAAM,eAAe,KAAK,YAAY,SAAS;AAC/C,UAAM,YAAY,iBAAiB,YAAY,SAAS;AACxD,UAAM,mBAAmB,KAAK,IAAI,cAAc,SAAS;AACzD,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,UAAM,UAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,OAAO;AAAA,MACP,KAAK;AAAA,MACL,KAAK,MAAM;AAAA,IACb;AAEA,QAAI,kBAAmB,SAAQ,MAAM;AACrC,QAAI,mBAAoB,SAAQ,MAAM;AACtC,QAAI,mBAAoB,SAAQ,MAAM;AAGtC,QAAI,MAAM;AACR,YAAM,aAAkC,CAAC;AACzC,UAAI,MAAM,QAAQ,KAAK,OAAO,GAAG;AAC/B,mBAAW,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ;AAC1C,cAAI,QAAQ,YAAa,QAAO;AAChC,cAAI,QAAQ,QAAS,QAAO;AAC5B,cAAI,QAAQ,SAAU,QAAO;AAC7B,cAAI,QAAQ,SAAU,QAAO;AAC7B,cAAI,IAAI,WAAW,WAAW,GAAG;AAC/B,mBAAO,KAAK,IAAI,MAAM,CAAC,CAAC;AAAA,UAC1B;AACA,iBAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA,UAAI,KAAK,eAAe;AACtB,mBAAW,MAAM,CAAC;AAClB,YAAI,KAAK,cAAc,WAAW,QAAW;AAC3C,qBAAW,IAAI,IAAI,KAAK,cAAc;AAAA,QACxC;AACA,YAAI,KAAK,cAAc,WAAW,QAAW;AAC3C,qBAAW,IAAI,MAAM,KAAK,cAAc;AAAA,QAC1C;AAAA,MACF;AACA,cAAQ,OAAO;AAAA,IACjB;AAGA,UAAM,QAAQ,MAAM,KAAK,aAAa,SAAS,KAAK,YAAY;AAGhE,UAAM,gBAAgB,OAAO,QAAQ,KAAK,OAAO,EAC9C,IAAI,CAAC,CAAC,IAAI,GAAG,MAAM,GAAG,EAAE,IAAI,GAAG,EAAE,EACjC,KAAK,GAAG;AACX,UAAM,YAAY,aACd,SAAS,mBAAmB,UAAU,CAAC,KACvC;AACJ,UAAM,WAAW,GAAG,YAAY,UAAU,KAAK,GAAG,SAAS,IAAI,aAAa;AAE5E,WAAO,EAAE,OAAO,SAAS;AAAA,EAC3B;AAAA,EAEA,MAAc,aAAa,SAAiB,QAAiC;AAC3E,UAAM,SAAS,EAAE,KAAK,SAAS,KAAK,MAAM;AAE1C,UAAM,SAAS,CAAC,QACd,KAAK,KAAK,UAAU,GAAG,CAAC,EACrB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AAErB,UAAM,WAAW,GAAG,OAAO,MAAM,CAAC,IAAI,OAAO,OAAO,CAAC;AAErD,UAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,MACzC;AAAA,MAAO,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,MAA8B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAAG;AAAA,MAAO,CAAC,MAAM;AAAA,IACvH;AACA,UAAM,kBAAkB,MAAM,WAAW,OAAO,OAAO;AAAA,MACrD;AAAA,MAAQ;AAAA,MAAK,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,IAChD;AAEA,QAAI,SAAS;AACb,UAAM,MAAM,IAAI,WAAW,eAAe;AAC1C,aAAS,IAAI,GAAG,IAAI,IAAI,YAAY,KAAK;AACvC,gBAAU,OAAO,aAAa,IAAI,CAAC,CAAC;AAAA,IACtC;AACA,UAAM,YAAY,KAAK,MAAM,EAC1B,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AAEnB,WAAO,GAAG,QAAQ,IAAI,SAAS;AAAA,EACjC;AAAA,EAEQ,YAAY,QAAwB;AAC1C,UAAM,QAAQ,OAAO,MAAM,kBAAkB;AAC7C,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,CAAC,EAAE,KAAK,IAAI,IAAI;AACtB,UAAM,IAAI,SAAS,KAAK,EAAE;AAC1B,YAAQ,MAAM;AAAA,MACZ,KAAK;AAAK,eAAO;AAAA,MACjB,KAAK;AAAK,eAAO,IAAI;AAAA,MACrB,KAAK;AAAK,eAAO,IAAI;AAAA,MACrB,KAAK;AAAK,eAAO,IAAI;AAAA,MACrB;AAAS,eAAO;AAAA,IAClB;AAAA,EACF;AACF;AAKO,IAAM,sBAAN,MAA0B;AAAA,EAG/B,YAAY,QAAyB;AACnC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAc,eACZ,QACA,aACA,YACA,SACkB;AAClB,UAAM,WAAW;AAAA,MACf,GAAG,QAAQ;AAAA,MACX,cAAc;AAAA,MACd,UAAU;AAAA,IACZ;AACA,WAAO,KAAK,OAAO,IAAI;AAAA,MACrB,GAAG;AAAA,MACH;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cAAc,SAAuD;AACzE,WAAO,KAAK,eAAe,kBAAkB,SAAS,WAAW,OAAO;AAAA,EAC1E;AAAA,EAEA,MAAM,cAAc,SAAuD;AACzE,WAAO,KAAK,eAAe,kBAAkB,SAAS,WAAW,OAAO;AAAA,EAC1E;AAAA,EAEA,MAAM,aAAa,SAAuD;AACxE,WAAO,KAAK,eAAe,iBAAiB,SAAS,YAAY,OAAO;AAAA,EAC1E;AAAA,EAEA,MAAM,oBAAoB,SAAuD;AAC/E,WAAO,KAAK,eAAe,yBAAyB,SAAS,YAAY,OAAO;AAAA,EAClF;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,WAAO,KAAK,eAAe,eAAe,SAAS,WAAW,OAAO;AAAA,EACvE;AACF;AAKO,IAAM,iBAAN,MAAqB;AAAA,EAG1B,YAAY,QAAyB;AACnC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAc,SACZ,QACA,SACA,WACA,aACA,YACA,SACkB;AAClB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG;AAAA,IACL,IAAI;AAEJ,UAAM,mBAAmB;AAAA,MACvB,GAAG;AAAA,MACH,GAAG;AAAA,MACH,WAAW;AAAA,MACX,aAAa;AAAA,MACb,cAAc;AAAA,MACd,UAAU;AAAA,IACZ;AAGA,WAAO,KAAK,OAAO;AAAA,MACjB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,SAMM;AACnB,WAAO,KAAK,SAAS,mBAAmB,cAAc,cAAc,SAAS,YAAY,OAAO;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,SAMM;AACnB,WAAO,KAAK,SAAS,kBAAkB,mBAAmB,cAAc,SAAS,YAAY,OAAO;AAAA,EACtG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,SAII;AACnB,WAAO,KAAK,SAAS,oBAAoB,cAAc,cAAc,SAAS,WAAW,OAAO;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,SAIO;AACnB,WAAO,KAAK,SAAS,iBAAiB,aAAa,cAAc,SAAS,YAAY,OAAO;AAAA,EAC/F;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,SAIO;AACnB,WAAO,KAAK,SAAS,iBAAiB,aAAa,cAAc,SAAS,YAAY,OAAO;AAAA,EAC/F;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,SAIO;AACnB,WAAO,KAAK,SAAS,iBAAiB,cAAc,WAAW,SAAS,YAAY,OAAO;AAAA,EAC7F;AACF;;;AD79BO,SAAS,cAAkC,QAAyB,SAAY;AACrF,SAAO,OAAO,KAAc,MAAW,CAAC,MAAM,SAAgB;AAC5D,UAAM,mBAAmB,gBAAgB,eAAe,GAAG;AAK3D,UAAM,YAAY,OAAO,YAAwB;AAC/C,aAAO,OAAO,IAAI;AAAA,QAChB,GAAG;AAAA,QACH,SAAS;AAAA,UACP,GAAG;AAAA,UACH,GAAG,QAAQ;AAAA,UACX,UAAU;AAAA,YACR,GAAG,iBAAiB;AAAA,YACpB,GAAI,QAAQ,SAAS,YAAY,CAAC;AAAA,UACpC;AAAA,UACA,QAAQ;AAAA,YACN,GAAG,iBAAiB;AAAA,YACpB,GAAI,QAAQ,SAAS,UAAU,CAAC;AAAA,UAClC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAUA,UAAM,cAAc,CAClB,QACA,aACA,YACA,YAEA,UAAU;AAAA,MACR,GAAG;AAAA,MACH;AAAA,MACA,UAAU;AAAA,QACR,GAAG,QAAQ;AAAA,QACX,cAAc;AAAA,QACd,UAAU;AAAA,MACZ;AAAA,IACF,CAAC;AAEH,UAAM,mBAAmB;AAAA,MACvB,eAAe,CAAC,MACd,YAAY,kBAAkB,SAAS,WAAW,CAAC;AAAA,MACrD,eAAe,CAAC,MACd,YAAY,kBAAkB,SAAS,WAAW,CAAC;AAAA,MACrD,cAAc,CAAC,MACb,YAAY,iBAAiB,SAAS,YAAY,CAAC;AAAA,MACrD,qBAAqB,CAAC,MACpB,YAAY,yBAAyB,SAAS,YAAY,CAAC;AAAA,MAC7D,YAAY,CAAC,MACX,YAAY,eAAe,SAAS,WAAW,CAAC;AAAA,IACpD;AAEA,UAAM,SAAS;AAAA,MACb,GAAG;AAAA,MACH,WAAW;AAAA,QACT,KAAK;AAAA,QACL,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO,QAAQ,KAAK,QAAQ,GAAG,IAAI;AAAA,EACrC;AACF;","names":[]}
+{"version":3,"sources":["../../src/middleware/next.ts","../../src/index.ts"],"sourcesContent":["import { VolidatorClient, LogPayload } from \"../index\";\n\n/**\n * Next.js App Router Middleware for Volidator.\n * Automatically extracts telemetry context (IP, User Agent, Location)\n * from the Next.js standard Request object and injects it into every\n * `volidator.log()` and `volidator.compliance.*()` call made inside\n * the wrapped handler.\n */\nexport function withVolidator<T extends Function>(\n  client: VolidatorClient,\n  handler: T\n): (req: Request, ctx?: any, ...args: any[]) => Promise<any> {\n  return async (req: Request, ctx: any = {}, ...args: any[]) => {\n    const extractedContext = VolidatorClient.extractContext(req);\n\n    // ---------------------------------------------------------------------------\n    // Scoped log — merges request-level IP/UA context into every log call.\n    // ---------------------------------------------------------------------------\n    const scopedLog = async (payload: LogPayload) => {\n      return client.log({\n        ...payload,\n        context: {\n          ...extractedContext,\n          ...payload.context,\n          location: {\n            ...extractedContext.location,\n            ...(payload.context?.location || {}),\n          },\n          device: {\n            ...extractedContext.device,\n            ...(payload.context?.device || {}),\n          },\n        },\n      });\n    };\n\n    // ---------------------------------------------------------------------------\n    // Scoped compliance — mirrors VolidatorCompliance but routes through\n    // scopedLog so that IP/UA telemetry is preserved in compliance events.\n    //\n    // Previously this passed client.compliance directly, which called\n    // client.log() without the request context — silently dropping telemetry\n    // from every compliance audit event.\n    // ---------------------------------------------------------------------------\n    const withControl = (\n      action: string,\n      soc2Control: string,\n      isoControl: string,\n      payload: Omit<LogPayload, \"action\">\n    ) =>\n      scopedLog({\n        ...payload,\n        action,\n        metadata: {\n          ...payload.metadata,\n          soc2_control: soc2Control,\n          iso27001: isoControl,\n        },\n      });\n\n    const scopedCompliance = {\n      accessRevoked: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"access.revoked\", \"CC6.1\", \"A.9.2.6\", p),\n      accessGranted: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"access.granted\", \"CC6.1\", \"A.9.2.1\", p),\n      dataExported: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"data.exported\", \"CC6.6\", \"A.12.4.1\", p),\n      systemConfigChanged: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"system.config_changed\", \"CC6.2\", \"A.12.1.2\", p),\n      mfaEnabled: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"mfa.enabled\", \"CC6.3\", \"A.9.4.2\", p),\n    };\n\n    const newCtx = {\n      ...ctx,\n      volidator: {\n        log: scopedLog,\n        compliance: scopedCompliance,\n      },\n    };\n\n    return handler(req, newCtx, ...args);\n  };\n}\n","// ---------------------------------------------------------------------------\r\n// Reference-Based Redaction Types\r\n// ---------------------------------------------------------------------------\r\n\r\n/**\r\n * A structured payload for fields listed in `referenceKeys`.\r\n * - `id`  — the non-sensitive internal identifier stored in Volidator as [REF:id].\r\n * - `pii` — the real value used ONLY to compute the blind index, then discarded.\r\n *\r\n * @example\r\n *   actor: { id: \"usr_890\", pii: \"john@company.com\" }\r\n *   // stored:      \"[REF:usr_890]\"\r\n *   // blind index: HMAC(\"john@company.com\")\r\n *   // telemetry:  extracted automatically or passed in context\r\n */\r\nexport type ReferencePayload = { id: string; pii: string };\r\n\r\n/**\r\n * Utility type that enforces { id, pii } shape on any LogPayload fields\r\n * whose key appears in the `referenceKeys` constructor option.\r\n * Gives a compile-time error if a developer passes a raw string instead.\r\n */\r\nexport type EnforceReference<TData, TRefKeys extends keyof TData> =\r\n  Omit<TData, TRefKeys> & { [K in TRefKeys]: ReferencePayload };\r\n\r\nexport interface TelemetryConfig {\r\n  preset?: \"strict\" | \"standard\" | \"full\";\r\n  ip?: \"track\" | \"anonymize\" | \"skip\";\r\n  userAgent?: \"track\" | \"parse\" | \"skip\";\r\n  location?: boolean;\r\n}\r\n\r\nexport interface TelemetryContext {\r\n  ip?: string;\r\n  userAgent?: string;\r\n  location?: {\r\n    country?: string;\r\n    region?: string;\r\n    city?: string;\r\n  };\r\n  device?: {\r\n    browser?: string;\r\n    os?: string;\r\n    type?: string;\r\n  };\r\n  [key: string]: any;\r\n}\r\n\r\nexport interface LogPayload {\r\n  /**\r\n   * The actor performing the action. Pass a plain string for normal logs.\r\n   * Pass a `ReferencePayload` when this field is listed in `referenceKeys`:\r\n   *   actor: { id: \"usr_890\", pii: \"john@company.com\" }\r\n   */\r\n  actor?: string | ReferencePayload;\r\n  actorId?: string; // support actorId as alias (plain string only)\r\n  action: string;\r\n  /**\r\n   * The target of the action. Pass a plain string for normal logs.\r\n   * Pass a `ReferencePayload` when this field is listed in `referenceKeys`.\r\n   */\r\n  target?: string | ReferencePayload;\r\n  targetId?: string; // support targetId as alias (plain string only)\r\n  /**\r\n   * The tenant or client identifier (e.g. B2B company name/ID).\r\n   * Pass a plain string for normal logs, or a `ReferencePayload`.\r\n   */\r\n  tenant?: string | ReferencePayload;\r\n  tenantId?: string; // support tenantId as alias (plain string only)\r\n  /**\r\n   * Groups all events belonging to a single agent run, workflow execution,\r\n   * or request trace. Passed through as a blind index so the server can\r\n   * filter by run without decrypting payloads.\r\n   */\r\n  traceId?: string;\r\n  /**\r\n   * Identifies this specific event within the trace (analogous to OTel spanId).\r\n   */\r\n  spanId?: string;\r\n  /**\r\n   * The spanId of the event that caused this one (parentSpanId).\r\n   */\r\n  parentSpanId?: string;\r\n  /**\r\n   * Arbitrary metadata. Values for keys listed in `referenceKeys` must be\r\n   * `ReferencePayload` objects: { id: \"ref_id\", pii: \"sensitive_value\" }.\r\n   */\r\n  metadata?: Record<string, any>;\r\n  context?: TelemetryContext;\r\n  telemetry?: TelemetryConfig;\r\n  req?: any; // support passing the HTTP request object directly\r\n}\r\n\r\ninterface EmbedTokenViewConfig {\r\n  /** The columns to show in the table, e.g. [\"actor\", \"action\", \"metadata.region\", \"createdAt\"] */\r\n  columns?: string[];\r\n  /** Default search filters loaded on mount */\r\n  defaultFilter?: {\r\n    search?: string;\r\n    action?: string;\r\n  };\r\n}\r\n\r\ninterface EmbedTokenConfig {\r\n  /** The plaintext actor identifier (e.g. \"usr_123\") */\r\n  actorId?: string;\r\n  /** The plaintext target identifier (e.g. \"usr_123\") */\r\n  targetId?: string;\r\n  /** The plaintext tenant identifier (e.g. \"johnsbakery\") */\r\n  tenantId?: string;\r\n  /** Scopes the logs to query. If not provided, defaults to 'actor' if actorId is provided, or 'tenant' if tenantId is provided. */\r\n  scope?: \"actor\" | \"target\" | \"tenant\" | \"all\" | \"auditor\";\r\n  /** Duration string: \"30m\", \"2h\", \"7d\". Defaults to \"2h\". */\r\n  expiresIn?: string;\r\n  /** Custom dashboard origin URL override */\r\n  dashboardUrl?: string;\r\n  /** Optional origin of host app for iframe postMessage domain validation */\r\n  hostOrigin?: string;\r\n  /** Custom column presentation and default filters */\r\n  view?: EmbedTokenViewConfig;\r\n}\r\n\r\ninterface EmbedTokenResult {\r\n  token: string;\r\n  embedUrl: string;\r\n}\r\n\r\nexport class VolidatorClient {\r\n  private apiKey: string;\r\n  private endpoint: string;\r\n  private telemetryConfig: Required<Omit<TelemetryConfig, \"preset\">>;\r\n\r\n  // Optional fields required only for generateEmbedToken()\r\n  private projectId?: string;\r\n  private clientSecret?: string;\r\n\r\n  private redactKeys: string[];\r\n  private referenceKeys: string[];\r\n\r\n  // Keyring properties\r\n  private activeKeyId: string;\r\n  private keyring: Record<string, string>;\r\n  private hashedKeyring: Record<string, Uint8Array>;\r\n  \r\n  // Custom limit for metadata object serialization size\r\n  private maxMetadataSize: number;\r\n\r\n  public compliance: VolidatorCompliance;\r\n  public agent: VolidatorAgent;\r\n\r\n  constructor(config: {\r\n    apiKey: string;\r\n    encryptionKey?: string;\r\n    activeEncryptionKeyId?: string;\r\n    keyring?: Record<string, string>;\r\n    endpoint?: string;\r\n    // Provide these when you need to generate embed tokens server-side\r\n    projectId?: string;\r\n    clientSecret?: string;\r\n    telemetry?: TelemetryConfig;\r\n    /**\r\n     * Fields to replace with [REDACTED:key] before encryption.\r\n     */\r\n    redactKeys?: string[];\r\n    /**\r\n     * Fields to replace with [REF:id] before encryption (JIT Hydration).\r\n     */\r\n    referenceKeys?: string[];\r\n    /**\r\n     * Custom maximum size for serialized metadata in bytes. Defaults to 10240 (10KB).\r\n     */\r\n    maxMetadataSize?: number;\r\n  }) {\r\n    this.apiKey = config.apiKey;\r\n    this.endpoint = config.endpoint || \"https://ingestion.volidator.com\";\r\n    this.projectId = config.projectId;\r\n    this.clientSecret = config.clientSecret;\r\n    this.redactKeys = config.redactKeys || [];\r\n    this.referenceKeys = config.referenceKeys || [];\r\n    this.maxMetadataSize = config.maxMetadataSize || 10240;\r\n\r\n    // Parse encryption keys & keyring\r\n    if (config.keyring && config.activeEncryptionKeyId) {\r\n      this.keyring = config.keyring;\r\n      this.activeKeyId = config.activeEncryptionKeyId;\r\n    } else if (config.encryptionKey) {\r\n      this.activeKeyId = \"v1\";\r\n      this.keyring = { \"v1\": config.encryptionKey };\r\n    } else {\r\n      throw new Error(\"Either encryptionKey OR (keyring AND activeEncryptionKeyId) must be provided in VolidatorClient constructor.\");\r\n    }\r\n\r\n    // Limit keyring size to 5 for performance & security\r\n    if (Object.keys(this.keyring).length > 5) {\r\n      throw new Error(\"Keyring size cannot exceed 5 keys.\");\r\n    }\r\n\r\n    if (!this.keyring[this.activeKeyId]) {\r\n      throw new Error(`Active key ID '${this.activeKeyId}' must exist in the keyring.`);\r\n    }\r\n\r\n    // Keys will be hashed lazily via WebCrypto in _getHashedKey\r\n    this.hashedKeyring = {};\r\n\r\n    // Default to 'standard' preset if nothing is provided\r\n    this.telemetryConfig = VolidatorClient.resolveTelemetryConfig(config.telemetry || { preset: \"standard\" });\r\n    this.compliance = new VolidatorCompliance(this);\r\n    this.agent = new VolidatorAgent(this);\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // Telemetry Context Parser (Zero-latency header parsing)\r\n  // ---------------------------------------------------------------------------\r\n  static extractContext(req: any): TelemetryContext {\r\n    const getHeader = (name: string): string => {\r\n      if (!req) return \"\";\r\n      // Handle standard Web API Request/Headers\r\n      if (typeof req.headers?.get === \"function\") {\r\n        return req.headers.get(name) || \"\";\r\n      }\r\n      // Handle Node.js IncomingMessage request headers\r\n      if (req.headers && typeof req.headers === \"object\") {\r\n        return req.headers[name] || req.headers[name.toLowerCase()] || \"\";\r\n      }\r\n      return \"\";\r\n    };\r\n\r\n    const rawIp = getHeader(\"cf-connecting-ip\") ||\r\n      getHeader(\"x-real-ip\") ||\r\n      getHeader(\"x-forwarded-for\");\r\n\r\n    const ip = rawIp ? rawIp.split(\",\")[0].trim() : (req?.socket?.remoteAddress || \"\");\r\n    const userAgent = getHeader(\"user-agent\");\r\n\r\n    return {\r\n      ip,\r\n      userAgent,\r\n      location: {\r\n        country: getHeader(\"cf-ipcountry\") || getHeader(\"x-vercel-ip-country\") || \"\",\r\n        region: getHeader(\"cf-region-code\") || getHeader(\"x-vercel-ip-country-region\") || \"\",\r\n        city: getHeader(\"cf-ipcity\") || getHeader(\"x-vercel-ip-city\") || \"\",\r\n      }\r\n    };\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // OpenTelemetry W3C traceparent context parser\r\n  // ---------------------------------------------------------------------------\r\n  static extractTraceContext(req: any): { traceId?: string; spanId?: string } {\r\n    if (!req) return {};\r\n    const getHeader = (name: string): string => {\r\n      if (typeof req.headers?.get === \"function\") {\r\n        return req.headers.get(name) || \"\";\r\n      }\r\n      if (req.headers && typeof req.headers === \"object\") {\r\n        return req.headers[name] || req.headers[name.toLowerCase()] || \"\";\r\n      }\r\n      return \"\";\r\n    };\r\n\r\n    const traceparent = getHeader(\"traceparent\");\r\n    if (!traceparent) return {};\r\n    const parts = traceparent.split(\"-\");\r\n    if (parts.length !== 4) return {};\r\n    return { traceId: parts[1], spanId: parts[2] };\r\n  }\r\n\r\n  private static resolveTelemetryConfig(config: TelemetryConfig): Required<Omit<TelemetryConfig, \"preset\">> {\r\n    const preset = config.preset || \"standard\";\r\n\r\n    let ip: \"track\" | \"anonymize\" | \"skip\" = \"anonymize\";\r\n    let userAgent: \"track\" | \"parse\" | \"skip\" = \"parse\";\r\n    let location = true;\r\n\r\n    if (preset === \"strict\") {\r\n      ip = \"skip\";\r\n      userAgent = \"skip\";\r\n      location = false;\r\n    } else if (preset === \"full\") {\r\n      ip = \"track\";\r\n      userAgent = \"track\";\r\n      location = true;\r\n    }\r\n\r\n    if (config.ip !== undefined) ip = config.ip;\r\n    if (config.userAgent !== undefined) userAgent = config.userAgent;\r\n    if (config.location !== undefined) location = config.location;\r\n\r\n    return { ip, userAgent, location };\r\n  }\r\n\r\n  private parseUserAgent(ua: string) {\r\n    let browser = \"Unknown Browser\";\r\n    let os = \"Unknown OS\";\r\n    let type = \"Desktop\";\r\n\r\n    if (/Volidator-Ingest-Worker/i.test(ua)) {\r\n      return {\r\n        browser: \"Volidator Ingest Worker\",\r\n        os: \"Linux Server\",\r\n        type: \"Server\"\r\n      };\r\n    }\r\n\r\n    // Simple Device Type detection\r\n    if (/mobile/i.test(ua)) {\r\n      type = \"Mobile\";\r\n    } else if (/tablet|ipad/i.test(ua)) {\r\n      type = \"Tablet\";\r\n    } else if (/server|bot/i.test(ua)) {\r\n      type = \"Server\";\r\n    }\r\n\r\n    // Simple Browser detection\r\n    if (/chrome|crios/i.test(ua) && !/edge|edg/i.test(ua) && !/opr/i.test(ua)) {\r\n      const match = ua.match(/(?:chrome|crios)\\/([0-9\\.]+)/i);\r\n      browser = `Chrome ${match ? match[1].split('.')[0] : \"\"}`.trim();\r\n    } else if (/safari/i.test(ua) && !/chrome|crios/i.test(ua) && !/android/i.test(ua)) {\r\n      browser = /mobile/i.test(ua) ? \"Safari Mobile\" : \"Safari\";\r\n    } else if (/firefox|fxios/i.test(ua)) {\r\n      browser = \"Firefox\";\r\n    } else if (/edge|edg/i.test(ua)) {\r\n      browser = \"Edge\";\r\n    }\r\n\r\n    // Simple OS detection\r\n    if (/windows/i.test(ua)) {\r\n      os = \"Windows\";\r\n    } else if (/macintosh|mac os x/i.test(ua)) {\r\n      os = \"macOS\";\r\n    } else if (/iphone|ipad|ipod/i.test(ua)) {\r\n      os = \"iOS\";\r\n    } else if (/android/i.test(ua)) {\r\n      os = \"Android\";\r\n    } else if (/linux/i.test(ua)) {\r\n      os = \"Linux\";\r\n    }\r\n\r\n    return { browser, os, type };\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // Blind Index & Key Hashing (WebCrypto)\r\n  // ---------------------------------------------------------------------------\r\n  private async _getHashedKey(id: string): Promise<Uint8Array> {\r\n    if (this.hashedKeyring[id]) return this.hashedKeyring[id];\r\n    const rawKey = this.keyring[id];\r\n    const buf = new TextEncoder().encode(rawKey);\r\n    const hash = await globalThis.crypto.subtle.digest(\"SHA-256\", buf);\r\n    this.hashedKeyring[id] = new Uint8Array(hash);\r\n    return this.hashedKeyring[id];\r\n  }\r\n\r\n  private async generateBlindIndex(value: string, keyBuffer: Uint8Array): Promise<string> {\r\n    const key = await globalThis.crypto.subtle.importKey(\r\n      \"raw\", keyBuffer as unknown as BufferSource, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]\r\n    );\r\n    const signature = await globalThis.crypto.subtle.sign(\r\n      \"HMAC\", key, new TextEncoder().encode(value)\r\n    );\r\n    return Array.from(new Uint8Array(signature))\r\n      .map(b => b.toString(16).padStart(2, \"0\"))\r\n      .join(\"\");\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // Payload Encryption — AES-256-GCM with prepended 12-byte IV\r\n  // Layout: [IV (12B)] [Ciphertext] [Auth Tag (16B)]\r\n  // ---------------------------------------------------------------------------\r\n  private async encryptPayload(payload: object): Promise<string> {\r\n    const text = JSON.stringify(payload);\r\n    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));\r\n    const activeHashedKey = await this._getHashedKey(this.activeKeyId);\r\n\r\n    const cryptoKey = await globalThis.crypto.subtle.importKey(\r\n      \"raw\", activeHashedKey as unknown as BufferSource, { name: \"AES-GCM\" }, false, [\"encrypt\"]\r\n    );\r\n\r\n    const encryptedBuffer = await globalThis.crypto.subtle.encrypt(\r\n      { name: \"AES-GCM\", iv }, cryptoKey, new TextEncoder().encode(text)\r\n    );\r\n\r\n    const finalBuffer = new Uint8Array(iv.length + encryptedBuffer.byteLength);\r\n    finalBuffer.set(iv, 0);\r\n    finalBuffer.set(new Uint8Array(encryptedBuffer), iv.length);\r\n\r\n    // Convert to base64 safely for edges\r\n    let binary = '';\r\n    const len = finalBuffer.byteLength;\r\n    for (let i = 0; i < len; i++) {\r\n      binary += String.fromCharCode(finalBuffer[i]);\r\n    }\r\n    const base64 = btoa(binary);\r\n    return `${this.activeKeyId}:${base64}`;\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // prepareLogEntry() — Prepares, redacts, and encrypts a single log entry payload\r\n  // ---------------------------------------------------------------------------\r\n  private async prepareLogEntry(payload: LogPayload, maxMetaOverride?: number) {\r\n    const actorRaw = payload.actor || payload.actorId || \"unknown\";\r\n    const targetRaw = payload.target || payload.targetId || \"unknown\";\r\n    const tenantRaw = payload.tenant || payload.tenantId || \"\";\r\n\r\n    const truncate = (str: string, maxLen: number): string => {\r\n      if (str.length > maxLen) {\r\n        return str.slice(0, maxLen) + \"...\";\r\n      }\r\n      return str;\r\n    };\r\n\r\n    const extractPii = (v: string | ReferencePayload): string =>\r\n      typeof v === \"object\" ? v.pii : v;\r\n    const extractId = (v: string | ReferencePayload): string =>\r\n      typeof v === \"object\" ? v.id : v;\r\n\r\n    const actor = truncate(extractPii(actorRaw), 255);\r\n    const target = truncate(extractPii(targetRaw), 255);\r\n    const tenant = tenantRaw ? truncate(extractPii(tenantRaw), 255) : \"\";\r\n    const action = truncate(payload.action, 255);\r\n\r\n    const logTelemetry = payload.telemetry\r\n      ? VolidatorClient.resolveTelemetryConfig({ ...this.telemetryConfig, ...payload.telemetry })\r\n      : this.telemetryConfig;\r\n\r\n    let payloadCtx = payload.context || {};\r\n    if (payload.req) {\r\n      const extracted = VolidatorClient.extractContext(payload.req);\r\n      payloadCtx = {\r\n        ...extracted,\r\n        ...payloadCtx,\r\n        location: {\r\n          ...extracted.location,\r\n          ...payloadCtx.location,\r\n        },\r\n        device: {\r\n          ...extracted.device,\r\n          ...payloadCtx.device,\r\n        },\r\n      };\r\n    }\r\n\r\n    const context: TelemetryContext = {};\r\n    const rawIp = payloadCtx.ip || \"\";\r\n    const rawUa = payloadCtx.userAgent || \"\";\r\n\r\n    if (logTelemetry.location) {\r\n      context.location = {};\r\n      if (payloadCtx.location) {\r\n        context.location.country = payloadCtx.location.country || \"\";\r\n        context.location.region = payloadCtx.location.region || \"\";\r\n        const isFull = payload.telemetry?.preset === \"full\" || (!payload.telemetry && this.telemetryConfig.ip === \"track\");\r\n        if (logTelemetry.ip === \"track\" || isFull) {\r\n          context.location.city = payloadCtx.location.city || \"\";\r\n        }\r\n      }\r\n    }\r\n\r\n    if (logTelemetry.ip === \"anonymize\" && rawIp) {\r\n      context.ip = await this.generateBlindIndex(rawIp, await this._getHashedKey(this.activeKeyId));\r\n    } else if (logTelemetry.ip === \"track\" && rawIp) {\r\n      context.ip = rawIp;\r\n    }\r\n\r\n    if (logTelemetry.userAgent !== \"skip\") {\r\n      if (rawUa) {\r\n        context.device = this.parseUserAgent(rawUa);\r\n        if (logTelemetry.userAgent === \"track\") {\r\n          context.userAgent = truncate(rawUa, 1000);\r\n        }\r\n      } else if (payloadCtx.device) {\r\n        context.device = payloadCtx.device;\r\n      }\r\n    }\r\n\r\n    const scrub = (value: string, key: string): string =>\r\n      this.redactKeys.includes(key) ? `[REDACTED:${key}]` : value;\r\n\r\n    const applyRef = (rawValue: string | ReferencePayload, key: string): string => {\r\n      if (this.referenceKeys.includes(key)) {\r\n        const id = extractId(rawValue);\r\n        return `[REF:${id}]`;\r\n      }\r\n      return scrub(extractPii(rawValue), key);\r\n    };\r\n\r\n    const rawMetadata = payload.metadata || {};\r\n    const safeMetadata: Record<string, any> = {};\r\n    for (const [k, v] of Object.entries(rawMetadata)) {\r\n      const metaKey = `metadata.${k}`;\r\n      if (this.referenceKeys.includes(metaKey) && typeof v === \"object\" && v !== null && \"id\" in v) {\r\n        safeMetadata[k] = `[REF:${(v as ReferencePayload).id}]`;\r\n      } else if (this.redactKeys.includes(metaKey) && typeof v === \"string\") {\r\n        safeMetadata[k] = `[REDACTED:${k}]`;\r\n      } else {\r\n        safeMetadata[k] = v;\r\n      }\r\n    }\r\n\r\n    const limitDepth = (obj: any, currentDepth = 1): any => {\r\n      if (currentDepth > 5) {\r\n        return \"[Truncated - Depth Exceeded]\";\r\n      }\r\n      if (typeof obj !== \"object\" || obj === null) {\r\n        if (typeof obj === \"string\") {\r\n          return truncate(obj, 1000);\r\n        }\r\n        return obj;\r\n      }\r\n      if (Array.isArray(obj)) {\r\n        return obj.map(item => limitDepth(item, currentDepth + 1));\r\n      }\r\n      const result: Record<string, any> = {};\r\n      for (const [key, val] of Object.entries(obj)) {\r\n        result[key] = limitDepth(val, currentDepth + 1);\r\n      }\r\n      return result;\r\n    };\r\n\r\n    const processedMetadata = limitDepth(safeMetadata);\r\n    const serializedMeta = JSON.stringify(processedMetadata);\r\n    const maxMetaLimit = maxMetaOverride || this.maxMetadataSize;\r\n    if (serializedMeta.length > maxMetaLimit) {\r\n      throw new Error(`Metadata size exceeds maximum allowed limit of ${maxMetaLimit / 1024}KB.`);\r\n    }\r\n\r\n    const safeActor = applyRef(actorRaw, \"actor\");\r\n    const safeTarget = applyRef(targetRaw, \"target\");\r\n    const safeTenant = tenantRaw ? applyRef(tenantRaw, \"tenant\") : undefined;\r\n\r\n    const enrichedPayload: any = {\r\n      actor: safeActor,\r\n      action,\r\n      target: safeTarget,\r\n      metadata: processedMetadata,\r\n    };\r\n\r\n    if (safeTenant) {\r\n      enrichedPayload.tenant = safeTenant;\r\n    }\r\n\r\n    if (Object.keys(context).length > 0) {\r\n      enrichedPayload.context = context;\r\n    }\r\n\r\n    // Auto-extract trace contexts\r\n    let traceId = payload.traceId;\r\n    let spanId = payload.spanId;\r\n    let parentSpanId = payload.parentSpanId;\r\n\r\n    if (payload.req) {\r\n      const extractedTrace = VolidatorClient.extractTraceContext(payload.req);\r\n      if (!traceId && extractedTrace.traceId) {\r\n        traceId = extractedTrace.traceId;\r\n      }\r\n      if (!spanId && extractedTrace.spanId) {\r\n        spanId = extractedTrace.spanId;\r\n      }\r\n    }\r\n\r\n    if (spanId) {\r\n      enrichedPayload.spanId = spanId;\r\n    }\r\n    if (parentSpanId) {\r\n      enrichedPayload.parentSpanId = parentSpanId;\r\n    }\r\n\r\n    const activeKeyBuffer = await this._getHashedKey(this.activeKeyId);\r\n    const actorBlindIndex = await this.generateBlindIndex(actor, activeKeyBuffer);\r\n    const actionBlindIndex = await this.generateBlindIndex(action, activeKeyBuffer);\r\n    const targetBlindIndex = await this.generateBlindIndex(target, activeKeyBuffer);\r\n    const tenantBlindIndex = tenant ? await this.generateBlindIndex(tenant, activeKeyBuffer) : undefined;\r\n    const traceBlindIndex = traceId ? await this.generateBlindIndex(traceId, activeKeyBuffer) : undefined;\r\n\r\n    const encryptedPayload = await this.encryptPayload(enrichedPayload);\r\n\r\n    return {\r\n      actorBlindIndex,\r\n      actionBlindIndex,\r\n      targetBlindIndex,\r\n      tenantBlindIndex,\r\n      traceBlindIndex,\r\n      encryptedPayload,\r\n    };\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // log() — Encrypt and ingest a single audit event\r\n  // ---------------------------------------------------------------------------\r\n  async log(payload: LogPayload, maxMetaOverride?: number): Promise<boolean> {\r\n    const entry = await this.prepareLogEntry(payload, maxMetaOverride);\r\n    try {\r\n      const res = await fetch(`${this.endpoint}/v1/log`, {\r\n        method: \"POST\",\r\n        headers: {\r\n          Authorization: `Bearer ${this.apiKey}`,\r\n          \"Content-Type\": \"application/json\",\r\n        },\r\n        body: JSON.stringify(entry),\r\n      });\r\n\r\n      return res.ok;\r\n    } catch (err: any) {\r\n      console.error(`[Volidator] Failed to send log: ${err.message}`);\r\n      return false;\r\n    }\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // logBatch() — Bulk encrypt and ingest a batch of up to 100 audit events\r\n  // ---------------------------------------------------------------------------\r\n  async logBatch(payloads: LogPayload[], maxMetaOverride?: number): Promise<{ accepted: number; rejected: number }> {\r\n    if (!Array.isArray(payloads) || payloads.length === 0) {\r\n      return { accepted: 0, rejected: 0 };\r\n    }\r\n\r\n    // Cap batch size at 100\r\n    const batch = payloads.slice(0, 100);\r\n    const preparedEntries: any[] = [];\r\n    let rejected = payloads.length - batch.length;\r\n\r\n    const results = await Promise.allSettled(\r\n      batch.map(p => this.prepareLogEntry(p, maxMetaOverride))\r\n    );\r\n\r\n    for (const res of results) {\r\n      if (res.status === \"fulfilled\") {\r\n        preparedEntries.push(res.value);\r\n      } else {\r\n        rejected++;\r\n        console.error(`[Volidator] Failed to prepare batch entry: ${res.reason?.message}`);\r\n      }\r\n    }\r\n\r\n    if (preparedEntries.length === 0) {\r\n      return { accepted: 0, rejected };\r\n    }\r\n\r\n    try {\r\n      const res = await fetch(`${this.endpoint}/v1/logs/batch`, {\r\n        method: \"POST\",\r\n        headers: {\r\n          Authorization: `Bearer ${this.apiKey}`,\r\n          \"Content-Type\": \"application/json\",\r\n        },\r\n        body: JSON.stringify({ logs: preparedEntries }),\r\n      });\r\n\r\n      if (res.ok) {\r\n        return { accepted: preparedEntries.length, rejected };\r\n      } else {\r\n        console.error(`[Volidator] Batch ingestion endpoint returned status: ${res.status}`);\r\n        return { accepted: 0, rejected: rejected + preparedEntries.length };\r\n      }\r\n    } catch (err: any) {\r\n      console.error(`[Volidator] Failed to send log batch: ${err.message}`);\r\n      return { accepted: 0, rejected: rejected + preparedEntries.length };\r\n    }\r\n  }\r\n\r\n  // ---------------------------------------------------------------------------\r\n  // generateEmbedToken() — Sign a HS256 JWT for the embeddable dashboard widget\r\n  // ---------------------------------------------------------------------------\r\n  async generateEmbedToken(config: EmbedTokenConfig): Promise<EmbedTokenResult> {\r\n    if (!this.projectId || !this.clientSecret) {\r\n      throw new Error(\r\n        \"generateEmbedToken() requires projectId and clientSecret in the VolidatorClient constructor.\"\r\n      );\r\n    }\r\n\r\n    const {\r\n      actorId,\r\n      targetId,\r\n      tenantId,\r\n      scope,\r\n      expiresIn = \"2h\",\r\n      dashboardUrl = \"https://dash.volidator.com\",\r\n      hostOrigin,\r\n      view,\r\n    } = config;\r\n\r\n    // Determine default query scope based on parameters\r\n    const defaultScope = scope || (tenantId ? \"tenant\" : \"actor\");\r\n\r\n    // Check if at least one identity parameter is provided (bypassed for auditor scope)\r\n    if (defaultScope !== \"auditor\" && !actorId && !targetId && !tenantId) {\r\n      throw new Error(\r\n        \"At least one of actorId, targetId, or tenantId must be provided to generateEmbedToken().\"\r\n      );\r\n    }\r\n\r\n    // 1. Compute blind indexes for all keys in the keyring\r\n    const actorBlindIndexes = actorId\r\n      ? await Promise.all(Object.keys(this.keyring).map(async id => this.generateBlindIndex(actorId, await this._getHashedKey(id))))\r\n      : undefined;\r\n    const targetBlindIndexes = targetId\r\n      ? await Promise.all(Object.keys(this.keyring).map(async id => this.generateBlindIndex(targetId, await this._getHashedKey(id))))\r\n      : undefined;\r\n    const tenantBlindIndexes = tenantId\r\n      ? await Promise.all(Object.keys(this.keyring).map(async id => this.generateBlindIndex(tenantId, await this._getHashedKey(id))))\r\n      : undefined;\r\n\r\n    // 2. Resolve expiry to seconds, capping it at 1 hour (3600s) for security.\r\n    const parsedExpiry = this.parseExpiry(expiresIn);\r\n    const maxExpiry = defaultScope === \"auditor\" ? 604800 : 3600;\r\n    const expiresInSeconds = Math.min(parsedExpiry, maxExpiry);\r\n    const now = Math.floor(Date.now() / 1000);\r\n\r\n    // 3. Build the JWT payload\r\n    const payload: Record<string, any> = {\r\n      pid: this.projectId,\r\n      scope: defaultScope,\r\n      iat: now,\r\n      exp: now + expiresInSeconds,\r\n    };\r\n\r\n    if (actorBlindIndexes) payload.abi = actorBlindIndexes;\r\n    if (targetBlindIndexes) payload.tgb = targetBlindIndexes;\r\n    if (tenantBlindIndexes) payload.tbi = tenantBlindIndexes;\r\n\r\n    // Compresses presentation config to minimize cookie/header footprint\r\n    if (view) {\r\n      const compressed: Record<string, any> = {};\r\n      if (Array.isArray(view.columns)) {\r\n        compressed.cols = view.columns.map((col) => {\r\n          if (col === \"createdAt\") return \"cat\";\r\n          if (col === \"actor\") return \"act\";\r\n          if (col === \"action\") return \"acn\";\r\n          if (col === \"target\") return \"tgt\";\r\n          if (col.startsWith(\"metadata.\")) {\r\n            return `m.${col.slice(9)}`;\r\n          }\r\n          return col;\r\n        });\r\n      }\r\n      if (view.defaultFilter) {\r\n        compressed.flt = {};\r\n        if (view.defaultFilter.search !== undefined) {\r\n          compressed.flt.q = view.defaultFilter.search;\r\n        }\r\n        if (view.defaultFilter.action !== undefined) {\r\n          compressed.flt.act = view.defaultFilter.action;\r\n        }\r\n      }\r\n      payload.view = compressed;\r\n    }\r\n\r\n    // 4. Sign as HS256 JWT using the project's clientSecret\r\n    const token = await this.signHS256JWT(payload, this.clientSecret);\r\n\r\n    // 5. Append the keyring as the URL hash fragment\r\n    const keyringString = Object.entries(this.keyring)\r\n      .map(([id, key]) => `${id}:${key}`)\r\n      .join(\",\");\r\n    const hostParam = hostOrigin\r\n      ? `?host=${encodeURIComponent(hostOrigin)}`\r\n      : \"\";\r\n    const embedUrl = `${dashboardUrl}/embed/${token}${hostParam}#${keyringString}`;\r\n\r\n    return { token, embedUrl };\r\n  }\r\n\r\n  private async signHS256JWT(payload: object, secret: string): Promise<string> {\r\n    const header = { alg: \"HS256\", typ: \"JWT\" };\r\n\r\n    const encode = (obj: object) =>\r\n      btoa(JSON.stringify(obj))\r\n        .replace(/\\+/g, \"-\")\r\n        .replace(/\\//g, \"_\")\r\n        .replace(/=/g, \"\");\r\n\r\n    const unsigned = `${encode(header)}.${encode(payload)}`;\r\n\r\n    const key = await globalThis.crypto.subtle.importKey(\r\n      \"raw\", new TextEncoder().encode(secret) as unknown as BufferSource, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]\r\n    );\r\n    const signatureBuffer = await globalThis.crypto.subtle.sign(\r\n      \"HMAC\", key, new TextEncoder().encode(unsigned)\r\n    );\r\n\r\n    let binary = '';\r\n    const arr = new Uint8Array(signatureBuffer);\r\n    for (let i = 0; i < arr.byteLength; i++) {\r\n      binary += String.fromCharCode(arr[i]);\r\n    }\r\n    const signature = btoa(binary)\r\n      .replace(/\\+/g, \"-\")\r\n      .replace(/\\//g, \"_\")\r\n      .replace(/=/g, \"\");\r\n\r\n    return `${unsigned}.${signature}`;\r\n  }\r\n\r\n  private parseExpiry(expiry: string): number {\r\n    const match = expiry.match(/^(\\d+)(s|m|h|d)$/);\r\n    if (!match) return 7200;\r\n    const [, num, unit] = match;\r\n    const n = parseInt(num, 10);\r\n    switch (unit) {\r\n      case \"s\": return n;\r\n      case \"m\": return n * 60;\r\n      case \"h\": return n * 3600;\r\n      case \"d\": return n * 86400;\r\n      default: return 7200;\r\n    }\r\n  }\r\n}\r\n\r\n// ---------------------------------------------------------------------------\r\n// Standard Compliance Logging Helper Class\r\n// ---------------------------------------------------------------------------\r\nexport class VolidatorCompliance {\r\n  private client: VolidatorClient;\r\n\r\n  constructor(client: VolidatorClient) {\r\n    this.client = client;\r\n  }\r\n\r\n  private async logWithControl(\r\n    action: string,\r\n    soc2Control: string,\r\n    isoControl: string,\r\n    payload: Omit<LogPayload, \"action\">\r\n  ): Promise<boolean> {\r\n    const metadata = {\r\n      ...payload.metadata,\r\n      soc2_control: soc2Control,\r\n      iso27001: isoControl,\r\n    };\r\n    return this.client.log({\r\n      ...payload,\r\n      action,\r\n      metadata,\r\n    });\r\n  }\r\n\r\n  async accessRevoked(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"access.revoked\", \"CC6.1\", \"A.9.2.6\", payload);\r\n  }\r\n\r\n  async accessGranted(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"access.granted\", \"CC6.1\", \"A.9.2.1\", payload);\r\n  }\r\n\r\n  async dataExported(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"data.exported\", \"CC6.6\", \"A.12.4.1\", payload);\r\n  }\r\n\r\n  async systemConfigChanged(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"system.config_changed\", \"CC6.2\", \"A.12.1.2\", payload);\r\n  }\r\n\r\n  async mfaEnabled(payload: Omit<LogPayload, \"action\">): Promise<boolean> {\r\n    return this.logWithControl(\"mfa.enabled\", \"CC6.3\", \"A.9.4.2\", payload);\r\n  }\r\n}\r\n\r\n// ---------------------------------------------------------------------------\r\n// AI & Autonomous Agent Compliance Audit Taxonomy Class\r\n// ---------------------------------------------------------------------------\r\nexport class VolidatorAgent {\r\n  private client: VolidatorClient;\r\n\r\n  constructor(client: VolidatorClient) {\r\n    this.client = client;\r\n  }\r\n\r\n  private async logAgent(\r\n    action: string,\r\n    euAiAct: string,\r\n    nistAiRmf: string,\r\n    soc2Control: string,\r\n    isoControl: string,\r\n    payload: Omit<LogPayload, \"action\"> & Record<string, any>\r\n  ): Promise<boolean> {\r\n    const {\r\n      actor,\r\n      actorId,\r\n      target,\r\n      targetId,\r\n      tenant,\r\n      tenantId,\r\n      metadata,\r\n      context,\r\n      telemetry,\r\n      req,\r\n      traceId,\r\n      spanId,\r\n      parentSpanId,\r\n      ...agentData\r\n    } = payload;\r\n\r\n    const enrichedMetadata = {\r\n      ...metadata,\r\n      ...agentData,\r\n      eu_ai_act: euAiAct,\r\n      nist_ai_rmf: nistAiRmf,\r\n      soc2_control: soc2Control,\r\n      iso27001: isoControl,\r\n    };\r\n\r\n    // Use 64KB metadata limit for AI events\r\n    return this.client.log(\r\n      {\r\n        actor,\r\n        actorId,\r\n        target,\r\n        targetId,\r\n        tenant,\r\n        tenantId,\r\n        action,\r\n        metadata: enrichedMetadata,\r\n        context,\r\n        telemetry,\r\n        req,\r\n        traceId,\r\n        spanId,\r\n        parentSpanId,\r\n      },\r\n      65536\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Logs a tool call or external API invocation by an agent.\r\n   * Maps to EU AI Act Article 12, NIST AI RMF MANAGE 2.2, SOC2 CC6.6, ISO 27001 A.12.4.1.\r\n   */\r\n  async toolCall(payload: Omit<LogPayload, \"action\"> & {\r\n    toolName: string;\r\n    toolInput?: Record<string, any>;\r\n    toolOutput?: Record<string, any>;\r\n    latencyMs?: number;\r\n    success: boolean;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.tool_call\", \"Article 12\", \"MANAGE 2.2\", \"CC6.6\", \"A.12.4.1\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs a key decision made autonomously by an AI agent model.\r\n   * Maps to EU AI Act Article 12 & 13, NIST AI RMF GOVERN 1.7, SOC2 CC6.2, ISO 27001 A.18.1.3.\r\n   */\r\n  async decision(payload: Omit<LogPayload, \"action\"> & {\r\n    decision: string;\r\n    alternatives?: string[];\r\n    rationale?: string;\r\n    confidenceScore?: number;\r\n    modelId?: string;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.decision\", \"Article 12 & 13\", \"GOVERN 1.7\", \"CC6.2\", \"A.18.1.3\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs a request for human review or permission escalation.\r\n   * Maps to EU AI Act Article 14, NIST AI RMF GOVERN 5.1, SOC2 CC6.3, ISO 27001 A.6.1.2.\r\n   */\r\n  async escalation(payload: Omit<LogPayload, \"action\"> & {\r\n    reason: string;\r\n    urgency?: \"low\" | \"medium\" | \"high\";\r\n    blockedAction?: string;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.escalation\", \"Article 14\", \"GOVERN 5.1\", \"CC6.3\", \"A.6.1.2\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs anomalous environment inputs, potential prompt injections, or policy violations.\r\n   * Maps to EU AI Act Article 9, NIST AI RMF MANAGE 2.4, SOC2 CC7.2, ISO 27001 A.16.1.2.\r\n   */\r\n  async anomaly(payload: Omit<LogPayload, \"action\"> & {\r\n    description: string;\r\n    severity?: \"low\" | \"medium\" | \"high\" | \"critical\";\r\n    anomalyType?: \"prompt_injection\" | \"unexpected_input\" | \"policy_violation\" | \"other\";\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.anomaly\", \"Article 9\", \"MANAGE 2.4\", \"CC7.2\", \"A.16.1.2\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs a model refusal to execute a user prompt or command due to alignment safety.\r\n   * Maps to EU AI Act Article 5, NIST AI RMF GOVERN 1.1, SOC2 CC6.8, ISO 27001 A.18.1.3.\r\n   */\r\n  async refusal(payload: Omit<LogPayload, \"action\"> & {\r\n    refusedInstruction: string;\r\n    reason: string;\r\n    policyViolated?: string;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.refusal\", \"Article 5\", \"GOVERN 1.1\", \"CC6.8\", \"A.18.1.3\", payload);\r\n  }\r\n\r\n  /**\r\n   * Logs an execution context handoff from one agent to another.\r\n   * Maps to EU AI Act Article 12, NIST AI RMF MAP 1.6, SOC2 CC6.6, ISO 27001 A.12.4.1.\r\n   */\r\n  async handoff(payload: Omit<LogPayload, \"action\"> & {\r\n    toAgentId: string;\r\n    instruction: string;\r\n    agentContext?: Record<string, any>;\r\n  }): Promise<boolean> {\r\n    return this.logAgent(\"agent.handoff\", \"Article 12\", \"MAP 1.6\", \"CC6.6\", \"A.12.4.1\", payload);\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC+HO,IAAM,kBAAN,MAAM,iBAAgB;AAAA,EAuB3B,YAAY,QAsBT;AACD,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,OAAO,YAAY;AACnC,SAAK,YAAY,OAAO;AACxB,SAAK,eAAe,OAAO;AAC3B,SAAK,aAAa,OAAO,cAAc,CAAC;AACxC,SAAK,gBAAgB,OAAO,iBAAiB,CAAC;AAC9C,SAAK,kBAAkB,OAAO,mBAAmB;AAGjD,QAAI,OAAO,WAAW,OAAO,uBAAuB;AAClD,WAAK,UAAU,OAAO;AACtB,WAAK,cAAc,OAAO;AAAA,IAC5B,WAAW,OAAO,eAAe;AAC/B,WAAK,cAAc;AACnB,WAAK,UAAU,EAAE,MAAM,OAAO,cAAc;AAAA,IAC9C,OAAO;AACL,YAAM,IAAI,MAAM,8GAA8G;AAAA,IAChI;AAGA,QAAI,OAAO,KAAK,KAAK,OAAO,EAAE,SAAS,GAAG;AACxC,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AAEA,QAAI,CAAC,KAAK,QAAQ,KAAK,WAAW,GAAG;AACnC,YAAM,IAAI,MAAM,kBAAkB,KAAK,WAAW,8BAA8B;AAAA,IAClF;AAGA,SAAK,gBAAgB,CAAC;AAGtB,SAAK,kBAAkB,iBAAgB,uBAAuB,OAAO,aAAa,EAAE,QAAQ,WAAW,CAAC;AACxG,SAAK,aAAa,IAAI,oBAAoB,IAAI;AAC9C,SAAK,QAAQ,IAAI,eAAe,IAAI;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,eAAe,KAA4B;AAChD,UAAM,YAAY,CAAC,SAAyB;AAC1C,UAAI,CAAC,IAAK,QAAO;AAEjB,UAAI,OAAO,IAAI,SAAS,QAAQ,YAAY;AAC1C,eAAO,IAAI,QAAQ,IAAI,IAAI,KAAK;AAAA,MAClC;AAEA,UAAI,IAAI,WAAW,OAAO,IAAI,YAAY,UAAU;AAClD,eAAO,IAAI,QAAQ,IAAI,KAAK,IAAI,QAAQ,KAAK,YAAY,CAAC,KAAK;AAAA,MACjE;AACA,aAAO;AAAA,IACT;AAEA,UAAM,QAAQ,UAAU,kBAAkB,KACxC,UAAU,WAAW,KACrB,UAAU,iBAAiB;AAE7B,UAAM,KAAK,QAAQ,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,IAAK,KAAK,QAAQ,iBAAiB;AAC/E,UAAM,YAAY,UAAU,YAAY;AAExC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,UAAU;AAAA,QACR,SAAS,UAAU,cAAc,KAAK,UAAU,qBAAqB,KAAK;AAAA,QAC1E,QAAQ,UAAU,gBAAgB,KAAK,UAAU,4BAA4B,KAAK;AAAA,QAClF,MAAM,UAAU,WAAW,KAAK,UAAU,kBAAkB,KAAK;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,oBAAoB,KAAiD;AAC1E,QAAI,CAAC,IAAK,QAAO,CAAC;AAClB,UAAM,YAAY,CAAC,SAAyB;AAC1C,UAAI,OAAO,IAAI,SAAS,QAAQ,YAAY;AAC1C,eAAO,IAAI,QAAQ,IAAI,IAAI,KAAK;AAAA,MAClC;AACA,UAAI,IAAI,WAAW,OAAO,IAAI,YAAY,UAAU;AAClD,eAAO,IAAI,QAAQ,IAAI,KAAK,IAAI,QAAQ,KAAK,YAAY,CAAC,KAAK;AAAA,MACjE;AACA,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,UAAU,aAAa;AAC3C,QAAI,CAAC,YAAa,QAAO,CAAC;AAC1B,UAAM,QAAQ,YAAY,MAAM,GAAG;AACnC,QAAI,MAAM,WAAW,EAAG,QAAO,CAAC;AAChC,WAAO,EAAE,SAAS,MAAM,CAAC,GAAG,QAAQ,MAAM,CAAC,EAAE;AAAA,EAC/C;AAAA,EAEA,OAAe,uBAAuB,QAAoE;AACxG,UAAM,SAAS,OAAO,UAAU;AAEhC,QAAI,KAAqC;AACzC,QAAI,YAAwC;AAC5C,QAAI,WAAW;AAEf,QAAI,WAAW,UAAU;AACvB,WAAK;AACL,kBAAY;AACZ,iBAAW;AAAA,IACb,WAAW,WAAW,QAAQ;AAC5B,WAAK;AACL,kBAAY;AACZ,iBAAW;AAAA,IACb;AAEA,QAAI,OAAO,OAAO,OAAW,MAAK,OAAO;AACzC,QAAI,OAAO,cAAc,OAAW,aAAY,OAAO;AACvD,QAAI,OAAO,aAAa,OAAW,YAAW,OAAO;AAErD,WAAO,EAAE,IAAI,WAAW,SAAS;AAAA,EACnC;AAAA,EAEQ,eAAe,IAAY;AACjC,QAAI,UAAU;AACd,QAAI,KAAK;AACT,QAAI,OAAO;AAEX,QAAI,2BAA2B,KAAK,EAAE,GAAG;AACvC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,IAAI;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,UAAU,KAAK,EAAE,GAAG;AACtB,aAAO;AAAA,IACT,WAAW,eAAe,KAAK,EAAE,GAAG;AAClC,aAAO;AAAA,IACT,WAAW,cAAc,KAAK,EAAE,GAAG;AACjC,aAAO;AAAA,IACT;AAGA,QAAI,gBAAgB,KAAK,EAAE,KAAK,CAAC,YAAY,KAAK,EAAE,KAAK,CAAC,OAAO,KAAK,EAAE,GAAG;AACzE,YAAM,QAAQ,GAAG,MAAM,+BAA+B;AACtD,gBAAU,UAAU,QAAQ,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK;AAAA,IACjE,WAAW,UAAU,KAAK,EAAE,KAAK,CAAC,gBAAgB,KAAK,EAAE,KAAK,CAAC,WAAW,KAAK,EAAE,GAAG;AAClF,gBAAU,UAAU,KAAK,EAAE,IAAI,kBAAkB;AAAA,IACnD,WAAW,iBAAiB,KAAK,EAAE,GAAG;AACpC,gBAAU;AAAA,IACZ,WAAW,YAAY,KAAK,EAAE,GAAG;AAC/B,gBAAU;AAAA,IACZ;AAGA,QAAI,WAAW,KAAK,EAAE,GAAG;AACvB,WAAK;AAAA,IACP,WAAW,sBAAsB,KAAK,EAAE,GAAG;AACzC,WAAK;AAAA,IACP,WAAW,oBAAoB,KAAK,EAAE,GAAG;AACvC,WAAK;AAAA,IACP,WAAW,WAAW,KAAK,EAAE,GAAG;AAC9B,WAAK;AAAA,IACP,WAAW,SAAS,KAAK,EAAE,GAAG;AAC5B,WAAK;AAAA,IACP;AAEA,WAAO,EAAE,SAAS,IAAI,KAAK;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAc,IAAiC;AAC3D,QAAI,KAAK,cAAc,EAAE,EAAG,QAAO,KAAK,cAAc,EAAE;AACxD,UAAM,SAAS,KAAK,QAAQ,EAAE;AAC9B,UAAM,MAAM,IAAI,YAAY,EAAE,OAAO,MAAM;AAC3C,UAAM,OAAO,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,GAAG;AACjE,SAAK,cAAc,EAAE,IAAI,IAAI,WAAW,IAAI;AAC5C,WAAO,KAAK,cAAc,EAAE;AAAA,EAC9B;AAAA,EAEA,MAAc,mBAAmB,OAAe,WAAwC;AACtF,UAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,MACzC;AAAA,MAAO;AAAA,MAAsC,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAAG;AAAA,MAAO,CAAC,MAAM;AAAA,IAChG;AACA,UAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,MAC/C;AAAA,MAAQ;AAAA,MAAK,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IAC7C;AACA,WAAO,MAAM,KAAK,IAAI,WAAW,SAAS,CAAC,EACxC,IAAI,OAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,EAAE;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eAAe,SAAkC;AAC7D,UAAM,OAAO,KAAK,UAAU,OAAO;AACnC,UAAM,KAAK,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC/D,UAAM,kBAAkB,MAAM,KAAK,cAAc,KAAK,WAAW;AAEjE,UAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,MAC/C;AAAA,MAAO;AAAA,MAA4C,EAAE,MAAM,UAAU;AAAA,MAAG;AAAA,MAAO,CAAC,SAAS;AAAA,IAC3F;AAEA,UAAM,kBAAkB,MAAM,WAAW,OAAO,OAAO;AAAA,MACrD,EAAE,MAAM,WAAW,GAAG;AAAA,MAAG;AAAA,MAAW,IAAI,YAAY,EAAE,OAAO,IAAI;AAAA,IACnE;AAEA,UAAM,cAAc,IAAI,WAAW,GAAG,SAAS,gBAAgB,UAAU;AACzE,gBAAY,IAAI,IAAI,CAAC;AACrB,gBAAY,IAAI,IAAI,WAAW,eAAe,GAAG,GAAG,MAAM;AAG1D,QAAI,SAAS;AACb,UAAM,MAAM,YAAY;AACxB,aAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,gBAAU,OAAO,aAAa,YAAY,CAAC,CAAC;AAAA,IAC9C;AACA,UAAM,SAAS,KAAK,MAAM;AAC1B,WAAO,GAAG,KAAK,WAAW,IAAI,MAAM;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,gBAAgB,SAAqB,iBAA0B;AAC3E,UAAM,WAAW,QAAQ,SAAS,QAAQ,WAAW;AACrD,UAAM,YAAY,QAAQ,UAAU,QAAQ,YAAY;AACxD,UAAM,YAAY,QAAQ,UAAU,QAAQ,YAAY;AAExD,UAAM,WAAW,CAAC,KAAa,WAA2B;AACxD,UAAI,IAAI,SAAS,QAAQ;AACvB,eAAO,IAAI,MAAM,GAAG,MAAM,IAAI;AAAA,MAChC;AACA,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,CAAC,MAClB,OAAO,MAAM,WAAW,EAAE,MAAM;AAClC,UAAM,YAAY,CAAC,MACjB,OAAO,MAAM,WAAW,EAAE,KAAK;AAEjC,UAAM,QAAQ,SAAS,WAAW,QAAQ,GAAG,GAAG;AAChD,UAAM,SAAS,SAAS,WAAW,SAAS,GAAG,GAAG;AAClD,UAAM,SAAS,YAAY,SAAS,WAAW,SAAS,GAAG,GAAG,IAAI;AAClE,UAAM,SAAS,SAAS,QAAQ,QAAQ,GAAG;AAE3C,UAAM,eAAe,QAAQ,YACzB,iBAAgB,uBAAuB,EAAE,GAAG,KAAK,iBAAiB,GAAG,QAAQ,UAAU,CAAC,IACxF,KAAK;AAET,QAAI,aAAa,QAAQ,WAAW,CAAC;AACrC,QAAI,QAAQ,KAAK;AACf,YAAM,YAAY,iBAAgB,eAAe,QAAQ,GAAG;AAC5D,mBAAa;AAAA,QACX,GAAG;AAAA,QACH,GAAG;AAAA,QACH,UAAU;AAAA,UACR,GAAG,UAAU;AAAA,UACb,GAAG,WAAW;AAAA,QAChB;AAAA,QACA,QAAQ;AAAA,UACN,GAAG,UAAU;AAAA,UACb,GAAG,WAAW;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAA4B,CAAC;AACnC,UAAM,QAAQ,WAAW,MAAM;AAC/B,UAAM,QAAQ,WAAW,aAAa;AAEtC,QAAI,aAAa,UAAU;AACzB,cAAQ,WAAW,CAAC;AACpB,UAAI,WAAW,UAAU;AACvB,gBAAQ,SAAS,UAAU,WAAW,SAAS,WAAW;AAC1D,gBAAQ,SAAS,SAAS,WAAW,SAAS,UAAU;AACxD,cAAM,SAAS,QAAQ,WAAW,WAAW,UAAW,CAAC,QAAQ,aAAa,KAAK,gBAAgB,OAAO;AAC1G,YAAI,aAAa,OAAO,WAAW,QAAQ;AACzC,kBAAQ,SAAS,OAAO,WAAW,SAAS,QAAQ;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,OAAO,eAAe,OAAO;AAC5C,cAAQ,KAAK,MAAM,KAAK,mBAAmB,OAAO,MAAM,KAAK,cAAc,KAAK,WAAW,CAAC;AAAA,IAC9F,WAAW,aAAa,OAAO,WAAW,OAAO;AAC/C,cAAQ,KAAK;AAAA,IACf;AAEA,QAAI,aAAa,cAAc,QAAQ;AACrC,UAAI,OAAO;AACT,gBAAQ,SAAS,KAAK,eAAe,KAAK;AAC1C,YAAI,aAAa,cAAc,SAAS;AACtC,kBAAQ,YAAY,SAAS,OAAO,GAAI;AAAA,QAC1C;AAAA,MACF,WAAW,WAAW,QAAQ;AAC5B,gBAAQ,SAAS,WAAW;AAAA,MAC9B;AAAA,IACF;AAEA,UAAM,QAAQ,CAAC,OAAe,QAC5B,KAAK,WAAW,SAAS,GAAG,IAAI,aAAa,GAAG,MAAM;AAExD,UAAM,WAAW,CAAC,UAAqC,QAAwB;AAC7E,UAAI,KAAK,cAAc,SAAS,GAAG,GAAG;AACpC,cAAM,KAAK,UAAU,QAAQ;AAC7B,eAAO,QAAQ,EAAE;AAAA,MACnB;AACA,aAAO,MAAM,WAAW,QAAQ,GAAG,GAAG;AAAA,IACxC;AAEA,UAAM,cAAc,QAAQ,YAAY,CAAC;AACzC,UAAM,eAAoC,CAAC;AAC3C,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,WAAW,GAAG;AAChD,YAAM,UAAU,YAAY,CAAC;AAC7B,UAAI,KAAK,cAAc,SAAS,OAAO,KAAK,OAAO,MAAM,YAAY,MAAM,QAAQ,QAAQ,GAAG;AAC5F,qBAAa,CAAC,IAAI,QAAS,EAAuB,EAAE;AAAA,MACtD,WAAW,KAAK,WAAW,SAAS,OAAO,KAAK,OAAO,MAAM,UAAU;AACrE,qBAAa,CAAC,IAAI,aAAa,CAAC;AAAA,MAClC,OAAO;AACL,qBAAa,CAAC,IAAI;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,aAAa,CAAC,KAAU,eAAe,MAAW;AACtD,UAAI,eAAe,GAAG;AACpB,eAAO;AAAA,MACT;AACA,UAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAC3C,YAAI,OAAO,QAAQ,UAAU;AAC3B,iBAAO,SAAS,KAAK,GAAI;AAAA,QAC3B;AACA,eAAO;AAAA,MACT;AACA,UAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,eAAO,IAAI,IAAI,UAAQ,WAAW,MAAM,eAAe,CAAC,CAAC;AAAA,MAC3D;AACA,YAAM,SAA8B,CAAC;AACrC,iBAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC5C,eAAO,GAAG,IAAI,WAAW,KAAK,eAAe,CAAC;AAAA,MAChD;AACA,aAAO;AAAA,IACT;AAEA,UAAM,oBAAoB,WAAW,YAAY;AACjD,UAAM,iBAAiB,KAAK,UAAU,iBAAiB;AACvD,UAAM,eAAe,mBAAmB,KAAK;AAC7C,QAAI,eAAe,SAAS,cAAc;AACxC,YAAM,IAAI,MAAM,kDAAkD,eAAe,IAAI,KAAK;AAAA,IAC5F;AAEA,UAAM,YAAY,SAAS,UAAU,OAAO;AAC5C,UAAM,aAAa,SAAS,WAAW,QAAQ;AAC/C,UAAM,aAAa,YAAY,SAAS,WAAW,QAAQ,IAAI;AAE/D,UAAM,kBAAuB;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,MACA,QAAQ;AAAA,MACR,UAAU;AAAA,IACZ;AAEA,QAAI,YAAY;AACd,sBAAgB,SAAS;AAAA,IAC3B;AAEA,QAAI,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG;AACnC,sBAAgB,UAAU;AAAA,IAC5B;AAGA,QAAI,UAAU,QAAQ;AACtB,QAAI,SAAS,QAAQ;AACrB,QAAI,eAAe,QAAQ;AAE3B,QAAI,QAAQ,KAAK;AACf,YAAM,iBAAiB,iBAAgB,oBAAoB,QAAQ,GAAG;AACtE,UAAI,CAAC,WAAW,eAAe,SAAS;AACtC,kBAAU,eAAe;AAAA,MAC3B;AACA,UAAI,CAAC,UAAU,eAAe,QAAQ;AACpC,iBAAS,eAAe;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,QAAQ;AACV,sBAAgB,SAAS;AAAA,IAC3B;AACA,QAAI,cAAc;AAChB,sBAAgB,eAAe;AAAA,IACjC;AAEA,UAAM,kBAAkB,MAAM,KAAK,cAAc,KAAK,WAAW;AACjE,UAAM,kBAAkB,MAAM,KAAK,mBAAmB,OAAO,eAAe;AAC5E,UAAM,mBAAmB,MAAM,KAAK,mBAAmB,QAAQ,eAAe;AAC9E,UAAM,mBAAmB,MAAM,KAAK,mBAAmB,QAAQ,eAAe;AAC9E,UAAM,mBAAmB,SAAS,MAAM,KAAK,mBAAmB,QAAQ,eAAe,IAAI;AAC3F,UAAM,kBAAkB,UAAU,MAAM,KAAK,mBAAmB,SAAS,eAAe,IAAI;AAE5F,UAAM,mBAAmB,MAAM,KAAK,eAAe,eAAe;AAElE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,IAAI,SAAqB,iBAA4C;AACzE,UAAM,QAAQ,MAAM,KAAK,gBAAgB,SAAS,eAAe;AACjE,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,KAAK,QAAQ,WAAW;AAAA,QACjD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,MAAM;AAAA,UACpC,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,KAAK;AAAA,MAC5B,CAAC;AAED,aAAO,IAAI;AAAA,IACb,SAAS,KAAU;AACjB,cAAQ,MAAM,mCAAmC,IAAI,OAAO,EAAE;AAC9D,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,UAAwB,iBAA2E;AAChH,QAAI,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW,GAAG;AACrD,aAAO,EAAE,UAAU,GAAG,UAAU,EAAE;AAAA,IACpC;AAGA,UAAM,QAAQ,SAAS,MAAM,GAAG,GAAG;AACnC,UAAM,kBAAyB,CAAC;AAChC,QAAI,WAAW,SAAS,SAAS,MAAM;AAEvC,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,MAAM,IAAI,OAAK,KAAK,gBAAgB,GAAG,eAAe,CAAC;AAAA,IACzD;AAEA,eAAW,OAAO,SAAS;AACzB,UAAI,IAAI,WAAW,aAAa;AAC9B,wBAAgB,KAAK,IAAI,KAAK;AAAA,MAChC,OAAO;AACL;AACA,gBAAQ,MAAM,8CAA8C,IAAI,QAAQ,OAAO,EAAE;AAAA,MACnF;AAAA,IACF;AAEA,QAAI,gBAAgB,WAAW,GAAG;AAChC,aAAO,EAAE,UAAU,GAAG,SAAS;AAAA,IACjC;AAEA,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,GAAG,KAAK,QAAQ,kBAAkB;AAAA,QACxD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,eAAe,UAAU,KAAK,MAAM;AAAA,UACpC,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAAA,MAChD,CAAC;AAED,UAAI,IAAI,IAAI;AACV,eAAO,EAAE,UAAU,gBAAgB,QAAQ,SAAS;AAAA,MACtD,OAAO;AACL,gBAAQ,MAAM,yDAAyD,IAAI,MAAM,EAAE;AACnF,eAAO,EAAE,UAAU,GAAG,UAAU,WAAW,gBAAgB,OAAO;AAAA,MACpE;AAAA,IACF,SAAS,KAAU;AACjB,cAAQ,MAAM,yCAAyC,IAAI,OAAO,EAAE;AACpE,aAAO,EAAE,UAAU,GAAG,UAAU,WAAW,gBAAgB,OAAO;AAAA,IACpE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,QAAqD;AAC5E,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,eAAe;AAAA,MACf;AAAA,MACA;AAAA,IACF,IAAI;AAGJ,UAAM,eAAe,UAAU,WAAW,WAAW;AAGrD,QAAI,iBAAiB,aAAa,CAAC,WAAW,CAAC,YAAY,CAAC,UAAU;AACpE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,UAAM,oBAAoB,UACtB,MAAM,QAAQ,IAAI,OAAO,KAAK,KAAK,OAAO,EAAE,IAAI,OAAM,OAAM,KAAK,mBAAmB,SAAS,MAAM,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,IAC3H;AACJ,UAAM,qBAAqB,WACvB,MAAM,QAAQ,IAAI,OAAO,KAAK,KAAK,OAAO,EAAE,IAAI,OAAM,OAAM,KAAK,mBAAmB,UAAU,MAAM,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,IAC5H;AACJ,UAAM,qBAAqB,WACvB,MAAM,QAAQ,IAAI,OAAO,KAAK,KAAK,OAAO,EAAE,IAAI,OAAM,OAAM,KAAK,mBAAmB,UAAU,MAAM,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,IAC5H;AAGJ,UAAM,eAAe,KAAK,YAAY,SAAS;AAC/C,UAAM,YAAY,iBAAiB,YAAY,SAAS;AACxD,UAAM,mBAAmB,KAAK,IAAI,cAAc,SAAS;AACzD,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,UAAM,UAA+B;AAAA,MACnC,KAAK,KAAK;AAAA,MACV,OAAO;AAAA,MACP,KAAK;AAAA,MACL,KAAK,MAAM;AAAA,IACb;AAEA,QAAI,kBAAmB,SAAQ,MAAM;AACrC,QAAI,mBAAoB,SAAQ,MAAM;AACtC,QAAI,mBAAoB,SAAQ,MAAM;AAGtC,QAAI,MAAM;AACR,YAAM,aAAkC,CAAC;AACzC,UAAI,MAAM,QAAQ,KAAK,OAAO,GAAG;AAC/B,mBAAW,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ;AAC1C,cAAI,QAAQ,YAAa,QAAO;AAChC,cAAI,QAAQ,QAAS,QAAO;AAC5B,cAAI,QAAQ,SAAU,QAAO;AAC7B,cAAI,QAAQ,SAAU,QAAO;AAC7B,cAAI,IAAI,WAAW,WAAW,GAAG;AAC/B,mBAAO,KAAK,IAAI,MAAM,CAAC,CAAC;AAAA,UAC1B;AACA,iBAAO;AAAA,QACT,CAAC;AAAA,MACH;AACA,UAAI,KAAK,eAAe;AACtB,mBAAW,MAAM,CAAC;AAClB,YAAI,KAAK,cAAc,WAAW,QAAW;AAC3C,qBAAW,IAAI,IAAI,KAAK,cAAc;AAAA,QACxC;AACA,YAAI,KAAK,cAAc,WAAW,QAAW;AAC3C,qBAAW,IAAI,MAAM,KAAK,cAAc;AAAA,QAC1C;AAAA,MACF;AACA,cAAQ,OAAO;AAAA,IACjB;AAGA,UAAM,QAAQ,MAAM,KAAK,aAAa,SAAS,KAAK,YAAY;AAGhE,UAAM,gBAAgB,OAAO,QAAQ,KAAK,OAAO,EAC9C,IAAI,CAAC,CAAC,IAAI,GAAG,MAAM,GAAG,EAAE,IAAI,GAAG,EAAE,EACjC,KAAK,GAAG;AACX,UAAM,YAAY,aACd,SAAS,mBAAmB,UAAU,CAAC,KACvC;AACJ,UAAM,WAAW,GAAG,YAAY,UAAU,KAAK,GAAG,SAAS,IAAI,aAAa;AAE5E,WAAO,EAAE,OAAO,SAAS;AAAA,EAC3B;AAAA,EAEA,MAAc,aAAa,SAAiB,QAAiC;AAC3E,UAAM,SAAS,EAAE,KAAK,SAAS,KAAK,MAAM;AAE1C,UAAM,SAAS,CAAC,QACd,KAAK,KAAK,UAAU,GAAG,CAAC,EACrB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AAErB,UAAM,WAAW,GAAG,OAAO,MAAM,CAAC,IAAI,OAAO,OAAO,CAAC;AAErD,UAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,MACzC;AAAA,MAAO,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,MAA8B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAAG;AAAA,MAAO,CAAC,MAAM;AAAA,IACvH;AACA,UAAM,kBAAkB,MAAM,WAAW,OAAO,OAAO;AAAA,MACrD;AAAA,MAAQ;AAAA,MAAK,IAAI,YAAY,EAAE,OAAO,QAAQ;AAAA,IAChD;AAEA,QAAI,SAAS;AACb,UAAM,MAAM,IAAI,WAAW,eAAe;AAC1C,aAAS,IAAI,GAAG,IAAI,IAAI,YAAY,KAAK;AACvC,gBAAU,OAAO,aAAa,IAAI,CAAC,CAAC;AAAA,IACtC;AACA,UAAM,YAAY,KAAK,MAAM,EAC1B,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AAEnB,WAAO,GAAG,QAAQ,IAAI,SAAS;AAAA,EACjC;AAAA,EAEQ,YAAY,QAAwB;AAC1C,UAAM,QAAQ,OAAO,MAAM,kBAAkB;AAC7C,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,CAAC,EAAE,KAAK,IAAI,IAAI;AACtB,UAAM,IAAI,SAAS,KAAK,EAAE;AAC1B,YAAQ,MAAM;AAAA,MACZ,KAAK;AAAK,eAAO;AAAA,MACjB,KAAK;AAAK,eAAO,IAAI;AAAA,MACrB,KAAK;AAAK,eAAO,IAAI;AAAA,MACrB,KAAK;AAAK,eAAO,IAAI;AAAA,MACrB;AAAS,eAAO;AAAA,IAClB;AAAA,EACF;AACF;AAKO,IAAM,sBAAN,MAA0B;AAAA,EAG/B,YAAY,QAAyB;AACnC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAc,eACZ,QACA,aACA,YACA,SACkB;AAClB,UAAM,WAAW;AAAA,MACf,GAAG,QAAQ;AAAA,MACX,cAAc;AAAA,MACd,UAAU;AAAA,IACZ;AACA,WAAO,KAAK,OAAO,IAAI;AAAA,MACrB,GAAG;AAAA,MACH;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,cAAc,SAAuD;AACzE,WAAO,KAAK,eAAe,kBAAkB,SAAS,WAAW,OAAO;AAAA,EAC1E;AAAA,EAEA,MAAM,cAAc,SAAuD;AACzE,WAAO,KAAK,eAAe,kBAAkB,SAAS,WAAW,OAAO;AAAA,EAC1E;AAAA,EAEA,MAAM,aAAa,SAAuD;AACxE,WAAO,KAAK,eAAe,iBAAiB,SAAS,YAAY,OAAO;AAAA,EAC1E;AAAA,EAEA,MAAM,oBAAoB,SAAuD;AAC/E,WAAO,KAAK,eAAe,yBAAyB,SAAS,YAAY,OAAO;AAAA,EAClF;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,WAAO,KAAK,eAAe,eAAe,SAAS,WAAW,OAAO;AAAA,EACvE;AACF;AAKO,IAAM,iBAAN,MAAqB;AAAA,EAG1B,YAAY,QAAyB;AACnC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAc,SACZ,QACA,SACA,WACA,aACA,YACA,SACkB;AAClB,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG;AAAA,IACL,IAAI;AAEJ,UAAM,mBAAmB;AAAA,MACvB,GAAG;AAAA,MACH,GAAG;AAAA,MACH,WAAW;AAAA,MACX,aAAa;AAAA,MACb,cAAc;AAAA,MACd,UAAU;AAAA,IACZ;AAGA,WAAO,KAAK,OAAO;AAAA,MACjB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,SAMM;AACnB,WAAO,KAAK,SAAS,mBAAmB,cAAc,cAAc,SAAS,YAAY,OAAO;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,SAMM;AACnB,WAAO,KAAK,SAAS,kBAAkB,mBAAmB,cAAc,SAAS,YAAY,OAAO;AAAA,EACtG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,SAII;AACnB,WAAO,KAAK,SAAS,oBAAoB,cAAc,cAAc,SAAS,WAAW,OAAO;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,SAIO;AACnB,WAAO,KAAK,SAAS,iBAAiB,aAAa,cAAc,SAAS,YAAY,OAAO;AAAA,EAC/F;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,SAIO;AACnB,WAAO,KAAK,SAAS,iBAAiB,aAAa,cAAc,SAAS,YAAY,OAAO;AAAA,EAC/F;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,QAAQ,SAIO;AACnB,WAAO,KAAK,SAAS,iBAAiB,cAAc,WAAW,SAAS,YAAY,OAAO;AAAA,EAC7F;AACF;;;AD79BO,SAAS,cACd,QACA,SAC2D;AAC3D,SAAO,OAAO,KAAc,MAAW,CAAC,MAAM,SAAgB;AAC5D,UAAM,mBAAmB,gBAAgB,eAAe,GAAG;AAK3D,UAAM,YAAY,OAAO,YAAwB;AAC/C,aAAO,OAAO,IAAI;AAAA,QAChB,GAAG;AAAA,QACH,SAAS;AAAA,UACP,GAAG;AAAA,UACH,GAAG,QAAQ;AAAA,UACX,UAAU;AAAA,YACR,GAAG,iBAAiB;AAAA,YACpB,GAAI,QAAQ,SAAS,YAAY,CAAC;AAAA,UACpC;AAAA,UACA,QAAQ;AAAA,YACN,GAAG,iBAAiB;AAAA,YACpB,GAAI,QAAQ,SAAS,UAAU,CAAC;AAAA,UAClC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAUA,UAAM,cAAc,CAClB,QACA,aACA,YACA,YAEA,UAAU;AAAA,MACR,GAAG;AAAA,MACH;AAAA,MACA,UAAU;AAAA,QACR,GAAG,QAAQ;AAAA,QACX,cAAc;AAAA,QACd,UAAU;AAAA,MACZ;AAAA,IACF,CAAC;AAEH,UAAM,mBAAmB;AAAA,MACvB,eAAe,CAAC,MACd,YAAY,kBAAkB,SAAS,WAAW,CAAC;AAAA,MACrD,eAAe,CAAC,MACd,YAAY,kBAAkB,SAAS,WAAW,CAAC;AAAA,MACrD,cAAc,CAAC,MACb,YAAY,iBAAiB,SAAS,YAAY,CAAC;AAAA,MACrD,qBAAqB,CAAC,MACpB,YAAY,yBAAyB,SAAS,YAAY,CAAC;AAAA,MAC7D,YAAY,CAAC,MACX,YAAY,eAAe,SAAS,WAAW,CAAC;AAAA,IACpD;AAEA,UAAM,SAAS;AAAA,MACb,GAAG;AAAA,MACH,WAAW;AAAA,QACT,KAAK;AAAA,QACL,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO,QAAQ,KAAK,QAAQ,GAAG,IAAI;AAAA,EACrC;AACF;","names":[]}

package/dist/middleware/next.js

@@ -1,6 +1,6 @@
 import {
   withVolidator
-} from "../chunk-KEXIKZGN.js";
+} from "../chunk-UUUKNFQ6.js";
 import "../chunk-YI4DCCHT.js";
 export {
   withVolidator

package/dist/plugins/agent-langchain.cjs

@@ -0,0 +1,93 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/agent-langchain.ts
+var agent_langchain_exports = {};
+__export(agent_langchain_exports, {
+  VolidatorLangChainHandler: () => VolidatorLangChainHandler
+});
+module.exports = __toCommonJS(agent_langchain_exports);
+var VolidatorLangChainHandler = class {
+  constructor(client, config) {
+    this.runMap = /* @__PURE__ */ new Map();
+    this.client = client;
+    this.actor = config.actor;
+    this.tenant = config.tenant;
+  }
+  /**
+   * Called when a tool starts executing.
+   */
+  async handleToolStart(tool, input, runId) {
+    this.runMap.set(runId, {
+      toolName: tool.name || "unnamed_tool",
+      toolInput: { input },
+      startTime: Date.now()
+    });
+  }
+  /**
+   * Called when a tool finishes executing successfully.
+   */
+  async handleToolEnd(output, runId) {
+    const run = this.runMap.get(runId);
+    if (!run) return;
+    this.runMap.delete(runId);
+    const latencyMs = Date.now() - run.startTime;
+    try {
+      await this.client.agent.toolCall({
+        actor: this.actor,
+        tenant: this.tenant,
+        toolName: run.toolName,
+        toolInput: run.toolInput,
+        toolOutput: { output },
+        latencyMs,
+        success: true
+      });
+    } catch (e) {
+      console.warn("[Volidator] Failed to log toolCall in LangChain plugin", e);
+    }
+  }
+  /**
+   * Called when a tool execution fails with an error.
+   */
+  async handleToolError(err, runId) {
+    const run = this.runMap.get(runId);
+    if (!run) return;
+    this.runMap.delete(runId);
+    const latencyMs = Date.now() - run.startTime;
+    const errorMessage = err instanceof Error ? err.message : String(err);
+    try {
+      await this.client.agent.toolCall({
+        actor: this.actor,
+        tenant: this.tenant,
+        toolName: run.toolName,
+        toolInput: run.toolInput,
+        toolOutput: { error: errorMessage },
+        latencyMs,
+        success: false
+      });
+    } catch (e) {
+      console.warn("[Volidator] Failed to log toolCall error in LangChain plugin", e);
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  VolidatorLangChainHandler
+});
+//# sourceMappingURL=agent-langchain.cjs.map

package/dist/plugins/agent-langchain.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/plugins/agent-langchain.ts"],"sourcesContent":["import { VolidatorClient } from \"../index\";\n\n/**\n * Duck-typed interfaces to avoid runtime dependencies on LangChain core packages.\n */\nexport interface LangChainToolRun {\n  name: string;\n}\n\nexport interface LangChainHandlerConfig {\n  /** The actor identifier (e.g., usr_alice, research-agent) to log the event under */\n  actor: string;\n  /** Optional tenant identifier */\n  tenant?: string;\n}\n\n/**\n * VolidatorLangChainHandler\n * \n * A callback handler to automatically instrument LangChain tool calls and log them to Volidator.\n * Avoids memory leaks by cleanly disposing of run trace contexts using .delete(runId).\n */\nexport class VolidatorLangChainHandler {\n  private client: VolidatorClient;\n  private actor: string;\n  private tenant?: string;\n  private runMap = new Map<string, { toolName: string; toolInput: any; startTime: number }>();\n\n  constructor(client: VolidatorClient, config: LangChainHandlerConfig) {\n    this.client = client;\n    this.actor = config.actor;\n    this.tenant = config.tenant;\n  }\n\n  /**\n   * Called when a tool starts executing.\n   */\n  async handleToolStart(\n    tool: LangChainToolRun,\n    input: string,\n    runId: string\n  ): Promise<void> {\n    this.runMap.set(runId, {\n      toolName: tool.name || \"unnamed_tool\",\n      toolInput: { input },\n      startTime: Date.now(),\n    });\n  }\n\n  /**\n   * Called when a tool finishes executing successfully.\n   */\n  async handleToolEnd(output: string, runId: string): Promise<void> {\n    const run = this.runMap.get(runId);\n    if (!run) return;\n    this.runMap.delete(runId); // Prevent memory leaks\n\n    const latencyMs = Date.now() - run.startTime;\n    try {\n      await this.client.agent.toolCall({\n        actor: this.actor,\n        tenant: this.tenant,\n        toolName: run.toolName,\n        toolInput: run.toolInput,\n        toolOutput: { output },\n        latencyMs,\n        success: true,\n      });\n    } catch (e) {\n      console.warn(\"[Volidator] Failed to log toolCall in LangChain plugin\", e);\n    }\n  }\n\n  /**\n   * Called when a tool execution fails with an error.\n   */\n  async handleToolError(err: any, runId: string): Promise<void> {\n    const run = this.runMap.get(runId);\n    if (!run) return;\n    this.runMap.delete(runId); // Prevent memory leaks\n\n    const latencyMs = Date.now() - run.startTime;\n    const errorMessage = err instanceof Error ? err.message : String(err);\n    try {\n      await this.client.agent.toolCall({\n        actor: this.actor,\n        tenant: this.tenant,\n        toolName: run.toolName,\n        toolInput: run.toolInput,\n        toolOutput: { error: errorMessage },\n        latencyMs,\n        success: false,\n      });\n    } catch (e) {\n      console.warn(\"[Volidator] Failed to log toolCall error in LangChain plugin\", e);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAsBO,IAAM,4BAAN,MAAgC;AAAA,EAMrC,YAAY,QAAyB,QAAgC;AAFrE,SAAQ,SAAS,oBAAI,IAAqE;AAGxF,SAAK,SAAS;AACd,SAAK,QAAQ,OAAO;AACpB,SAAK,SAAS,OAAO;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBACJ,MACA,OACA,OACe;AACf,SAAK,OAAO,IAAI,OAAO;AAAA,MACrB,UAAU,KAAK,QAAQ;AAAA,MACvB,WAAW,EAAE,MAAM;AAAA,MACnB,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgB,OAA8B;AAChE,UAAM,MAAM,KAAK,OAAO,IAAI,KAAK;AACjC,QAAI,CAAC,IAAK;AACV,SAAK,OAAO,OAAO,KAAK;AAExB,UAAM,YAAY,KAAK,IAAI,IAAI,IAAI;AACnC,QAAI;AACF,YAAM,KAAK,OAAO,MAAM,SAAS;AAAA,QAC/B,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,QACf,YAAY,EAAE,OAAO;AAAA,QACrB;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,GAAG;AACV,cAAQ,KAAK,0DAA0D,CAAC;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,KAAU,OAA8B;AAC5D,UAAM,MAAM,KAAK,OAAO,IAAI,KAAK;AACjC,QAAI,CAAC,IAAK;AACV,SAAK,OAAO,OAAO,KAAK;AAExB,UAAM,YAAY,KAAK,IAAI,IAAI,IAAI;AACnC,UAAM,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACpE,QAAI;AACF,YAAM,KAAK,OAAO,MAAM,SAAS;AAAA,QAC/B,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,QACf,YAAY,EAAE,OAAO,aAAa;AAAA,QAClC;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,GAAG;AACV,cAAQ,KAAK,gEAAgE,CAAC;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}

package/dist/plugins/agent-langchain.d.cts

@@ -0,0 +1,41 @@
+import { VolidatorClient } from '../index.cjs';
+
+/**
+ * Duck-typed interfaces to avoid runtime dependencies on LangChain core packages.
+ */
+interface LangChainToolRun {
+    name: string;
+}
+interface LangChainHandlerConfig {
+    /** The actor identifier (e.g., usr_alice, research-agent) to log the event under */
+    actor: string;
+    /** Optional tenant identifier */
+    tenant?: string;
+}
+/**
+ * VolidatorLangChainHandler
+ *
+ * A callback handler to automatically instrument LangChain tool calls and log them to Volidator.
+ * Avoids memory leaks by cleanly disposing of run trace contexts using .delete(runId).
+ */
+declare class VolidatorLangChainHandler {
+    private client;
+    private actor;
+    private tenant?;
+    private runMap;
+    constructor(client: VolidatorClient, config: LangChainHandlerConfig);
+    /**
+     * Called when a tool starts executing.
+     */
+    handleToolStart(tool: LangChainToolRun, input: string, runId: string): Promise<void>;
+    /**
+     * Called when a tool finishes executing successfully.
+     */
+    handleToolEnd(output: string, runId: string): Promise<void>;
+    /**
+     * Called when a tool execution fails with an error.
+     */
+    handleToolError(err: any, runId: string): Promise<void>;
+}
+
+export { type LangChainHandlerConfig, type LangChainToolRun, VolidatorLangChainHandler };

package/dist/plugins/agent-langchain.d.ts

@@ -0,0 +1,41 @@
+import { VolidatorClient } from '../index.js';
+
+/**
+ * Duck-typed interfaces to avoid runtime dependencies on LangChain core packages.
+ */
+interface LangChainToolRun {
+    name: string;
+}
+interface LangChainHandlerConfig {
+    /** The actor identifier (e.g., usr_alice, research-agent) to log the event under */
+    actor: string;
+    /** Optional tenant identifier */
+    tenant?: string;
+}
+/**
+ * VolidatorLangChainHandler
+ *
+ * A callback handler to automatically instrument LangChain tool calls and log them to Volidator.
+ * Avoids memory leaks by cleanly disposing of run trace contexts using .delete(runId).
+ */
+declare class VolidatorLangChainHandler {
+    private client;
+    private actor;
+    private tenant?;
+    private runMap;
+    constructor(client: VolidatorClient, config: LangChainHandlerConfig);
+    /**
+     * Called when a tool starts executing.
+     */
+    handleToolStart(tool: LangChainToolRun, input: string, runId: string): Promise<void>;
+    /**
+     * Called when a tool finishes executing successfully.
+     */
+    handleToolEnd(output: string, runId: string): Promise<void>;
+    /**
+     * Called when a tool execution fails with an error.
+     */
+    handleToolError(err: any, runId: string): Promise<void>;
+}
+
+export { type LangChainHandlerConfig, type LangChainToolRun, VolidatorLangChainHandler };

package/dist/plugins/agent-langchain.js

@@ -0,0 +1,68 @@
+// src/plugins/agent-langchain.ts
+var VolidatorLangChainHandler = class {
+  constructor(client, config) {
+    this.runMap = /* @__PURE__ */ new Map();
+    this.client = client;
+    this.actor = config.actor;
+    this.tenant = config.tenant;
+  }
+  /**
+   * Called when a tool starts executing.
+   */
+  async handleToolStart(tool, input, runId) {
+    this.runMap.set(runId, {
+      toolName: tool.name || "unnamed_tool",
+      toolInput: { input },
+      startTime: Date.now()
+    });
+  }
+  /**
+   * Called when a tool finishes executing successfully.
+   */
+  async handleToolEnd(output, runId) {
+    const run = this.runMap.get(runId);
+    if (!run) return;
+    this.runMap.delete(runId);
+    const latencyMs = Date.now() - run.startTime;
+    try {
+      await this.client.agent.toolCall({
+        actor: this.actor,
+        tenant: this.tenant,
+        toolName: run.toolName,
+        toolInput: run.toolInput,
+        toolOutput: { output },
+        latencyMs,
+        success: true
+      });
+    } catch (e) {
+      console.warn("[Volidator] Failed to log toolCall in LangChain plugin", e);
+    }
+  }
+  /**
+   * Called when a tool execution fails with an error.
+   */
+  async handleToolError(err, runId) {
+    const run = this.runMap.get(runId);
+    if (!run) return;
+    this.runMap.delete(runId);
+    const latencyMs = Date.now() - run.startTime;
+    const errorMessage = err instanceof Error ? err.message : String(err);
+    try {
+      await this.client.agent.toolCall({
+        actor: this.actor,
+        tenant: this.tenant,
+        toolName: run.toolName,
+        toolInput: run.toolInput,
+        toolOutput: { error: errorMessage },
+        latencyMs,
+        success: false
+      });
+    } catch (e) {
+      console.warn("[Volidator] Failed to log toolCall error in LangChain plugin", e);
+    }
+  }
+};
+export {
+  VolidatorLangChainHandler
+};
+//# sourceMappingURL=agent-langchain.js.map

package/dist/plugins/agent-langchain.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/plugins/agent-langchain.ts"],"sourcesContent":["import { VolidatorClient } from \"../index\";\n\n/**\n * Duck-typed interfaces to avoid runtime dependencies on LangChain core packages.\n */\nexport interface LangChainToolRun {\n  name: string;\n}\n\nexport interface LangChainHandlerConfig {\n  /** The actor identifier (e.g., usr_alice, research-agent) to log the event under */\n  actor: string;\n  /** Optional tenant identifier */\n  tenant?: string;\n}\n\n/**\n * VolidatorLangChainHandler\n * \n * A callback handler to automatically instrument LangChain tool calls and log them to Volidator.\n * Avoids memory leaks by cleanly disposing of run trace contexts using .delete(runId).\n */\nexport class VolidatorLangChainHandler {\n  private client: VolidatorClient;\n  private actor: string;\n  private tenant?: string;\n  private runMap = new Map<string, { toolName: string; toolInput: any; startTime: number }>();\n\n  constructor(client: VolidatorClient, config: LangChainHandlerConfig) {\n    this.client = client;\n    this.actor = config.actor;\n    this.tenant = config.tenant;\n  }\n\n  /**\n   * Called when a tool starts executing.\n   */\n  async handleToolStart(\n    tool: LangChainToolRun,\n    input: string,\n    runId: string\n  ): Promise<void> {\n    this.runMap.set(runId, {\n      toolName: tool.name || \"unnamed_tool\",\n      toolInput: { input },\n      startTime: Date.now(),\n    });\n  }\n\n  /**\n   * Called when a tool finishes executing successfully.\n   */\n  async handleToolEnd(output: string, runId: string): Promise<void> {\n    const run = this.runMap.get(runId);\n    if (!run) return;\n    this.runMap.delete(runId); // Prevent memory leaks\n\n    const latencyMs = Date.now() - run.startTime;\n    try {\n      await this.client.agent.toolCall({\n        actor: this.actor,\n        tenant: this.tenant,\n        toolName: run.toolName,\n        toolInput: run.toolInput,\n        toolOutput: { output },\n        latencyMs,\n        success: true,\n      });\n    } catch (e) {\n      console.warn(\"[Volidator] Failed to log toolCall in LangChain plugin\", e);\n    }\n  }\n\n  /**\n   * Called when a tool execution fails with an error.\n   */\n  async handleToolError(err: any, runId: string): Promise<void> {\n    const run = this.runMap.get(runId);\n    if (!run) return;\n    this.runMap.delete(runId); // Prevent memory leaks\n\n    const latencyMs = Date.now() - run.startTime;\n    const errorMessage = err instanceof Error ? err.message : String(err);\n    try {\n      await this.client.agent.toolCall({\n        actor: this.actor,\n        tenant: this.tenant,\n        toolName: run.toolName,\n        toolInput: run.toolInput,\n        toolOutput: { error: errorMessage },\n        latencyMs,\n        success: false,\n      });\n    } catch (e) {\n      console.warn(\"[Volidator] Failed to log toolCall error in LangChain plugin\", e);\n    }\n  }\n}\n"],"mappings":";AAsBO,IAAM,4BAAN,MAAgC;AAAA,EAMrC,YAAY,QAAyB,QAAgC;AAFrE,SAAQ,SAAS,oBAAI,IAAqE;AAGxF,SAAK,SAAS;AACd,SAAK,QAAQ,OAAO;AACpB,SAAK,SAAS,OAAO;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBACJ,MACA,OACA,OACe;AACf,SAAK,OAAO,IAAI,OAAO;AAAA,MACrB,UAAU,KAAK,QAAQ;AAAA,MACvB,WAAW,EAAE,MAAM;AAAA,MACnB,WAAW,KAAK,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAAgB,OAA8B;AAChE,UAAM,MAAM,KAAK,OAAO,IAAI,KAAK;AACjC,QAAI,CAAC,IAAK;AACV,SAAK,OAAO,OAAO,KAAK;AAExB,UAAM,YAAY,KAAK,IAAI,IAAI,IAAI;AACnC,QAAI;AACF,YAAM,KAAK,OAAO,MAAM,SAAS;AAAA,QAC/B,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,QACf,YAAY,EAAE,OAAO;AAAA,QACrB;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,GAAG;AACV,cAAQ,KAAK,0DAA0D,CAAC;AAAA,IAC1E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,KAAU,OAA8B;AAC5D,UAAM,MAAM,KAAK,OAAO,IAAI,KAAK;AACjC,QAAI,CAAC,IAAK;AACV,SAAK,OAAO,OAAO,KAAK;AAExB,UAAM,YAAY,KAAK,IAAI,IAAI,IAAI;AACnC,UAAM,eAAe,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACpE,QAAI;AACF,YAAM,KAAK,OAAO,MAAM,SAAS;AAAA,QAC/B,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,QACf,YAAY,EAAE,OAAO,aAAa;AAAA,QAClC;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,GAAG;AACV,cAAQ,KAAK,gEAAgE,CAAC;AAAA,IAChF;AAAA,EACF;AACF;","names":[]}