@volidator/node 1.0.0

package/README.md

@@ -0,0 +1,518 @@
+# Volidator Node.js SDK
+
+**Zero-knowledge, server-blind audit logging for Node.js, Next.js, and edge runtimes.**
+
+Volidator encrypts every log entry locally — on your server — before sending it. The Volidator backend stores only ciphertext and blind indexes. Your plaintext data never leaves your infrastructure unencrypted.
+
+[![npm](https://img.shields.io/npm/v/@volidator/node)](https://www.npmjs.com/package/@volidator/node)
+[![license](https://img.shields.io/npm/l/@volidator/node)](LICENSE)
+
+---
+
+## What is Volidator?
+
+**Volidator** is the developer-first, zero-knowledge audit log infrastructure built for modern applications, enterprise B2B SaaS, and autonomous AI agents. By utilizing local AES-256-GCM encryption and blind indexing (HMAC-SHA-256) on your servers before ingestion, Volidator allows you to store, query, and stream audit trails without ever holding or exposing raw PII (Personally Identifiable Information) or sensitive activity data (though configurable if you want to host PII/PHI with us).
+
+---
+
+## Why Volidator? (Pain Points We Solve)
+
+Traditional logging tools force a dangerous compromise: either send raw customer data to a third-party logging vendor (creating security liabilities, compliance issues, and API keys leakage risks), or spend months building a custom, secure compliance database in-house.
+
+Volidator solves this with **Zero-Knowledge Audit Trails**:
+* **Enterprise Compliance in Minutes:** Unlocks enterprise-ready audit logging matching SOC 2 (CC6.x), ISO 27001 (A.12.4), HIPAA, and GDPR standards under 5 minutes.
+* **Zero Trust Security:** Even if Volidator's databases were compromised, hackers see only randomized ciphertext. Decryption keys live exclusively in your server environment variables and the user's browser hash fragments.
+* **AI Agent Action Auditing & Accountability:** Autonomous AI agents make decisions, run API calls, and modify databases. Volidator provides a tamper-proof ledger to trace exactly *which* agent tool was executed, *why* (LLM prompt/context), and *what* was modified, satisfying critical alignment and security monitoring requirements.
+* **Instant Customer-Facing Dashboards:** Embed fully-interactive, securely hydrated log tables inside your React frontends using our signed JIT tokens.
+
+---
+
+## Who is it for?
+
+* **B2B SaaS Engineering Teams:** Developers who need to provide enterprise tenants with search, filter, and CSV exports of system events.
+* **Security & Compliance Teams:** Organizations aiming to achieve security certifications without expanding their data privacy liability or telemetry footprint.
+* **AI & Agentic App Developers:** Builders establishing guardrails and debug logs for autonomous systems to audit agent decisions, LLM outputs, and automated tool calls.
+
+---
+
+## Table of Contents
+
+1. [Install](#1-install)
+2. [Environment Setup](#2-environment-setup)
+3. [Initialize the Client](#3-initialize-the-client)
+4. [Log an Event](#4-log-an-event)
+5. [Pass Request Context](#5-pass-request-context)
+6. [Telemetry Configuration](#6-telemetry-configuration)
+7. [PII Redaction](#7-pii-redaction)
+8. [JIT Hydration (referenceKeys)](#8-jit-hydration-referencekeys)
+9. [Keyring Rotation](#9-keyring-rotation)
+10. [Embed Token](#10-embed-token)
+11. [Compliance Helpers](#11-compliance-helpers)
+12. [Next.js Middleware](#12-nextjs-middleware)
+14. [`@volidator/react`](#14-volidatorreact)
+15. [AI Agent Auditing (VolidatorAgent)](#15-ai-agent-auditing-volidatoragent)
+16. [Batch Ingestion (logBatch)](#16-batch-ingestion-logbatch)
+
+---
+
+## 1. Install
+
+```bash
+npm install @volidator/node
+```
+
+---
+
+## 2. Environment Setup
+
+Store secrets as environment variables. Never hardcode them.
+
+```bash
+# Authenticates your server with the Volidator ingestion endpoint
+VOLIDATOR_API_KEY="val_live_xxxxxxxx..."
+
+# AES-256-GCM encryption key — your data is encrypted with this before leaving your server
+VOLIDATOR_ENCRYPTION_KEY="vol-dek-xxxxxxxx..."
+```
+
+---
+
+## 3. Initialize the Client
+
+Create **one instance** per application and reuse it. Do not instantiate per-request.
+
+```typescript
+import { VolidatorClient } from "@volidator/node";
+
+export const volidator = new VolidatorClient({
+  apiKey: process.env.VOLIDATOR_API_KEY!,
+  encryptionKey: process.env.VOLIDATOR_ENCRYPTION_KEY!,
+});
+```
+
+---
+
+## 4. Log an Event
+
+```typescript
+await volidator.log({
+  actor: "usr_12345",              // Who performed the action
+  action: "user.login.success",   // What happened (use dot notation)
+  target: "workspace_abc789",     // What was affected
+  metadata: {
+    deviceName: "MacBook Pro",
+    authProvider: "Google OAuth",
+  },
+});
+```
+
+`log()` returns `true` if the event was accepted, `false` if delivery failed. It never throws — failures are swallowed and logged to `console.error`.
+
+---
+
+## 5. Pass Request Context
+
+Pass your framework's `Request` object directly. The SDK extracts IP, User-Agent, and geolocation headers automatically.
+
+```typescript
+// Next.js App Router / Cloudflare Workers / Express
+await volidator.log({
+  actor: session.userId,
+  action: "settings.update",
+  req: request,  // Web API Request or Node.js IncomingMessage
+  metadata: { fieldChanged: "email_address" },
+});
+```
+
+Supported request formats:
+- `Request` — Next.js App Router, Cloudflare Workers, Bun
+- `IncomingMessage` — Node.js `http`, Express, Fastify
+
+---
+
+## 6. Telemetry Configuration
+
+Control how IP, User-Agent, and location data are handled. Choose a preset, then override individual fields as needed.
+
+| Preset | IP | User-Agent | Location |
+|---|---|---|---|
+| `"strict"` | skip | skip | disabled |
+| `"standard"` *(default)* | anonymized (hashed) | parsed to browser/OS | country + region |
+| `"full"` | stored as-is | stored as-is | country + region + city |
+
+```typescript
+const volidator = new VolidatorClient({
+  apiKey: process.env.VOLIDATOR_API_KEY!,
+  encryptionKey: process.env.VOLIDATOR_ENCRYPTION_KEY!,
+  telemetry: {
+    preset: "standard",      // baseline
+    ip: "skip",              // override: don't store IP at all
+    location: false,         // override: disable geolocation
+  },
+});
+```
+
+---
+
+## 7. PII Redaction
+
+For fields containing sensitive data that should never be stored — even in encrypted form — use `redactKeys`. The value is replaced with `[REDACTED:fieldName]` **before** encryption.
+
+```typescript
+const volidator = new VolidatorClient({
+  apiKey: process.env.VOLIDATOR_API_KEY!,
+  encryptionKey: process.env.VOLIDATOR_ENCRYPTION_KEY!,
+  redactKeys: ["actor", "metadata.socialSecurityNumber", "metadata.email"],
+});
+```
+
+Supported key patterns:
+- `"actor"` — the top-level actor field
+- `"target"` — the top-level target field  
+- `"metadata.fieldName"` — any metadata field by name
+
+> **Blind indexes are still computed from the original value before redaction**, so the Volidator dashboard can still filter and search by actor/target even after redaction.
+
+---
+
+## 8. JIT Hydration (`referenceKeys`)
+
+JIT (Just-In-Time) Hydration lets you store a **non-sensitive reference ID** instead of PII, while preserving full dashboard display names. PII never reaches Volidator's servers.
+
+When you configure `referenceKeys`, you pass fields as `{ id, pii }` objects:
+- `id` — the internal identifier stored as `[REF:id]` in the encrypted log
+- `pii` — the real value used **only** to compute the blind index, then discarded
+
+The dashboard resolves `[REF:id]` to a display name at render time by sending a `postMessage` request back to your application. See the [`@volidator/react`](#14-volidatorreact) section for the client-side hook.
+
+```typescript
+const volidator = new VolidatorClient({
+  apiKey: process.env.VOLIDATOR_API_KEY!,
+  encryptionKey: process.env.VOLIDATOR_ENCRYPTION_KEY!,
+  referenceKeys: ["actor"],
+});
+
+await volidator.log({
+  // Pass { id, pii } for any field in referenceKeys
+  actor: { id: "usr_890", pii: "alice@company.com" },
+  action: "document.deleted",
+  target: "doc_4521",
+});
+// Stored: actor = "[REF:usr_890]"
+// Blind index computed from "alice@company.com" — search still works
+```
+
+`referenceKeys` and `redactKeys` can coexist. If a field is in both, `referenceKeys` takes precedence.
+
+→ [Full JIT Hydration guide](https://docs.volidator.com/guides/jit-hydration/)
+
+---
+
+## 9. Keyring Rotation
+
+Rotate your encryption key without re-encrypting historical logs. Provide a `keyring` (all active key versions) and `activeEncryptionKeyId` (the key used for new writes). Old logs are decrypted with whichever key was active when they were written.
+
+```typescript
+const volidator = new VolidatorClient({
+  apiKey: process.env.VOLIDATOR_API_KEY!,
+  keyring: {
+    v1: process.env.VOLIDATOR_KEY_V1!,  // old — decrypts historical logs
+    v2: process.env.VOLIDATOR_KEY_V2!,  // new — encrypts all new writes
+  },
+  activeEncryptionKeyId: "v2",
+});
+```
+
+Constraints:
+- Keyring size is capped at **5 keys** (security + performance bound).
+- `activeEncryptionKeyId` must be present in the `keyring` object.
+
+---
+
+## 10. Embed Token
+
+Generate a signed JWT that scopes the embeddable dashboard widget to a specific actor, target, or tenant. This is called server-side; the returned `embedUrl` is dropped directly into an `<iframe>`.
+
+```typescript
+const volidator = new VolidatorClient({
+  apiKey: process.env.VOLIDATOR_API_KEY!,
+  encryptionKey: process.env.VOLIDATOR_ENCRYPTION_KEY!,
+  // Required for generateEmbedToken():
+  projectId: process.env.VOLIDATOR_PROJECT_ID!,
+  clientSecret: process.env.VOLIDATOR_CLIENT_SECRET!,
+});
+
+const { embedUrl } = await volidator.generateEmbedToken({
+  actorId: session.userId,          // Scope to this actor's logs
+  scope: "actor",                   // "actor" | "target" | "tenant" | "all" | "auditor"
+  expiresIn: "1h",                  // Max: 1h for actor/target/tenant; 7d for auditor
+  hostOrigin: "https://app.yourcompany.com",  // Enables strict postMessage origin validation
+  view: {
+    columns: ["actor", "action", "metadata.ipAddress", "createdAt"],
+    defaultFilter: { action: "user.login" },
+  },
+});
+
+// In your API route response:
+return Response.json({ embedUrl });
+```
+
+```tsx
+// In your React component:
+<iframe src={embedUrl} width="100%" height="600" />
+```
+
+---
+
+## 11. Compliance Helpers
+
+`volidator.compliance` provides pre-tagged methods for common SOC 2 and ISO 27001 audit events. Each method automatically appends the correct `soc2_control` and `iso27001` keys to the log metadata.
+
+```typescript
+// Access provisioning
+await volidator.compliance.accessGranted({ actor: "admin_01", target: "usr_890" });
+await volidator.compliance.accessRevoked({ actor: "admin_01", target: "usr_890" });
+
+// Data movement
+await volidator.compliance.dataExported({
+  actor: "usr_123",
+  metadata: { exportFormat: "csv", rowCount: 5420 },
+});
+
+// System changes
+await volidator.compliance.systemConfigChanged({
+  actor: "usr_123",
+  metadata: { setting: "mfa_enforcement", newValue: "required" },
+});
+
+// Authentication
+await volidator.compliance.mfaEnabled({ actor: "usr_890" });
+```
+
+| Method | Action stored | SOC 2 | ISO 27001 |
+|---|---|---|---|
+| `accessGranted` | `access.granted` | CC6.1 | A.9.2.1 |
+| `accessRevoked` | `access.revoked` | CC6.1 | A.9.2.6 |
+| `dataExported` | `data.exported` | CC6.6 | A.12.4.1 |
+| `systemConfigChanged` | `system.config_changed` | CC6.2 | A.12.1.2 |
+| `mfaEnabled` | `mfa.enabled` | CC6.3 | A.9.4.2 |
+
+---
+
+## 12. Next.js Middleware
+
+The `withVolidator` wrapper injects a request-scoped `volidator` object into every Next.js App Router handler. It automatically extracts IP, User-Agent, and geolocation from the incoming request and merges it into every `log()` and `compliance.*()` call — no manual `req` passing needed.
+
+```typescript
+import { withVolidator } from "@volidator/node/next";
+import { volidator } from "@/lib/volidator";
+
+export const POST = withVolidator(volidator, async (req: Request, ctx) => {
+  await ctx.volidator.log({
+    actor: session.userId,
+    action: "invoice.created",
+    target: invoiceId,
+  });
+
+  // Compliance methods also receive full telemetry context:
+  await ctx.volidator.compliance.dataExported({ actor: session.userId });
+
+  return Response.json({ ok: true });
+});
+```
+
+---
+
+## 13. Auth Plugins
+
+Auth plugins extend `withVolidator` to automatically inject the authenticated user's ID as `actor` on every log call.
+
+### Clerk
+
+```typescript
+import { createClerkAudit } from "@volidator/node/clerk";
+import { auth } from "@clerk/nextjs/server";
+import { volidator } from "@/lib/volidator";
+
+const withClerkAudit = createClerkAudit({ client: volidator, getAuth: auth });
+
+export const DELETE = withClerkAudit(async (req: Request, ctx) => {
+  // ctx.session — Clerk session object
+  // actor is automatically set to ctx.session.userId
+  await ctx.volidator.log({ action: "record.deleted", target: recordId });
+  return Response.json({ ok: true });
+});
+```
+
+### Universal (Auth0, NextAuth, BetterAuth, Kinde, Supabase, ...)
+
+```typescript
+import { createUniversalAudit } from "@volidator/node/universal";
+import { getServerSession } from "next-auth";
+import { volidator } from "@/lib/volidator";
+
+const withAudit = createUniversalAudit({
+  client: volidator,
+  getSession: (req) => getServerSession(),
+  getUserId: (req, session) => session?.user?.id,
+  // Optionally inject extra metadata into every log call:
+  getMetadata: (req, session) => ({ userEmail: session?.user?.email }),
+});
+
+export const PUT = withAudit(async (req: Request, ctx) => {
+  await ctx.volidator.log({ action: "profile.updated" });
+  return Response.json({ ok: true });
+});
+```
+
+---
+
+## 14. `@volidator/react`
+
+The `@volidator/react` package provides the `useVolidatorHydration` hook, which manages the JIT Hydration postMessage handshake between your application and the Volidator embed iframe.
+
+```bash
+npm install @volidator/react
+```
+
+```tsx
+import { useRef } from "react";
+import { useVolidatorHydration } from "@volidator/react";
+
+export function AuditLogPage({ embedUrl }: { embedUrl: string }) {
+  const iframeRef = useRef<HTMLIFrameElement>(null);
+
+  useVolidatorHydration({
+    iframeRef,
+    volidatorOrigin: "https://dash.volidator.com",
+    resolveActors: async (ids) => {
+      // Called with a deduplicated batch of reference IDs from decrypted logs.
+      // Return a map of id → { name, avatarUrl? }.
+      const res = await fetch("/api/users/resolve", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ ids }),
+      });
+      return res.json();
+    },
+  });
+
+  return <iframe ref={iframeRef} src={embedUrl} width="100%" height="600" />;
+}
+```
+
+The hook:
+1. Listens for `VOLIDATOR_RESOLVE_ACTORS` messages from the iframe.
+2. Validates `event.origin` strictly against `volidatorOrigin` (wildcard `"*"` is not accepted).
+3. Calls `resolveActors(ids)` with only the IDs not already in the local cache.
+4. Posts the resolution map back into the iframe as `VOLIDATOR_RESOLVE_RESPONSE`.
+5. Cleans up the event listener on component unmount.
+
+→ [Full JIT Hydration guide](https://docs.volidator.com/guides/jit-hydration/)
+
+---
+
+## 15. AI Agent Auditing (`VolidatorAgent`)
+
+Volidator provides a specialized compliance logging namespace tailored for autonomous AI systems, LLMs, and multi-agent chains. Access these methods via `volidator.agent.*`.
+
+Every call automatically appends the correct mapping metadata for **EU AI Act compliance**, **NIST AI RMF guidelines**, **SOC 2**, and **ISO 27001**.
+
+```typescript
+// 1. Log an agent tool call or external API request
+await volidator.agent.toolCall({
+  actor: "writer-agent-v1",
+  traceId: runId,
+  spanId: spanId,
+  toolName: "fetch_news",
+  toolInput: { topic: "AI Act updates" },
+  toolOutput: { results: ["..." ] },
+  success: true,
+  latencyMs: 140,
+});
+
+// 2. Log an autonomous decision made by the model
+await volidator.agent.decision({
+  actor: "writer-agent-v1",
+  traceId: runId,
+  decision: "publish_article",
+  rationale: "article scoring passed verification checks",
+  confidenceScore: 0.96,
+  modelId: "claude-3-5-sonnet",
+});
+
+// 3. Request human oversight/escalation (EU AI Act Article 14)
+await volidator.agent.escalation({
+  actor: "writer-agent-v1",
+  traceId: runId,
+  reason: "article output score fell below threshold",
+  urgency: "medium",
+  blockedAction: "auto_publish",
+});
+
+// 4. Log suspected anomalies, injections, or system security events
+await volidator.agent.anomaly({
+  actor: "guardrail-shield",
+  traceId: runId,
+  description: "jailbreak prompt pattern detected in input stream",
+  severity: "critical",
+  anomalyType: "prompt_injection",
+});
+
+// 5. Log a model refusal based on safety alignment rules
+await volidator.agent.refusal({
+  actor: "writer-agent-v1",
+  traceId: runId,
+  refusedInstruction: "write code to extract system logs",
+  reason: "corporate security policy alignment violation",
+});
+
+// 6. Log execution context handoffs in multi-agent workflows
+await volidator.agent.handoff({
+  actor: "orchestrator",
+  toAgentId: "designer-agent-v1",
+  instruction: "generate banner image matching text outline",
+  agentContext: { prompt: "neon style workspace banner" },
+});
+```
+
+### Trace Correlation (OpenTelemetry Compatibility)
+
+Pass standard trace metadata (`traceId`, `spanId`, `parentSpanId`) to map out parent-child relationships and causality graphs between agent steps.
+
+Volidator parses W3C `traceparent` headers automatically when you pass a request object. Telemetry contexts emitted by LangChain, LlamaIndex, or standard instrumentations are inherited without manual piping:
+
+```typescript
+await volidator.agent.toolCall({
+  req: request, // Automatically extracts traceId/spanId from incoming headers
+  toolName: "database_write",
+  success: true,
+});
+```
+
+---
+
+## 16. Batch Ingestion (`logBatch`)
+
+For high-throughput runtimes (like agents executing iterative reasoning loops or massive data imports), use `logBatch` to prepare and send multiple logs in a single HTTP request.
+
+All cryptographic preparation (AES-256-GCM encryption, blind indexing) runs in parallel on the client before a single POST request is made.
+
+```typescript
+const logs = [
+  { actor: "agent-1", action: "thought", metadata: { step: 1 } },
+  { actor: "agent-1", action: "tool_call", metadata: { toolName: "search" } },
+  { actor: "agent-1", action: "thought", metadata: { step: 2 } },
+];
+
+const { accepted, rejected } = await volidator.logBatch(logs);
+console.log(`Successfully ingested ${accepted} logs, failed to prepare ${rejected}`);
+```
+
+*Maximum batch size is 100 entries per request.*
+
+---
+
+## License
+
+MIT © Volidator Contributors

package/dist/chunk-KEXIKZGN.js

@@ -0,0 +1,56 @@
+import {
+  VolidatorClient
+} from "./chunk-YI4DCCHT.js";
+
+// src/middleware/next.ts
+function withVolidator(client, handler) {
+  return async (req, ctx = {}, ...args) => {
+    const extractedContext = VolidatorClient.extractContext(req);
+    const scopedLog = async (payload) => {
+      return client.log({
+        ...payload,
+        context: {
+          ...extractedContext,
+          ...payload.context,
+          location: {
+            ...extractedContext.location,
+            ...payload.context?.location || {}
+          },
+          device: {
+            ...extractedContext.device,
+            ...payload.context?.device || {}
+          }
+        }
+      });
+    };
+    const withControl = (action, soc2Control, isoControl, payload) => scopedLog({
+      ...payload,
+      action,
+      metadata: {
+        ...payload.metadata,
+        soc2_control: soc2Control,
+        iso27001: isoControl
+      }
+    });
+    const scopedCompliance = {
+      accessRevoked: (p) => withControl("access.revoked", "CC6.1", "A.9.2.6", p),
+      accessGranted: (p) => withControl("access.granted", "CC6.1", "A.9.2.1", p),
+      dataExported: (p) => withControl("data.exported", "CC6.6", "A.12.4.1", p),
+      systemConfigChanged: (p) => withControl("system.config_changed", "CC6.2", "A.12.1.2", p),
+      mfaEnabled: (p) => withControl("mfa.enabled", "CC6.3", "A.9.4.2", p)
+    };
+    const newCtx = {
+      ...ctx,
+      volidator: {
+        log: scopedLog,
+        compliance: scopedCompliance
+      }
+    };
+    return handler(req, newCtx, ...args);
+  };
+}
+
+export {
+  withVolidator
+};
+//# sourceMappingURL=chunk-KEXIKZGN.js.map

package/dist/chunk-KEXIKZGN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/middleware/next.ts"],"sourcesContent":["import { VolidatorClient, LogPayload } from \"../index\";\n\n/**\n * Next.js App Router Middleware for Volidator.\n * Automatically extracts telemetry context (IP, User Agent, Location)\n * from the Next.js standard Request object and injects it into every\n * `volidator.log()` and `volidator.compliance.*()` call made inside\n * the wrapped handler.\n */\nexport function withVolidator<T extends Function>(client: VolidatorClient, handler: T) {\n  return async (req: Request, ctx: any = {}, ...args: any[]) => {\n    const extractedContext = VolidatorClient.extractContext(req);\n\n    // ---------------------------------------------------------------------------\n    // Scoped log — merges request-level IP/UA context into every log call.\n    // ---------------------------------------------------------------------------\n    const scopedLog = async (payload: LogPayload) => {\n      return client.log({\n        ...payload,\n        context: {\n          ...extractedContext,\n          ...payload.context,\n          location: {\n            ...extractedContext.location,\n            ...(payload.context?.location || {}),\n          },\n          device: {\n            ...extractedContext.device,\n            ...(payload.context?.device || {}),\n          },\n        },\n      });\n    };\n\n    // ---------------------------------------------------------------------------\n    // Scoped compliance — mirrors VolidatorCompliance but routes through\n    // scopedLog so that IP/UA telemetry is preserved in compliance events.\n    //\n    // Previously this passed client.compliance directly, which called\n    // client.log() without the request context — silently dropping telemetry\n    // from every compliance audit event.\n    // ---------------------------------------------------------------------------\n    const withControl = (\n      action: string,\n      soc2Control: string,\n      isoControl: string,\n      payload: Omit<LogPayload, \"action\">\n    ) =>\n      scopedLog({\n        ...payload,\n        action,\n        metadata: {\n          ...payload.metadata,\n          soc2_control: soc2Control,\n          iso27001: isoControl,\n        },\n      });\n\n    const scopedCompliance = {\n      accessRevoked: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"access.revoked\", \"CC6.1\", \"A.9.2.6\", p),\n      accessGranted: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"access.granted\", \"CC6.1\", \"A.9.2.1\", p),\n      dataExported: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"data.exported\", \"CC6.6\", \"A.12.4.1\", p),\n      systemConfigChanged: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"system.config_changed\", \"CC6.2\", \"A.12.1.2\", p),\n      mfaEnabled: (p: Omit<LogPayload, \"action\">) =>\n        withControl(\"mfa.enabled\", \"CC6.3\", \"A.9.4.2\", p),\n    };\n\n    const newCtx = {\n      ...ctx,\n      volidator: {\n        log: scopedLog,\n        compliance: scopedCompliance,\n      },\n    };\n\n    return handler(req, newCtx, ...args);\n  };\n}\n"],"mappings":";;;;;AASO,SAAS,cAAkC,QAAyB,SAAY;AACrF,SAAO,OAAO,KAAc,MAAW,CAAC,MAAM,SAAgB;AAC5D,UAAM,mBAAmB,gBAAgB,eAAe,GAAG;AAK3D,UAAM,YAAY,OAAO,YAAwB;AAC/C,aAAO,OAAO,IAAI;AAAA,QAChB,GAAG;AAAA,QACH,SAAS;AAAA,UACP,GAAG;AAAA,UACH,GAAG,QAAQ;AAAA,UACX,UAAU;AAAA,YACR,GAAG,iBAAiB;AAAA,YACpB,GAAI,QAAQ,SAAS,YAAY,CAAC;AAAA,UACpC;AAAA,UACA,QAAQ;AAAA,YACN,GAAG,iBAAiB;AAAA,YACpB,GAAI,QAAQ,SAAS,UAAU,CAAC;AAAA,UAClC;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAUA,UAAM,cAAc,CAClB,QACA,aACA,YACA,YAEA,UAAU;AAAA,MACR,GAAG;AAAA,MACH;AAAA,MACA,UAAU;AAAA,QACR,GAAG,QAAQ;AAAA,QACX,cAAc;AAAA,QACd,UAAU;AAAA,MACZ;AAAA,IACF,CAAC;AAEH,UAAM,mBAAmB;AAAA,MACvB,eAAe,CAAC,MACd,YAAY,kBAAkB,SAAS,WAAW,CAAC;AAAA,MACrD,eAAe,CAAC,MACd,YAAY,kBAAkB,SAAS,WAAW,CAAC;AAAA,MACrD,cAAc,CAAC,MACb,YAAY,iBAAiB,SAAS,YAAY,CAAC;AAAA,MACrD,qBAAqB,CAAC,MACpB,YAAY,yBAAyB,SAAS,YAAY,CAAC;AAAA,MAC7D,YAAY,CAAC,MACX,YAAY,eAAe,SAAS,WAAW,CAAC;AAAA,IACpD;AAEA,UAAM,SAAS;AAAA,MACb,GAAG;AAAA,MACH,WAAW;AAAA,QACT,KAAK;AAAA,QACL,YAAY;AAAA,MACd;AAAA,IACF;AAEA,WAAO,QAAQ,KAAK,QAAQ,GAAG,IAAI;AAAA,EACrC;AACF;","names":[]}