@volidator/node 1.0.0

package/dist/plugins/universal.cjs

@@ -0,0 +1,774 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/plugins/universal.ts
+var universal_exports = {};
+__export(universal_exports, {
+  createUniversalAudit: () => createUniversalAudit
+});
+module.exports = __toCommonJS(universal_exports);
+
+// src/index.ts
+var VolidatorClient = class _VolidatorClient {
+  constructor(config) {
+    this.apiKey = config.apiKey;
+    this.endpoint = config.endpoint || "https://ingestion.volidator.com";
+    this.projectId = config.projectId;
+    this.clientSecret = config.clientSecret;
+    this.redactKeys = config.redactKeys || [];
+    this.referenceKeys = config.referenceKeys || [];
+    this.maxMetadataSize = config.maxMetadataSize || 10240;
+    if (config.keyring && config.activeEncryptionKeyId) {
+      this.keyring = config.keyring;
+      this.activeKeyId = config.activeEncryptionKeyId;
+    } else if (config.encryptionKey) {
+      this.activeKeyId = "v1";
+      this.keyring = { "v1": config.encryptionKey };
+    } else {
+      throw new Error("Either encryptionKey OR (keyring AND activeEncryptionKeyId) must be provided in VolidatorClient constructor.");
+    }
+    if (Object.keys(this.keyring).length > 5) {
+      throw new Error("Keyring size cannot exceed 5 keys.");
+    }
+    if (!this.keyring[this.activeKeyId]) {
+      throw new Error(`Active key ID '${this.activeKeyId}' must exist in the keyring.`);
+    }
+    this.hashedKeyring = {};
+    this.telemetryConfig = _VolidatorClient.resolveTelemetryConfig(config.telemetry || { preset: "standard" });
+    this.compliance = new VolidatorCompliance(this);
+    this.agent = new VolidatorAgent(this);
+  }
+  // ---------------------------------------------------------------------------
+  // Telemetry Context Parser (Zero-latency header parsing)
+  // ---------------------------------------------------------------------------
+  static extractContext(req) {
+    const getHeader = (name) => {
+      if (!req) return "";
+      if (typeof req.headers?.get === "function") {
+        return req.headers.get(name) || "";
+      }
+      if (req.headers && typeof req.headers === "object") {
+        return req.headers[name] || req.headers[name.toLowerCase()] || "";
+      }
+      return "";
+    };
+    const rawIp = getHeader("cf-connecting-ip") || getHeader("x-real-ip") || getHeader("x-forwarded-for");
+    const ip = rawIp ? rawIp.split(",")[0].trim() : req?.socket?.remoteAddress || "";
+    const userAgent = getHeader("user-agent");
+    return {
+      ip,
+      userAgent,
+      location: {
+        country: getHeader("cf-ipcountry") || getHeader("x-vercel-ip-country") || "",
+        region: getHeader("cf-region-code") || getHeader("x-vercel-ip-country-region") || "",
+        city: getHeader("cf-ipcity") || getHeader("x-vercel-ip-city") || ""
+      }
+    };
+  }
+  // ---------------------------------------------------------------------------
+  // OpenTelemetry W3C traceparent context parser
+  // ---------------------------------------------------------------------------
+  static extractTraceContext(req) {
+    if (!req) return {};
+    const getHeader = (name) => {
+      if (typeof req.headers?.get === "function") {
+        return req.headers.get(name) || "";
+      }
+      if (req.headers && typeof req.headers === "object") {
+        return req.headers[name] || req.headers[name.toLowerCase()] || "";
+      }
+      return "";
+    };
+    const traceparent = getHeader("traceparent");
+    if (!traceparent) return {};
+    const parts = traceparent.split("-");
+    if (parts.length !== 4) return {};
+    return { traceId: parts[1], spanId: parts[2] };
+  }
+  static resolveTelemetryConfig(config) {
+    const preset = config.preset || "standard";
+    let ip = "anonymize";
+    let userAgent = "parse";
+    let location = true;
+    if (preset === "strict") {
+      ip = "skip";
+      userAgent = "skip";
+      location = false;
+    } else if (preset === "full") {
+      ip = "track";
+      userAgent = "track";
+      location = true;
+    }
+    if (config.ip !== void 0) ip = config.ip;
+    if (config.userAgent !== void 0) userAgent = config.userAgent;
+    if (config.location !== void 0) location = config.location;
+    return { ip, userAgent, location };
+  }
+  parseUserAgent(ua) {
+    let browser = "Unknown Browser";
+    let os = "Unknown OS";
+    let type = "Desktop";
+    if (/Volidator-Ingest-Worker/i.test(ua)) {
+      return {
+        browser: "Volidator Ingest Worker",
+        os: "Linux Server",
+        type: "Server"
+      };
+    }
+    if (/mobile/i.test(ua)) {
+      type = "Mobile";
+    } else if (/tablet|ipad/i.test(ua)) {
+      type = "Tablet";
+    } else if (/server|bot/i.test(ua)) {
+      type = "Server";
+    }
+    if (/chrome|crios/i.test(ua) && !/edge|edg/i.test(ua) && !/opr/i.test(ua)) {
+      const match = ua.match(/(?:chrome|crios)\/([0-9\.]+)/i);
+      browser = `Chrome ${match ? match[1].split(".")[0] : ""}`.trim();
+    } else if (/safari/i.test(ua) && !/chrome|crios/i.test(ua) && !/android/i.test(ua)) {
+      browser = /mobile/i.test(ua) ? "Safari Mobile" : "Safari";
+    } else if (/firefox|fxios/i.test(ua)) {
+      browser = "Firefox";
+    } else if (/edge|edg/i.test(ua)) {
+      browser = "Edge";
+    }
+    if (/windows/i.test(ua)) {
+      os = "Windows";
+    } else if (/macintosh|mac os x/i.test(ua)) {
+      os = "macOS";
+    } else if (/iphone|ipad|ipod/i.test(ua)) {
+      os = "iOS";
+    } else if (/android/i.test(ua)) {
+      os = "Android";
+    } else if (/linux/i.test(ua)) {
+      os = "Linux";
+    }
+    return { browser, os, type };
+  }
+  // ---------------------------------------------------------------------------
+  // Blind Index & Key Hashing (WebCrypto)
+  // ---------------------------------------------------------------------------
+  async _getHashedKey(id) {
+    if (this.hashedKeyring[id]) return this.hashedKeyring[id];
+    const rawKey = this.keyring[id];
+    const buf = new TextEncoder().encode(rawKey);
+    const hash = await globalThis.crypto.subtle.digest("SHA-256", buf);
+    this.hashedKeyring[id] = new Uint8Array(hash);
+    return this.hashedKeyring[id];
+  }
+  async generateBlindIndex(value, keyBuffer) {
+    const key = await globalThis.crypto.subtle.importKey(
+      "raw",
+      keyBuffer,
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const signature = await globalThis.crypto.subtle.sign(
+      "HMAC",
+      key,
+      new TextEncoder().encode(value)
+    );
+    return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  // ---------------------------------------------------------------------------
+  // Payload Encryption — AES-256-GCM with prepended 12-byte IV
+  // Layout: [IV (12B)] [Ciphertext] [Auth Tag (16B)]
+  // ---------------------------------------------------------------------------
+  async encryptPayload(payload) {
+    const text = JSON.stringify(payload);
+    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+    const activeHashedKey = await this._getHashedKey(this.activeKeyId);
+    const cryptoKey = await globalThis.crypto.subtle.importKey(
+      "raw",
+      activeHashedKey,
+      { name: "AES-GCM" },
+      false,
+      ["encrypt"]
+    );
+    const encryptedBuffer = await globalThis.crypto.subtle.encrypt(
+      { name: "AES-GCM", iv },
+      cryptoKey,
+      new TextEncoder().encode(text)
+    );
+    const finalBuffer = new Uint8Array(iv.length + encryptedBuffer.byteLength);
+    finalBuffer.set(iv, 0);
+    finalBuffer.set(new Uint8Array(encryptedBuffer), iv.length);
+    let binary = "";
+    const len = finalBuffer.byteLength;
+    for (let i = 0; i < len; i++) {
+      binary += String.fromCharCode(finalBuffer[i]);
+    }
+    const base64 = btoa(binary);
+    return `${this.activeKeyId}:${base64}`;
+  }
+  // ---------------------------------------------------------------------------
+  // prepareLogEntry() — Prepares, redacts, and encrypts a single log entry payload
+  // ---------------------------------------------------------------------------
+  async prepareLogEntry(payload, maxMetaOverride) {
+    const actorRaw = payload.actor || payload.actorId || "unknown";
+    const targetRaw = payload.target || payload.targetId || "unknown";
+    const tenantRaw = payload.tenant || payload.tenantId || "";
+    const truncate = (str, maxLen) => {
+      if (str.length > maxLen) {
+        return str.slice(0, maxLen) + "...";
+      }
+      return str;
+    };
+    const extractPii = (v) => typeof v === "object" ? v.pii : v;
+    const extractId = (v) => typeof v === "object" ? v.id : v;
+    const actor = truncate(extractPii(actorRaw), 255);
+    const target = truncate(extractPii(targetRaw), 255);
+    const tenant = tenantRaw ? truncate(extractPii(tenantRaw), 255) : "";
+    const action = truncate(payload.action, 255);
+    const logTelemetry = payload.telemetry ? _VolidatorClient.resolveTelemetryConfig({ ...this.telemetryConfig, ...payload.telemetry }) : this.telemetryConfig;
+    let payloadCtx = payload.context || {};
+    if (payload.req) {
+      const extracted = _VolidatorClient.extractContext(payload.req);
+      payloadCtx = {
+        ...extracted,
+        ...payloadCtx,
+        location: {
+          ...extracted.location,
+          ...payloadCtx.location
+        },
+        device: {
+          ...extracted.device,
+          ...payloadCtx.device
+        }
+      };
+    }
+    const context = {};
+    const rawIp = payloadCtx.ip || "";
+    const rawUa = payloadCtx.userAgent || "";
+    if (logTelemetry.location) {
+      context.location = {};
+      if (payloadCtx.location) {
+        context.location.country = payloadCtx.location.country || "";
+        context.location.region = payloadCtx.location.region || "";
+        const isFull = payload.telemetry?.preset === "full" || !payload.telemetry && this.telemetryConfig.ip === "track";
+        if (logTelemetry.ip === "track" || isFull) {
+          context.location.city = payloadCtx.location.city || "";
+        }
+      }
+    }
+    if (logTelemetry.ip === "anonymize" && rawIp) {
+      context.ip = await this.generateBlindIndex(rawIp, await this._getHashedKey(this.activeKeyId));
+    } else if (logTelemetry.ip === "track" && rawIp) {
+      context.ip = rawIp;
+    }
+    if (logTelemetry.userAgent !== "skip") {
+      if (rawUa) {
+        context.device = this.parseUserAgent(rawUa);
+        if (logTelemetry.userAgent === "track") {
+          context.userAgent = truncate(rawUa, 1e3);
+        }
+      } else if (payloadCtx.device) {
+        context.device = payloadCtx.device;
+      }
+    }
+    const scrub = (value, key) => this.redactKeys.includes(key) ? `[REDACTED:${key}]` : value;
+    const applyRef = (rawValue, key) => {
+      if (this.referenceKeys.includes(key)) {
+        const id = extractId(rawValue);
+        return `[REF:${id}]`;
+      }
+      return scrub(extractPii(rawValue), key);
+    };
+    const rawMetadata = payload.metadata || {};
+    const safeMetadata = {};
+    for (const [k, v] of Object.entries(rawMetadata)) {
+      const metaKey = `metadata.${k}`;
+      if (this.referenceKeys.includes(metaKey) && typeof v === "object" && v !== null && "id" in v) {
+        safeMetadata[k] = `[REF:${v.id}]`;
+      } else if (this.redactKeys.includes(metaKey) && typeof v === "string") {
+        safeMetadata[k] = `[REDACTED:${k}]`;
+      } else {
+        safeMetadata[k] = v;
+      }
+    }
+    const limitDepth = (obj, currentDepth = 1) => {
+      if (currentDepth > 5) {
+        return "[Truncated - Depth Exceeded]";
+      }
+      if (typeof obj !== "object" || obj === null) {
+        if (typeof obj === "string") {
+          return truncate(obj, 1e3);
+        }
+        return obj;
+      }
+      if (Array.isArray(obj)) {
+        return obj.map((item) => limitDepth(item, currentDepth + 1));
+      }
+      const result = {};
+      for (const [key, val] of Object.entries(obj)) {
+        result[key] = limitDepth(val, currentDepth + 1);
+      }
+      return result;
+    };
+    const processedMetadata = limitDepth(safeMetadata);
+    const serializedMeta = JSON.stringify(processedMetadata);
+    const maxMetaLimit = maxMetaOverride || this.maxMetadataSize;
+    if (serializedMeta.length > maxMetaLimit) {
+      throw new Error(`Metadata size exceeds maximum allowed limit of ${maxMetaLimit / 1024}KB.`);
+    }
+    const safeActor = applyRef(actorRaw, "actor");
+    const safeTarget = applyRef(targetRaw, "target");
+    const safeTenant = tenantRaw ? applyRef(tenantRaw, "tenant") : void 0;
+    const enrichedPayload = {
+      actor: safeActor,
+      action,
+      target: safeTarget,
+      metadata: processedMetadata
+    };
+    if (safeTenant) {
+      enrichedPayload.tenant = safeTenant;
+    }
+    if (Object.keys(context).length > 0) {
+      enrichedPayload.context = context;
+    }
+    let traceId = payload.traceId;
+    let spanId = payload.spanId;
+    let parentSpanId = payload.parentSpanId;
+    if (payload.req) {
+      const extractedTrace = _VolidatorClient.extractTraceContext(payload.req);
+      if (!traceId && extractedTrace.traceId) {
+        traceId = extractedTrace.traceId;
+      }
+      if (!spanId && extractedTrace.spanId) {
+        spanId = extractedTrace.spanId;
+      }
+    }
+    if (spanId) {
+      enrichedPayload.spanId = spanId;
+    }
+    if (parentSpanId) {
+      enrichedPayload.parentSpanId = parentSpanId;
+    }
+    const activeKeyBuffer = await this._getHashedKey(this.activeKeyId);
+    const actorBlindIndex = await this.generateBlindIndex(actor, activeKeyBuffer);
+    const actionBlindIndex = await this.generateBlindIndex(action, activeKeyBuffer);
+    const targetBlindIndex = await this.generateBlindIndex(target, activeKeyBuffer);
+    const tenantBlindIndex = tenant ? await this.generateBlindIndex(tenant, activeKeyBuffer) : void 0;
+    const traceBlindIndex = traceId ? await this.generateBlindIndex(traceId, activeKeyBuffer) : void 0;
+    const encryptedPayload = await this.encryptPayload(enrichedPayload);
+    return {
+      actorBlindIndex,
+      actionBlindIndex,
+      targetBlindIndex,
+      tenantBlindIndex,
+      traceBlindIndex,
+      encryptedPayload
+    };
+  }
+  // ---------------------------------------------------------------------------
+  // log() — Encrypt and ingest a single audit event
+  // ---------------------------------------------------------------------------
+  async log(payload, maxMetaOverride) {
+    const entry = await this.prepareLogEntry(payload, maxMetaOverride);
+    try {
+      const res = await fetch(`${this.endpoint}/v1/log`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(entry)
+      });
+      return res.ok;
+    } catch (err) {
+      console.error(`[Volidator] Failed to send log: ${err.message}`);
+      return false;
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // logBatch() — Bulk encrypt and ingest a batch of up to 100 audit events
+  // ---------------------------------------------------------------------------
+  async logBatch(payloads, maxMetaOverride) {
+    if (!Array.isArray(payloads) || payloads.length === 0) {
+      return { accepted: 0, rejected: 0 };
+    }
+    const batch = payloads.slice(0, 100);
+    const preparedEntries = [];
+    let rejected = payloads.length - batch.length;
+    const results = await Promise.allSettled(
+      batch.map((p) => this.prepareLogEntry(p, maxMetaOverride))
+    );
+    for (const res of results) {
+      if (res.status === "fulfilled") {
+        preparedEntries.push(res.value);
+      } else {
+        rejected++;
+        console.error(`[Volidator] Failed to prepare batch entry: ${res.reason?.message}`);
+      }
+    }
+    if (preparedEntries.length === 0) {
+      return { accepted: 0, rejected };
+    }
+    try {
+      const res = await fetch(`${this.endpoint}/v1/logs/batch`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ logs: preparedEntries })
+      });
+      if (res.ok) {
+        return { accepted: preparedEntries.length, rejected };
+      } else {
+        console.error(`[Volidator] Batch ingestion endpoint returned status: ${res.status}`);
+        return { accepted: 0, rejected: rejected + preparedEntries.length };
+      }
+    } catch (err) {
+      console.error(`[Volidator] Failed to send log batch: ${err.message}`);
+      return { accepted: 0, rejected: rejected + preparedEntries.length };
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // generateEmbedToken() — Sign a HS256 JWT for the embeddable dashboard widget
+  // ---------------------------------------------------------------------------
+  async generateEmbedToken(config) {
+    if (!this.projectId || !this.clientSecret) {
+      throw new Error(
+        "generateEmbedToken() requires projectId and clientSecret in the VolidatorClient constructor."
+      );
+    }
+    const {
+      actorId,
+      targetId,
+      tenantId,
+      scope,
+      expiresIn = "2h",
+      dashboardUrl = "https://dash.volidator.com",
+      hostOrigin,
+      view
+    } = config;
+    const defaultScope = scope || (tenantId ? "tenant" : "actor");
+    if (defaultScope !== "auditor" && !actorId && !targetId && !tenantId) {
+      throw new Error(
+        "At least one of actorId, targetId, or tenantId must be provided to generateEmbedToken()."
+      );
+    }
+    const actorBlindIndexes = actorId ? await Promise.all(Object.keys(this.keyring).map(async (id) => this.generateBlindIndex(actorId, await this._getHashedKey(id)))) : void 0;
+    const targetBlindIndexes = targetId ? await Promise.all(Object.keys(this.keyring).map(async (id) => this.generateBlindIndex(targetId, await this._getHashedKey(id)))) : void 0;
+    const tenantBlindIndexes = tenantId ? await Promise.all(Object.keys(this.keyring).map(async (id) => this.generateBlindIndex(tenantId, await this._getHashedKey(id)))) : void 0;
+    const parsedExpiry = this.parseExpiry(expiresIn);
+    const maxExpiry = defaultScope === "auditor" ? 604800 : 3600;
+    const expiresInSeconds = Math.min(parsedExpiry, maxExpiry);
+    const now = Math.floor(Date.now() / 1e3);
+    const payload = {
+      pid: this.projectId,
+      scope: defaultScope,
+      iat: now,
+      exp: now + expiresInSeconds
+    };
+    if (actorBlindIndexes) payload.abi = actorBlindIndexes;
+    if (targetBlindIndexes) payload.tgb = targetBlindIndexes;
+    if (tenantBlindIndexes) payload.tbi = tenantBlindIndexes;
+    if (view) {
+      const compressed = {};
+      if (Array.isArray(view.columns)) {
+        compressed.cols = view.columns.map((col) => {
+          if (col === "createdAt") return "cat";
+          if (col === "actor") return "act";
+          if (col === "action") return "acn";
+          if (col === "target") return "tgt";
+          if (col.startsWith("metadata.")) {
+            return `m.${col.slice(9)}`;
+          }
+          return col;
+        });
+      }
+      if (view.defaultFilter) {
+        compressed.flt = {};
+        if (view.defaultFilter.search !== void 0) {
+          compressed.flt.q = view.defaultFilter.search;
+        }
+        if (view.defaultFilter.action !== void 0) {
+          compressed.flt.act = view.defaultFilter.action;
+        }
+      }
+      payload.view = compressed;
+    }
+    const token = await this.signHS256JWT(payload, this.clientSecret);
+    const keyringString = Object.entries(this.keyring).map(([id, key]) => `${id}:${key}`).join(",");
+    const hostParam = hostOrigin ? `?host=${encodeURIComponent(hostOrigin)}` : "";
+    const embedUrl = `${dashboardUrl}/embed/${token}${hostParam}#${keyringString}`;
+    return { token, embedUrl };
+  }
+  async signHS256JWT(payload, secret) {
+    const header = { alg: "HS256", typ: "JWT" };
+    const encode = (obj) => btoa(JSON.stringify(obj)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    const unsigned = `${encode(header)}.${encode(payload)}`;
+    const key = await globalThis.crypto.subtle.importKey(
+      "raw",
+      new TextEncoder().encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const signatureBuffer = await globalThis.crypto.subtle.sign(
+      "HMAC",
+      key,
+      new TextEncoder().encode(unsigned)
+    );
+    let binary = "";
+    const arr = new Uint8Array(signatureBuffer);
+    for (let i = 0; i < arr.byteLength; i++) {
+      binary += String.fromCharCode(arr[i]);
+    }
+    const signature = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+    return `${unsigned}.${signature}`;
+  }
+  parseExpiry(expiry) {
+    const match = expiry.match(/^(\d+)(s|m|h|d)$/);
+    if (!match) return 7200;
+    const [, num, unit] = match;
+    const n = parseInt(num, 10);
+    switch (unit) {
+      case "s":
+        return n;
+      case "m":
+        return n * 60;
+      case "h":
+        return n * 3600;
+      case "d":
+        return n * 86400;
+      default:
+        return 7200;
+    }
+  }
+};
+var VolidatorCompliance = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async logWithControl(action, soc2Control, isoControl, payload) {
+    const metadata = {
+      ...payload.metadata,
+      soc2_control: soc2Control,
+      iso27001: isoControl
+    };
+    return this.client.log({
+      ...payload,
+      action,
+      metadata
+    });
+  }
+  async accessRevoked(payload) {
+    return this.logWithControl("access.revoked", "CC6.1", "A.9.2.6", payload);
+  }
+  async accessGranted(payload) {
+    return this.logWithControl("access.granted", "CC6.1", "A.9.2.1", payload);
+  }
+  async dataExported(payload) {
+    return this.logWithControl("data.exported", "CC6.6", "A.12.4.1", payload);
+  }
+  async systemConfigChanged(payload) {
+    return this.logWithControl("system.config_changed", "CC6.2", "A.12.1.2", payload);
+  }
+  async mfaEnabled(payload) {
+    return this.logWithControl("mfa.enabled", "CC6.3", "A.9.4.2", payload);
+  }
+};
+var VolidatorAgent = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async logAgent(action, euAiAct, nistAiRmf, soc2Control, isoControl, payload) {
+    const {
+      actor,
+      actorId,
+      target,
+      targetId,
+      tenant,
+      tenantId,
+      metadata,
+      context,
+      telemetry,
+      req,
+      traceId,
+      spanId,
+      parentSpanId,
+      ...agentData
+    } = payload;
+    const enrichedMetadata = {
+      ...metadata,
+      ...agentData,
+      eu_ai_act: euAiAct,
+      nist_ai_rmf: nistAiRmf,
+      soc2_control: soc2Control,
+      iso27001: isoControl
+    };
+    return this.client.log(
+      {
+        actor,
+        actorId,
+        target,
+        targetId,
+        tenant,
+        tenantId,
+        action,
+        metadata: enrichedMetadata,
+        context,
+        telemetry,
+        req,
+        traceId,
+        spanId,
+        parentSpanId
+      },
+      65536
+    );
+  }
+  /**
+   * Logs a tool call or external API invocation by an agent.
+   * Maps to EU AI Act Article 12, NIST AI RMF MANAGE 2.2, SOC2 CC6.6, ISO 27001 A.12.4.1.
+   */
+  async toolCall(payload) {
+    return this.logAgent("agent.tool_call", "Article 12", "MANAGE 2.2", "CC6.6", "A.12.4.1", payload);
+  }
+  /**
+   * Logs a key decision made autonomously by an AI agent model.
+   * Maps to EU AI Act Article 12 & 13, NIST AI RMF GOVERN 1.7, SOC2 CC6.2, ISO 27001 A.18.1.3.
+   */
+  async decision(payload) {
+    return this.logAgent("agent.decision", "Article 12 & 13", "GOVERN 1.7", "CC6.2", "A.18.1.3", payload);
+  }
+  /**
+   * Logs a request for human review or permission escalation.
+   * Maps to EU AI Act Article 14, NIST AI RMF GOVERN 5.1, SOC2 CC6.3, ISO 27001 A.6.1.2.
+   */
+  async escalation(payload) {
+    return this.logAgent("agent.escalation", "Article 14", "GOVERN 5.1", "CC6.3", "A.6.1.2", payload);
+  }
+  /**
+   * Logs anomalous environment inputs, potential prompt injections, or policy violations.
+   * Maps to EU AI Act Article 9, NIST AI RMF MANAGE 2.4, SOC2 CC7.2, ISO 27001 A.16.1.2.
+   */
+  async anomaly(payload) {
+    return this.logAgent("agent.anomaly", "Article 9", "MANAGE 2.4", "CC7.2", "A.16.1.2", payload);
+  }
+  /**
+   * Logs a model refusal to execute a user prompt or command due to alignment safety.
+   * Maps to EU AI Act Article 5, NIST AI RMF GOVERN 1.1, SOC2 CC6.8, ISO 27001 A.18.1.3.
+   */
+  async refusal(payload) {
+    return this.logAgent("agent.refusal", "Article 5", "GOVERN 1.1", "CC6.8", "A.18.1.3", payload);
+  }
+  /**
+   * Logs an execution context handoff from one agent to another.
+   * Maps to EU AI Act Article 12, NIST AI RMF MAP 1.6, SOC2 CC6.6, ISO 27001 A.12.4.1.
+   */
+  async handoff(payload) {
+    return this.logAgent("agent.handoff", "Article 12", "MAP 1.6", "CC6.6", "A.12.4.1", payload);
+  }
+};
+
+// src/middleware/next.ts
+function withVolidator(client, handler) {
+  return async (req, ctx = {}, ...args) => {
+    const extractedContext = VolidatorClient.extractContext(req);
+    const scopedLog = async (payload) => {
+      return client.log({
+        ...payload,
+        context: {
+          ...extractedContext,
+          ...payload.context,
+          location: {
+            ...extractedContext.location,
+            ...payload.context?.location || {}
+          },
+          device: {
+            ...extractedContext.device,
+            ...payload.context?.device || {}
+          }
+        }
+      });
+    };
+    const withControl = (action, soc2Control, isoControl, payload) => scopedLog({
+      ...payload,
+      action,
+      metadata: {
+        ...payload.metadata,
+        soc2_control: soc2Control,
+        iso27001: isoControl
+      }
+    });
+    const scopedCompliance = {
+      accessRevoked: (p) => withControl("access.revoked", "CC6.1", "A.9.2.6", p),
+      accessGranted: (p) => withControl("access.granted", "CC6.1", "A.9.2.1", p),
+      dataExported: (p) => withControl("data.exported", "CC6.6", "A.12.4.1", p),
+      systemConfigChanged: (p) => withControl("system.config_changed", "CC6.2", "A.12.1.2", p),
+      mfaEnabled: (p) => withControl("mfa.enabled", "CC6.3", "A.9.4.2", p)
+    };
+    const newCtx = {
+      ...ctx,
+      volidator: {
+        log: scopedLog,
+        compliance: scopedCompliance
+      }
+    };
+    return handler(req, newCtx, ...args);
+  };
+}
+
+// src/plugins/universal.ts
+function createUniversalAudit({ client, getUserId, getSession, getMetadata }) {
+  return function withAuthAudit(handler) {
+    const baseHandler = withVolidator(client, async (req, ctx) => {
+      let session = null;
+      let userId;
+      let injectedMetadata = {};
+      try {
+        if (getSession) {
+          session = await getSession(req, ctx);
+        }
+        userId = await getUserId(req, session ?? ctx);
+        if (getMetadata) {
+          injectedMetadata = await getMetadata(req, session ?? ctx) || {};
+        }
+      } catch (e) {
+        console.warn("[Volidator] Failed to execute IAM callbacks in Universal plugin", e);
+      }
+      const originalLog = ctx.volidator.log;
+      ctx.volidator.log = async (payload) => {
+        const enrichedPayload = { ...payload };
+        if (!enrichedPayload.actor && userId) {
+          enrichedPayload.actor = userId;
+        }
+        if (Object.keys(injectedMetadata).length > 0) {
+          enrichedPayload.metadata = {
+            ...injectedMetadata,
+            ...enrichedPayload.metadata || {}
+          };
+        }
+        return originalLog(enrichedPayload);
+      };
+      ctx.session = session;
+      return handler(req, ctx);
+    });
+    return baseHandler;
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createUniversalAudit
+});
+//# sourceMappingURL=universal.cjs.map