@centient/secrets 0.10.0 → 0.11.0

package/dist/sinks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sinks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EACL,6BAA6B,EAC7B,aAAa,EACb,0BAA0B,GAC3B,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EACV,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EACV,SAAS,EACT,qBAAqB,EACrB,eAAe,GAChB,MAAM,YAAY,CAAC"}

package/dist/sinks/index.js

@@ -0,0 +1,5 @@
+export { jsonlAuditSink } from "./jsonl.js";
+export { credentialAuditSpanAttributes, otelAuditSink, OtelAuditSinkDegradedError, } from "./otel.js";
+export { syslogAuditSink } from "./syslog.js";
+export { AuditSinkOverflowError } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/sinks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sinks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,OAAO,EACL,6BAA6B,EAC7B,aAAa,EACb,0BAA0B,GAC3B,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAK9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC"}

package/dist/sinks/jsonl.d.ts

@@ -0,0 +1,16 @@
+import type { AuditSink, AuditSinkErrorHandler } from "./types.js";
+export interface JsonlAuditSinkOptions {
+    readonly filePath: string;
+    /** Creation mode for a new log file. Defaults to owner-only `0o600`. */
+    readonly fileMode?: number;
+    /** Creation mode for missing directories. Defaults to owner-only `0o700`. */
+    readonly directoryMode?: number;
+    readonly maxPending?: number;
+    readonly onError?: AuditSinkErrorHandler;
+}
+/**
+ * Append bare OCSF records as newline-delimited JSON. Writes are serialized in
+ * emission order; `flush()` rejects if any queued append failed.
+ */
+export declare function jsonlAuditSink(options: JsonlAuditSinkOptions): AuditSink;
+//# sourceMappingURL=jsonl.d.ts.map

package/dist/sinks/jsonl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonl.d.ts","sourceRoot":"","sources":["../../src/sinks/jsonl.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGnE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,SAAS,CAuCxE"}

package/dist/sinks/jsonl.js

@@ -0,0 +1,51 @@
+import { appendFile, mkdir } from "node:fs/promises";
+import { dirname } from "node:path";
+import { createQueuedAuditSink } from "./queue.js";
+function assertMode(mode, field) {
+    if (!Number.isInteger(mode) || mode < 0 || mode > 0o777) {
+        throw new RangeError(`${field} must be an integer permission mode from 0o000 to 0o777`);
+    }
+}
+/**
+ * Append bare OCSF records as newline-delimited JSON. Writes are serialized in
+ * emission order; `flush()` rejects if any queued append failed.
+ */
+export function jsonlAuditSink(options) {
+    if (options.filePath.length === 0) {
+        throw new TypeError("filePath must not be empty");
+    }
+    const fileMode = options.fileMode ?? 0o600;
+    const directoryMode = options.directoryMode ?? 0o700;
+    assertMode(fileMode, "fileMode");
+    assertMode(directoryMode, "directoryMode");
+    let directoryReady = false;
+    return createQueuedAuditSink({
+        name: "jsonl",
+        ...(options.maxPending !== undefined ? { maxPending: options.maxPending } : {}),
+        ...(options.onError !== undefined ? { onError: options.onError } : {}),
+        async write(event) {
+            if (!directoryReady) {
+                await mkdir(dirname(options.filePath), {
+                    recursive: true,
+                    mode: directoryMode,
+                });
+                directoryReady = true;
+            }
+            try {
+                await appendFile(options.filePath, `${JSON.stringify(event)}\n`, {
+                    encoding: "utf8",
+                    mode: fileMode,
+                });
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    "code" in error &&
+                    error.code === "ENOENT") {
+                    directoryReady = false;
+                }
+                throw error;
+            }
+        },
+    });
+}
+//# sourceMappingURL=jsonl.js.map

package/dist/sinks/jsonl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonl.js","sourceRoot":"","sources":["../../src/sinks/jsonl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAYnD,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,yDAAyD,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;IACrD,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjC,UAAU,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAE3C,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,OAAO,qBAAqB,CAAC;QAC3B,IAAI,EAAE,OAAO;QACb,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;oBACrC,SAAS,EAAE,IAAI;oBACf,IAAI,EAAE,aAAa;iBACpB,CAAC,CAAC;gBACH,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE;oBAC/D,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,KAAK,YAAY,KAAK;oBACtB,MAAM,IAAI,KAAK;oBACd,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAClD,CAAC;oBACD,cAAc,GAAG,KAAK,CAAC;gBACzB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/sinks/otel.d.ts

@@ -0,0 +1,22 @@
+import { type Attributes, type Tracer } from "@opentelemetry/api";
+import type { CredentialAuditEvent } from "../audit/ocsf.js";
+import { type AuditSink, type AuditSinkErrorHandler } from "./types.js";
+export declare class OtelAuditSinkDegradedError extends Error {
+    readonly code: "OTEL_AUDIT_SINK_DEGRADED";
+    constructor(reason: "not-recording" | "not-sampled");
+}
+export interface OtelAuditSinkOptions {
+    /** Application-owned tracer; defaults to the global OTel API tracer. */
+    readonly tracer?: Tracer;
+    /** Called once when spans are not recording/sampled, and on synchronous errors. */
+    readonly onError?: AuditSinkErrorHandler;
+}
+/** Flatten one OCSF JSON record into primitive span attributes. */
+export declare function credentialAuditSpanAttributes(event: CredentialAuditEvent): Attributes;
+/**
+ * Emit one completed credential operation as a retroactive OTel span. The
+ * application owns SDK/exporter configuration; this package depends only on
+ * the OTel API, as required for reusable instrumentation libraries.
+ */
+export declare function otelAuditSink(options?: OtelAuditSinkOptions): AuditSink;
+//# sourceMappingURL=otel.d.ts.map

package/dist/sinks/otel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.d.ts","sourceRoot":"","sources":["../../src/sinks/otel.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,MAAM,EACZ,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AAKpB,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;gBAExC,MAAM,EAAE,eAAe,GAAG,aAAa;CAQpD;AAED,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAED,mEAAmE;AACnE,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,oBAAoB,GAC1B,UAAU,CA6DZ;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,SAAS,CA0E3E"}

package/dist/sinks/otel.js

@@ -0,0 +1,155 @@
+import { SpanKind, SpanStatusCode, TraceFlags, trace, } from "@opentelemetry/api";
+import { asError, defaultAuditSinkErrorHandler, } from "./types.js";
+const TRACER_NAME = "@centient/secrets";
+const SPAN_NAME = "centient.secrets.credential";
+export class OtelAuditSinkDegradedError extends Error {
+    code = "OTEL_AUDIT_SINK_DEGRADED";
+    constructor(reason) {
+        super(reason === "not-recording"
+            ? "OpenTelemetry audit span is not recording; configure an audit tracer provider"
+            : "OpenTelemetry audit span is not sampled; configure an always-on audit sampler");
+        this.name = "OtelAuditSinkDegradedError";
+    }
+}
+/** Flatten one OCSF JSON record into primitive span attributes. */
+export function credentialAuditSpanAttributes(event) {
+    const attestation = event.attestation_list?.[0];
+    const previousHash = attestation?.prev_event?.fingerprint.value;
+    const durationMs = event.unmapped["centient.secrets.operation.duration_ms"];
+    return {
+        "ocsf.category_uid": event.category_uid,
+        "ocsf.class_uid": event.class_uid,
+        "ocsf.type_uid": event.type_uid,
+        "ocsf.activity_id": event.activity_id,
+        "ocsf.activity_name": event.activity_name,
+        "ocsf.action_id": event.action_id,
+        "ocsf.status_id": event.status_id,
+        "ocsf.severity_id": event.severity_id,
+        "ocsf.time": event.time,
+        "ocsf.metadata.version": event.metadata.version,
+        "ocsf.metadata.uid": event.metadata.uid,
+        "ocsf.actor.user.uid": event.actor.user.uid,
+        "ocsf.entity.name": event.entity.name,
+        "ocsf.entity.type": event.entity.type,
+        "ocsf.entity.type_id": event.entity.type_id,
+        "centient.secrets.credential.vault.name": event.entity.data.vault_name,
+        "centient.secrets.operation.duration_ms": durationMs,
+        "centient.secrets.event_type": event.unmapped["centient.secrets.event_type"],
+        // ADR-002's original attribute spellings are retained as projection
+        // aliases. They are not fields in released OCSF 1.9 JSON.
+        activity_id: event.activity_id,
+        "actor.user": event.actor.user.uid,
+        "credential.name": event.entity.name,
+        "credential.vault.name": event.entity.data.vault_name,
+        status_id: event.status_id,
+        time: event.time,
+        duration: durationMs,
+        ...(event.status_detail !== undefined
+            ? { "ocsf.status_detail": event.status_detail }
+            : {}),
+        ...(event.metadata.sequence !== undefined
+            ? {
+                "ocsf.metadata.sequence": event.metadata.sequence,
+                sequence_number: event.metadata.sequence,
+            }
+            : {}),
+        ...(attestation !== undefined
+            ? {
+                "ocsf.attestation.chain_uid": attestation.chain_uid,
+                "ocsf.attestation.fingerprint": attestation.fingerprint.value,
+                event_hash: attestation.fingerprint.value,
+            }
+            : {}),
+        ...(previousHash !== undefined
+            ? {
+                "ocsf.attestation.prev_event.fingerprint": previousHash,
+                previous_hash: previousHash,
+            }
+            : {}),
+        ...(event.unmapped["centient.audit_chain.key_id"] !== undefined
+            ? {
+                "centient.audit_chain.key_id": event.unmapped["centient.audit_chain.key_id"],
+            }
+            : {}),
+    };
+}
+/**
+ * Emit one completed credential operation as a retroactive OTel span. The
+ * application owns SDK/exporter configuration; this package depends only on
+ * the OTel API, as required for reusable instrumentation libraries.
+ */
+export function otelAuditSink(options = {}) {
+    const tracer = options.tracer ?? trace.getTracer(TRACER_NAME);
+    const onError = options.onError ?? defaultAuditSinkErrorHandler;
+    let degraded;
+    let failures = 0;
+    let degradationReported = false;
+    const report = (error, once = false) => {
+        degraded = error;
+        failures += 1;
+        if (once && degradationReported)
+            return;
+        if (once)
+            degradationReported = true;
+        try {
+            onError(error);
+        }
+        catch (handlerError) {
+            defaultAuditSinkErrorHandler(asError(handlerError));
+        }
+    };
+    const sink = ((event) => {
+        let span;
+        try {
+            span = tracer.startSpan(SPAN_NAME, {
+                kind: SpanKind.INTERNAL,
+                startTime: event.time,
+                attributes: credentialAuditSpanAttributes(event),
+            });
+        }
+        catch (error) {
+            const normalized = asError(error);
+            report(normalized);
+            throw normalized;
+        }
+        let operationError;
+        try {
+            if (!span.isRecording()) {
+                report(new OtelAuditSinkDegradedError("not-recording"), true);
+            }
+            else if ((span.spanContext().traceFlags & TraceFlags.SAMPLED) === 0) {
+                report(new OtelAuditSinkDegradedError("not-sampled"), true);
+            }
+            span.setStatus({
+                code: event.status_id === 1 ? SpanStatusCode.OK : SpanStatusCode.ERROR,
+                ...(event.status_detail !== undefined ? { message: event.status_detail } : {}),
+            });
+        }
+        catch (error) {
+            operationError = asError(error);
+            report(operationError);
+        }
+        try {
+            // A started span must be ended even when its recording/status methods
+            // throw through an injected tracer seam.
+            span.end(event.time + event.unmapped["centient.secrets.operation.duration_ms"]);
+        }
+        catch (error) {
+            const endError = asError(error);
+            report(endError);
+            operationError = operationError === undefined
+                ? endError
+                : new AggregateError([operationError, endError], "OpenTelemetry audit span processing and end both failed");
+        }
+        if (operationError !== undefined)
+            throw operationError;
+    });
+    sink.health = () => ({
+        status: degraded === undefined ? "healthy" : "degraded",
+        pending: 0,
+        failures,
+        ...(degraded !== undefined ? { lastError: degraded.message } : {}),
+    });
+    return sink;
+}
+//# sourceMappingURL=otel.js.map

package/dist/sinks/otel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.js","sourceRoot":"","sources":["../../src/sinks/otel.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,cAAc,EACd,UAAU,EACV,KAAK,GAGN,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,OAAO,EACP,4BAA4B,GAI7B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,GAAG,mBAAmB,CAAC;AACxC,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAEhD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,0BAAmC,CAAC;IAEpD,YAAY,MAAuC;QACjD,KAAK,CACH,MAAM,KAAK,eAAe;YACxB,CAAC,CAAC,+EAA+E;YACjF,CAAC,CAAC,+EAA+E,CACpF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AASD,mEAAmE;AACnE,MAAM,UAAU,6BAA6B,CAC3C,KAA2B;IAE3B,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC;IAChE,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;IAE5E,OAAO;QACL,mBAAmB,EAAE,KAAK,CAAC,YAAY;QACvC,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,eAAe,EAAE,KAAK,CAAC,QAAQ;QAC/B,kBAAkB,EAAE,KAAK,CAAC,WAAW;QACrC,oBAAoB,EAAE,KAAK,CAAC,aAAa;QACzC,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,gBAAgB,EAAE,KAAK,CAAC,SAAS;QACjC,kBAAkB,EAAE,KAAK,CAAC,WAAW;QACrC,WAAW,EAAE,KAAK,CAAC,IAAI;QACvB,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/C,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;QACvC,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;QAC3C,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACrC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACrC,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC3C,wCAAwC,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU;QACtE,wCAAwC,EAAE,UAAU;QACpD,6BAA6B,EAAE,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC5E,oEAAoE;QACpE,0DAA0D;QAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;QAClC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;QACpC,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU;QACrD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,UAAU;QACpB,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,aAAa,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS;YACvC,CAAC,CAAC;gBACE,wBAAwB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;gBACjD,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;aACzC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,WAAW,KAAK,SAAS;YAC3B,CAAC,CAAC;gBACE,4BAA4B,EAAE,WAAW,CAAC,SAAS;gBACnD,8BAA8B,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK;gBAC7D,UAAU,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK;aAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,YAAY,KAAK,SAAS;YAC5B,CAAC,CAAC;gBACE,yCAAyC,EAAE,YAAY;gBACvD,aAAa,EAAE,YAAY;aAC5B;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC,KAAK,SAAS;YAC7D,CAAC,CAAC;gBACE,6BAA6B,EAAE,KAAK,CAAC,QAAQ,CAAC,6BAA6B,CAAC;aAC7E;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAgC,EAAE;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4BAA4B,CAAC;IAChE,IAAI,QAA2B,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAEhC,MAAM,MAAM,GAAG,CAAC,KAAY,EAAE,IAAI,GAAG,KAAK,EAAQ,EAAE;QAClD,QAAQ,GAAG,KAAK,CAAC;QACjB,QAAQ,IAAI,CAAC,CAAC;QACd,IAAI,IAAI,IAAI,mBAAmB;YAAE,OAAO;QACxC,IAAI,IAAI;YAAE,mBAAmB,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAC,KAA2B,EAAQ,EAAE;QAClD,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE;gBACjC,IAAI,EAAE,QAAQ,CAAC,QAAQ;gBACvB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,CAAC;YACnB,MAAM,UAAU,CAAC;QACnB,CAAC;QAED,IAAI,cAAiC,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,0BAA0B,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtE,MAAM,CAAC,IAAI,0BAA0B,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK;gBACtE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,cAAc,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,CAAC;YACH,sEAAsE;YACtE,yCAAyC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjB,cAAc,GAAG,cAAc,KAAK,SAAS;gBAC3C,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,IAAI,cAAc,CAChB,CAAC,cAAc,EAAE,QAAQ,CAAC,EAC1B,yDAAyD,CAC1D,CAAC;QACR,CAAC;QACD,IAAI,cAAc,KAAK,SAAS;YAAE,MAAM,cAAc,CAAC;IACzD,CAAC,CAAc,CAAC;IAEhB,IAAI,CAAC,MAAM,GAAG,GAAoB,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QACvD,OAAO,EAAE,CAAC;QACV,QAAQ;QACR,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sinks/queue.d.ts

@@ -0,0 +1,12 @@
+import type { CredentialAuditEvent } from "../audit/ocsf.js";
+import { type AuditSink, type AuditSinkErrorHandler } from "./types.js";
+export interface QueuedAuditSinkOptions {
+    readonly name: string;
+    readonly write: (event: CredentialAuditEvent) => void | Promise<void>;
+    readonly close?: () => void | Promise<void>;
+    readonly maxPending?: number;
+    readonly onError?: AuditSinkErrorHandler;
+}
+/** Internal serialized queue shared by the JSONL and syslog transports. */
+export declare function createQueuedAuditSink(options: QueuedAuditSinkOptions): AuditSink;
+//# sourceMappingURL=queue.d.ts.map

package/dist/sinks/queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../src/sinks/queue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAID,2EAA2E;AAC3E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,SAAS,CAgGhF"}

package/dist/sinks/queue.js

@@ -0,0 +1,89 @@
+import { asError, AuditSinkOverflowError, defaultAuditSinkErrorHandler, } from "./types.js";
+const DEFAULT_MAX_PENDING = 1_000;
+/** Internal serialized queue shared by the JSONL and syslog transports. */
+export function createQueuedAuditSink(options) {
+    const maxPending = options.maxPending ?? DEFAULT_MAX_PENDING;
+    if (!Number.isSafeInteger(maxPending) || maxPending < 1) {
+        throw new RangeError("maxPending must be a positive safe integer");
+    }
+    const onError = options.onError ?? defaultAuditSinkErrorHandler;
+    let tail = Promise.resolve();
+    let pending = 0;
+    let failures = 0;
+    let lastError;
+    let closed = false;
+    let closePromise;
+    const recordFailure = (error) => {
+        const normalized = asError(error);
+        failures += 1;
+        lastError = normalized;
+        try {
+            onError(normalized);
+        }
+        catch (handlerError) {
+            // An error reporter must not turn a handled queue rejection into an
+            // unhandled rejection. The fallback is deliberately value-free.
+            defaultAuditSinkErrorHandler(asError(handlerError));
+        }
+    };
+    const sink = ((event) => {
+        if (closed) {
+            throw new Error(`${options.name} audit sink is closed`);
+        }
+        if (pending >= maxPending) {
+            const error = new AuditSinkOverflowError(options.name, maxPending);
+            recordFailure(error);
+            throw error;
+        }
+        pending += 1;
+        const writeResult = tail.then(() => options.write(event));
+        tail = writeResult.then(() => {
+            pending -= 1;
+        }, (error) => {
+            pending -= 1;
+            recordFailure(error);
+        });
+    });
+    sink.flush = async () => {
+        await tail;
+        if (failures > 0) {
+            throw new AggregateError(lastError === undefined ? [] : [lastError], `${options.name} audit sink failed to write ${failures} record(s)`);
+        }
+    };
+    sink.close = () => {
+        if (closePromise !== undefined)
+            return closePromise;
+        closed = true;
+        closePromise = (async () => {
+            const closeErrors = [];
+            try {
+                await sink.flush?.();
+            }
+            catch (error) {
+                closeErrors.push(asError(error));
+            }
+            try {
+                await options.close?.();
+            }
+            catch (error) {
+                const normalized = asError(error);
+                recordFailure(normalized);
+                closeErrors.push(normalized);
+            }
+            if (closeErrors.length === 1)
+                throw closeErrors[0];
+            if (closeErrors.length > 1) {
+                throw new AggregateError(closeErrors, `${options.name} audit sink drain and transport close both failed`);
+            }
+        })();
+        return closePromise;
+    };
+    sink.health = () => ({
+        status: failures === 0 ? "healthy" : "degraded",
+        pending,
+        failures,
+        ...(lastError !== undefined ? { lastError: lastError.message } : {}),
+    });
+    return sink;
+}
+//# sourceMappingURL=queue.js.map

package/dist/sinks/queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.js","sourceRoot":"","sources":["../../src/sinks/queue.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EACP,sBAAsB,EACtB,4BAA4B,GAI7B,MAAM,YAAY,CAAC;AAUpB,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,UAAU,CAAC,4CAA4C,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4BAA4B,CAAC;IAChE,IAAI,IAAI,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAA4B,CAAC;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,YAAuC,CAAC;IAE5C,MAAM,aAAa,GAAG,CAAC,KAAc,EAAQ,EAAE;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAClC,QAAQ,IAAI,CAAC,CAAC;QACd,SAAS,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,oEAAoE;YACpE,gEAAgE;YAChE,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,CAAC,KAA2B,EAAQ,EAAE;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,uBAAuB,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,sBAAsB,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACnE,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,CAAC;QACb,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,GAAG,WAAW,CAAC,IAAI,CACrB,GAAG,EAAE;YACH,OAAO,IAAI,CAAC,CAAC;QACf,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,OAAO,IAAI,CAAC,CAAC;YACb,aAAa,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC,CACF,CAAC;IACJ,CAAC,CAAc,CAAC;IAEhB,IAAI,CAAC,KAAK,GAAG,KAAK,IAAmB,EAAE;QACrC,MAAM,IAAI,CAAC;QACX,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,cAAc,CACtB,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAC1C,GAAG,OAAO,CAAC,IAAI,+BAA+B,QAAQ,YAAY,CACnE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,GAAG,GAAkB,EAAE;QAC/B,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;QACpD,MAAM,GAAG,IAAI,CAAC;QACd,YAAY,GAAG,CAAC,KAAK,IAAmB,EAAE;YACxC,MAAM,WAAW,GAAY,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;gBAClC,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1B,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,cAAc,CACtB,WAAW,EACX,GAAG,OAAO,CAAC,IAAI,mDAAmD,CACnE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,IAAI,CAAC,MAAM,GAAG,GAAoB,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QAC/C,OAAO;QACP,QAAQ;QACR,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/sinks/syslog.d.ts

@@ -0,0 +1,17 @@
+import { type AuditSink, type AuditSinkErrorHandler } from "./types.js";
+export type SyslogAuditSender = (message: string) => void | Promise<void>;
+export interface SyslogAuditSinkOptions {
+    readonly host?: string;
+    readonly port?: number;
+    /** RFC 5424 facility number. Defaults to 10 (`authpriv`). */
+    readonly facility?: number;
+    readonly hostname?: string;
+    readonly appName?: string;
+    readonly maxPending?: number;
+    readonly onError?: AuditSinkErrorHandler;
+    /** Injectable transport seam. When omitted, UDP is used. */
+    readonly sender?: SyslogAuditSender;
+}
+/** Create an RFC 5424 syslog sink, using UDP unless a sender is injected. */
+export declare function syslogAuditSink(options?: SyslogAuditSinkOptions): AuditSink;
+//# sourceMappingURL=syslog.d.ts.map

package/dist/sinks/syslog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syslog.d.ts","sourceRoot":"","sources":["../../src/sinks/syslog.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AA2ED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,SAAS,CA8B/E"}

package/dist/sinks/syslog.js

@@ -0,0 +1,103 @@
+import { createSocket } from "node:dgram";
+import { hostname as getHostname } from "node:os";
+import { createQueuedAuditSink } from "./queue.js";
+import { asError, defaultAuditSinkErrorHandler, } from "./types.js";
+function headerToken(value, fallback) {
+    const sanitized = value.replace(/[^\x21-\x7e]/g, "_").slice(0, 48);
+    return sanitized.length === 0 ? fallback : sanitized;
+}
+function syslogMessage(event, options) {
+    // RFC 5424: informational for a successful operation, warning otherwise.
+    const severity = event.status_id === 1 ? 6 : 4;
+    const priority = options.facility * 8 + severity;
+    const timestamp = new Date(event.time).toISOString();
+    const host = headerToken(options.hostname, "-");
+    const appName = headerToken(options.appName, "centient-secrets");
+    return `<${priority}>1 ${timestamp} ${host} ${appName} ${process.pid} OCSF3004 - ${JSON.stringify(event)}`;
+}
+function createUdpSender(host, port, onError) {
+    const socket = createSocket(host.includes(":") ? "udp6" : "udp4");
+    let sendInFlight = false;
+    let started = false;
+    socket.unref();
+    // Keep socket-level failures observable even if they occur outside a send
+    // callback. A per-send listener below also rejects the queued write.
+    socket.on("error", (error) => {
+        if (sendInFlight)
+            return;
+        try {
+            onError(error);
+        }
+        catch (handlerError) {
+            defaultAuditSinkErrorHandler(asError(handlerError));
+        }
+    });
+    return {
+        send(message) {
+            return new Promise((resolve, reject) => {
+                sendInFlight = true;
+                const onSocketError = (error) => {
+                    socket.off("error", onSocketError);
+                    sendInFlight = false;
+                    reject(error);
+                };
+                socket.once("error", onSocketError);
+                try {
+                    started = true;
+                    socket.send(message, port, host, (error) => {
+                        socket.off("error", onSocketError);
+                        sendInFlight = false;
+                        if (error)
+                            reject(error);
+                        else
+                            resolve();
+                    });
+                }
+                catch (error) {
+                    socket.off("error", onSocketError);
+                    sendInFlight = false;
+                    started = false;
+                    reject(error);
+                }
+            });
+        },
+        close() {
+            if (!started)
+                return Promise.resolve();
+            return new Promise((resolve) => {
+                socket.close(() => resolve());
+            });
+        },
+    };
+}
+/** Create an RFC 5424 syslog sink, using UDP unless a sender is injected. */
+export function syslogAuditSink(options = {}) {
+    const host = options.host ?? "127.0.0.1";
+    const port = options.port ?? 514;
+    const facility = options.facility ?? 10;
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new RangeError("syslog port must be an integer from 1 through 65535");
+    }
+    if (!Number.isInteger(facility) || facility < 0 || facility > 23) {
+        throw new RangeError("syslog facility must be an integer from 0 through 23");
+    }
+    const onError = options.onError ?? defaultAuditSinkErrorHandler;
+    const udp = options.sender === undefined
+        ? createUdpSender(host, port, onError)
+        : undefined;
+    const sender = options.sender ?? udp.send;
+    return createQueuedAuditSink({
+        name: "syslog",
+        ...(options.maxPending !== undefined ? { maxPending: options.maxPending } : {}),
+        onError,
+        write(event) {
+            return sender(syslogMessage(event, {
+                facility,
+                hostname: options.hostname ?? getHostname(),
+                appName: options.appName ?? "centient-secrets",
+            }));
+        },
+        ...(udp !== undefined ? { close: udp.close } : {}),
+    });
+}
+//# sourceMappingURL=syslog.js.map

package/dist/sinks/syslog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syslog.js","sourceRoot":"","sources":["../../src/sinks/syslog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,QAAQ,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AAGlD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EACL,OAAO,EACP,4BAA4B,GAG7B,MAAM,YAAY,CAAC;AAiBpB,SAAS,WAAW,CAAC,KAAa,EAAE,QAAgB;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CACpB,KAA2B,EAC3B,OAAoF;IAEpF,yEAAyE;IACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,GAAG,CAAC,GAAG,QAAQ,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACjE,OAAO,IAAI,QAAQ,MAAM,SAAS,IAAI,IAAI,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,IAAY,EACZ,OAA8B;IAE9B,MAAM,MAAM,GAAW,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1E,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,YAAY;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,CAAC,OAAO;YACV,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM,aAAa,GAAG,CAAC,KAAY,EAAQ,EAAE;oBAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBACnC,YAAY,GAAG,KAAK,CAAC;oBACrB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;wBACzC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;wBACnC,YAAY,GAAG,KAAK,CAAC;wBACrB,IAAI,KAAK;4BAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;4BACpB,OAAO,EAAE,CAAC;oBACjB,CAAC,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBACnC,YAAY,GAAG,KAAK,CAAC;oBACrB,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK;YACH,IAAI,CAAC,OAAO;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YACvC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACnC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,UAAU,CAAC,qDAAqD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,4BAA4B,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS;QACtC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAI,CAAC,IAAI,CAAC;IAE3C,OAAO,qBAAqB,CAAC;QAC3B,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO;QACP,KAAK,CAAC,KAAK;YACT,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE;gBACjC,QAAQ;gBACR,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE;gBAC3C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,kBAAkB;aAC/C,CAAC,CAAC,CAAC;QACN,CAAC;QACD,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC;AACL,CAAC"}

package/dist/sinks/types.d.ts

@@ -0,0 +1,27 @@
+import type { CredentialAuditEvent } from "../audit/ocsf.js";
+export interface AuditSinkHealth {
+    readonly status: "healthy" | "degraded";
+    readonly pending: number;
+    readonly failures: number;
+    readonly lastError?: string;
+}
+/**
+ * Synchronous policy boundary. Buffered sinks enqueue before returning and
+ * expose `flush()` so delivery-sensitive callers can observe async failure.
+ */
+export interface AuditSink {
+    (event: CredentialAuditEvent): void;
+    flush?(): Promise<void>;
+    close?(): Promise<void>;
+    health?(): AuditSinkHealth;
+}
+export type AuditSinkErrorHandler = (error: Error) => void;
+export declare class AuditSinkOverflowError extends Error {
+    readonly sink: string;
+    readonly maxPending: number;
+    readonly code: "AUDIT_SINK_OVERFLOW";
+    constructor(sink: string, maxPending: number);
+}
+export declare function asError(error: unknown): Error;
+export declare function defaultAuditSinkErrorHandler(error: Error): void;
+//# sourceMappingURL=types.d.ts.map

package/dist/sinks/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sinks/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,IAAI,eAAe,CAAC;CAC5B;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;AAE3D,qBAAa,sBAAuB,SAAQ,KAAK;IAI7C,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM;IAJ7B,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBAGpC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM;CAK9B;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAE7C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAE/D"}

package/dist/sinks/types.js

@@ -0,0 +1,18 @@
+export class AuditSinkOverflowError extends Error {
+    sink;
+    maxPending;
+    code = "AUDIT_SINK_OVERFLOW";
+    constructor(sink, maxPending) {
+        super(`${sink} audit sink queue reached its ${maxPending}-record limit`);
+        this.sink = sink;
+        this.maxPending = maxPending;
+        this.name = "AuditSinkOverflowError";
+    }
+}
+export function asError(error) {
+    return error instanceof Error ? error : new Error(String(error));
+}
+export function defaultAuditSinkErrorHandler(error) {
+    process.stderr.write(`[secrets] audit sink failure: ${error.message}\n`);
+}
+//# sourceMappingURL=types.js.map

package/dist/sinks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sinks/types.ts"],"names":[],"mappings":"AAsBA,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAIpC;IACA;IAJF,IAAI,GAAG,qBAA8B,CAAC;IAE/C,YACW,IAAY,EACZ,UAAkB;QAE3B,KAAK,CAAC,GAAG,IAAI,iCAAiC,UAAU,eAAe,CAAC,CAAC;QAHhE,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAQ;QAG3B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAY;IACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;AAC3E,CAAC"}