@flipboxlabs/aws-audit-sdk 1.2.0 → 1.2.2

package/dist/audits.js

@@ -120,7 +120,7 @@ export class Audits {
      * @param item - The audit entry to buffer
      */
     addAudit(item) {
-        if (Object.keys(this.storedAudits).length >= MAX_AUDITS_SIZE) {
+        if (this.storedAudits.length >= MAX_AUDITS_SIZE) {
             this.publishStoredAudits();
         }
         this.config.schemas.resourceReference.parse(item.target);

package/dist/repository.d.ts

@@ -176,7 +176,7 @@ export declare class AuditRepository<C extends AuditConfig> {
      * - Timestamps (createdAt, updatedAt)
      *
      * @param items - Array of audit records to upsert
-     * @returns True when the operation completes (does not check for unprocessed items)
+     * @returns True when the operation completes (retries unprocessed items with exponential backoff; throws if max retries exceeded)
      *
      * @example
      * ```typescript
@@ -197,6 +197,20 @@ export declare class AuditRepository<C extends AuditConfig> {
      * ```
      */
     upsertBatch(items: Array<UpsertAuditInput>): Promise<boolean>;
+    /**
+     * Writes a batch of items to DynamoDB with exponential backoff retry for unprocessed items.
+     *
+     * DynamoDB's BatchWriteItem can return unprocessed items when throttled or under transient
+     * errors without throwing an exception. This method retries those items automatically.
+     *
+     * @param items - Array of WriteRequests to send
+     * @param tableName - Target DynamoDB table name
+     * @param maxRetries - Maximum number of retry attempts (default: 8)
+     * @param baseDelayMs - Initial delay in milliseconds before first retry (default: 100)
+     * @throws Error if unprocessed items remain after maxRetries attempts
+     * @internal
+     */
+    private writeBatchWithRetry;
     /**
      * Upserts a single audit record with atomic attempt tracking.
      *

package/dist/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../src/repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAEL,cAAc,EAKf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EACL,KAAK,KAAK,EAIX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,UAAU,EAA8B,MAAM,mBAAmB,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AASvF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAAE,CAAC;AAiE7E;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qCAAqC;IACrC,YAAY,EAAE,eAAe,CAAC;CAC/B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,WAAW,IAAI;IACpD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,8CAA8C;IAC9C,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qCAAqC;IACrC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;CACpC,CAAC;AAyCF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,WAAW,IAAI;IACzD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,EAAE;QACR,2BAA2B;QAC3B,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC3B,wCAAwC;QACxC,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,sCAAsC;IACtC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,WAAW,IAAI;IACvD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClB,+BAA+B;IAC/B,QAAQ,CAAC,EAAE;QACT,8BAA8B;QAC9B,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC5B,4BAA4B;QAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,qBAAa,eAAe,CAAC,CAAC,SAAS,WAAW;IAS9C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAVzB;;;;;;OAMG;gBAEgB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,CAAC,EACT,MAAM,GAAE,cAGvB;IAGJ;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,OAAO,CAClB,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,GACnD,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAwB7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACU,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA4D1E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,UAAU,CACrB,IAAI,EAAE,gBAAgB,EACtB,cAAc,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;KACZ,GACA,OAAO,CAAC,MAAM,CAAC;IA8ElB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACU,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuChF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACU,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8DnF;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;CAS1B"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../src/repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAEL,cAAc,EAKf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EACL,KAAK,KAAK,EAIX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,UAAU,EAA8B,MAAM,mBAAmB,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AASvF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAAE,CAAC;AAiE7E;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qCAAqC;IACrC,YAAY,EAAE,eAAe,CAAC;CAC/B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,WAAW,IAAI;IACpD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,8CAA8C;IAC9C,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qCAAqC;IACrC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;CACpC,CAAC;AAyCF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,WAAW,IAAI;IACzD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,EAAE;QACR,2BAA2B;QAC3B,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC3B,wCAAwC;QACxC,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,sCAAsC;IACtC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,WAAW,IAAI;IACvD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClB,+BAA+B;IAC/B,QAAQ,CAAC,EAAE;QACT,8BAA8B;QAC9B,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC5B,4BAA4B;QAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,qBAAa,eAAe,CAAC,CAAC,SAAS,WAAW;IAS9C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAVzB;;;;;;OAMG;gBAEgB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,CAAC,EACT,MAAM,GAAE,cAGvB;IAGJ;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,OAAO,CAClB,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,GACnD,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAwB7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACU,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAqD1E;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAyCjC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,UAAU,CACrB,IAAI,EAAE,gBAAgB,EACtB,cAAc,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;KACZ,GACA,OAAO,CAAC,MAAM,CAAC;IA8ElB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACU,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuChF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACU,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8DnF;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAQrB;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;CAS1B"}

package/dist/repository.js

@@ -126,7 +126,7 @@ export class AuditRepository {
      * - Timestamps (createdAt, updatedAt)
      *
      * @param items - Array of audit records to upsert
-     * @returns True when the operation completes (does not check for unprocessed items)
+     * @returns True when the operation completes (retries unprocessed items with exponential backoff; throws if max retries exceeded)
      *
      * @example
      * ```typescript
@@ -180,13 +180,53 @@ export class AuditRepository {
         for (let i = 0, j = Items.length; i < j; i += BATCH_SIZE) {
             ItemBatches.push(Items.slice(i, i + BATCH_SIZE));
         }
-        await Promise.all(ItemBatches.map((ItemBatch) => this.client.send(new BatchWriteItemCommand({
-            RequestItems: {
-                [DynamoDB.Table.Name()]: ItemBatch,
-            },
-        }))));
+        // Process batches sequentially to reduce risk of triggering additional throttling
+        for (const ItemBatch of ItemBatches) {
+            await this.writeBatchWithRetry(ItemBatch, DynamoDB.Table.Name());
+        }
         return true;
     }
+    /**
+     * Writes a batch of items to DynamoDB with exponential backoff retry for unprocessed items.
+     *
+     * DynamoDB's BatchWriteItem can return unprocessed items when throttled or under transient
+     * errors without throwing an exception. This method retries those items automatically.
+     *
+     * @param items - Array of WriteRequests to send
+     * @param tableName - Target DynamoDB table name
+     * @param maxRetries - Maximum number of retry attempts (default: 8)
+     * @param baseDelayMs - Initial delay in milliseconds before first retry (default: 100)
+     * @throws Error if unprocessed items remain after maxRetries attempts
+     * @internal
+     */
+    async writeBatchWithRetry(items, tableName, maxRetries = 8, baseDelayMs = 100) {
+        let requestItems = { [tableName]: items };
+        let attempt = 0;
+        let delayMs = baseDelayMs;
+        while (attempt <= maxRetries) {
+            const response = await this.client.send(new BatchWriteItemCommand({ RequestItems: requestItems }));
+            const unprocessed = response.UnprocessedItems;
+            if (!unprocessed || Object.keys(unprocessed).length === 0) {
+                return; // all items written successfully
+            }
+            attempt++;
+            if (attempt > maxRetries) {
+                this.logger.error("BatchWriteItem: unprocessed items remain after max retries", {
+                    unprocessed,
+                    attempt,
+                });
+                throw new Error(`BatchWriteItem failed: unprocessed items after ${maxRetries} retries`);
+            }
+            this.logger.warn("BatchWriteItem: retrying unprocessed items", {
+                count: Object.values(unprocessed).flat().length,
+                attempt,
+                delayMs,
+            });
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+            delayMs = Math.min(delayMs * 2, 30_000); // cap at 30 seconds
+            requestItems = unprocessed;
+        }
+    }
     /**
      * Upserts a single audit record with atomic attempt tracking.
      *
@@ -524,11 +564,11 @@ export class AuditRepository {
      * @internal
      */
     transformItem(item) {
-        return Promise.resolve(AuditSchema.parse({
+        return AuditSchema.parse({
             trace: `${item.GSI1_SN_PK}:${item.GSI1_SN_SK}`,
             ...item,
             id: item.id.split("#").pop(),
-        }));
+        });
     }
     /**
      * Transforms a trace listing item into an audit list item payload.

package/dist/repository.utils.d.ts

@@ -1,34 +1,33 @@
 /**
- * Encodes a pagination object into an encrypted token string.
+ * Encodes a pagination object into a base64url token string.
  *
- * Uses AES-256-CTR encryption to obfuscate the DynamoDB LastEvaluatedKey,
- * preventing clients from tampering with pagination state.
- *
- * The token format is: `{iv}:{encryptedData}` where both parts are hex-encoded.
+ * Pagination tokens are opaque cursors representing DynamoDB LastEvaluatedKey
+ * objects. They do not require confidentiality — base64url encoding provides
+ * a compact, URL-safe representation.
  *
  * @param nextPageObject - DynamoDB LastEvaluatedKey object to encode
- * @returns Encrypted pagination token string, or undefined if input is null/undefined
+ * @returns Base64url-encoded pagination token string, or undefined if input is null/undefined
  *
  * @example
  * ```typescript
  * const lastKey = { PK: 'App1.USER', SK: 'audit-123' };
  * const token = encodeNextPageToken(lastKey);
- * // Returns something like: "a1b2c3d4...:e5f6g7h8..."
+ * // Returns a base64url string like: "eyJQSyI6IkFwcDEuVVNFUiIsIlNLIjoiYXVkaXQtMTIzIn0"
  * ```
  */
 export declare function encodeNextPageToken(nextPageObject?: Record<string, string>): string | undefined;
 /**
- * Decodes an encrypted pagination token back into a DynamoDB key object.
+ * Decodes a base64url pagination token back into a DynamoDB key object.
  *
- * Reverses the encryption performed by {@link encodeNextPageToken} to
+ * Reverses the encoding performed by {@link encodeNextPageToken} to
  * restore the original LastEvaluatedKey for DynamoDB queries.
  *
- * @param nextPageString - Encrypted pagination token from a previous response
+ * @param nextPageString - Base64url-encoded pagination token from a previous response
  * @returns Decoded DynamoDB key object, or undefined if input is null/undefined/invalid
  *
  * @example
  * ```typescript
- * const token = "a1b2c3d4...:e5f6g7h8...";
+ * const token = "eyJQSyI6IkFwcDEuVVNFUiIsIlNLIjoiYXVkaXQtMTIzIn0";
  * const lastKey = decodeNextPageToken(token);
  * // Returns: { PK: 'App1.USER', SK: 'audit-123' }
  * ```

package/dist/repository.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.utils.d.ts","sourceRoot":"","sources":["../src/repository.utils.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAgB/F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAuBpC"}
+{"version":3,"file":"repository.utils.d.ts","sourceRoot":"","sources":["../src/repository.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAM/F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAMpC"}

package/dist/repository.utils.js

@@ -1,70 +1,45 @@
-import * as crypto from "node:crypto";
 /**
- * Encryption algorithm used for pagination tokens.
- * AES-256-CTR provides symmetric encryption with counter mode.
- */
-const ENCRYPTION_ALGORITHM = "aes-256-ctr";
-/**
- * Key size in bytes for AES-256 encryption.
- */
-const KEY_SIZE = 32;
-/**
- * Encodes a pagination object into an encrypted token string.
+ * Encodes a pagination object into a base64url token string.
  *
- * Uses AES-256-CTR encryption to obfuscate the DynamoDB LastEvaluatedKey,
- * preventing clients from tampering with pagination state.
- *
- * The token format is: `{iv}:{encryptedData}` where both parts are hex-encoded.
+ * Pagination tokens are opaque cursors representing DynamoDB LastEvaluatedKey
+ * objects. They do not require confidentiality — base64url encoding provides
+ * a compact, URL-safe representation.
  *
  * @param nextPageObject - DynamoDB LastEvaluatedKey object to encode
- * @returns Encrypted pagination token string, or undefined if input is null/undefined
+ * @returns Base64url-encoded pagination token string, or undefined if input is null/undefined
  *
  * @example
  * ```typescript
  * const lastKey = { PK: 'App1.USER', SK: 'audit-123' };
  * const token = encodeNextPageToken(lastKey);
- * // Returns something like: "a1b2c3d4...:e5f6g7h8..."
+ * // Returns a base64url string like: "eyJQSyI6IkFwcDEuVVNFUiIsIlNLIjoiYXVkaXQtMTIzIn0"
  * ```
  */
 export function encodeNextPageToken(nextPageObject) {
     if (nextPageObject == null) {
         return undefined;
     }
-    const nextPageString = JSON.stringify(nextPageObject);
-    const iv = crypto.randomBytes(16);
-    const cipher = crypto.createCipheriv(ENCRYPTION_ALGORITHM, Buffer.concat([Buffer.alloc(KEY_SIZE)], KEY_SIZE), iv);
-    const encrypted = cipher.update(nextPageString);
-    return [iv.toString("hex"), encrypted.toString("hex")].join(":");
+    return Buffer.from(JSON.stringify(nextPageObject)).toString("base64url");
 }
 /**
- * Decodes an encrypted pagination token back into a DynamoDB key object.
+ * Decodes a base64url pagination token back into a DynamoDB key object.
  *
- * Reverses the encryption performed by {@link encodeNextPageToken} to
+ * Reverses the encoding performed by {@link encodeNextPageToken} to
  * restore the original LastEvaluatedKey for DynamoDB queries.
  *
- * @param nextPageString - Encrypted pagination token from a previous response
+ * @param nextPageString - Base64url-encoded pagination token from a previous response
  * @returns Decoded DynamoDB key object, or undefined if input is null/undefined/invalid
  *
  * @example
  * ```typescript
- * const token = "a1b2c3d4...:e5f6g7h8...";
+ * const token = "eyJQSyI6IkFwcDEuVVNFUiIsIlNLIjoiYXVkaXQtMTIzIn0";
  * const lastKey = decodeNextPageToken(token);
  * // Returns: { PK: 'App1.USER', SK: 'audit-123' }
  * ```
  */
 export function decodeNextPageToken(nextPageString) {
-    if (nextPageString == null) {
-        return undefined;
-    }
-    const textParts = nextPageString.split(":");
-    const iv = textParts.shift();
-    if (!iv) {
+    if (nextPageString == null || nextPageString === "") {
         return undefined;
     }
-    const decipher = crypto.createDecipheriv(ENCRYPTION_ALGORITHM, Buffer.concat([Buffer.alloc(KEY_SIZE)], KEY_SIZE), Buffer.from(iv, "hex"));
-    const decrypted = Buffer.concat([
-        decipher.update(Buffer.from(textParts.join(":"), "hex")),
-        decipher.final(),
-    ]);
-    return JSON.parse(decrypted.toString());
+    return JSON.parse(Buffer.from(nextPageString, "base64url").toString());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flipboxlabs/aws-audit-sdk",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "AWS Audit SDK - Core SDK for audit logging and event management",
   "keywords": [
     "audit",