@flipboxlabs/aws-audit-sdk 1.2.0 → 1.2.3

package/dist/audits.js

@@ -120,7 +120,7 @@ export class Audits {
      * @param item - The audit entry to buffer
      */
     addAudit(item) {
-        if (Object.keys(this.storedAudits).length >= MAX_AUDITS_SIZE) {
+        if (this.storedAudits.length >= MAX_AUDITS_SIZE) {
             this.publishStoredAudits();
         }
         this.config.schemas.resourceReference.parse(item.target);

package/dist/config.d.ts

@@ -1,4 +1,8 @@
 import * as z from "zod/v4";
+/**
+ * Default TTL for audit records in seconds (90 days).
+ */
+export declare const DEFAULT_TTL_SECONDS: number;
 /**
  * Input configuration for defining audit apps and resource types.
  */
@@ -6,6 +10,12 @@ export interface AuditConfigInput {
     readonly apps: readonly string[];
     readonly resourceTypes: readonly string[];
     readonly service?: string;
+    /**
+     * Time-to-live for audit records in seconds.
+     * DynamoDB will automatically delete records after this period.
+     * @default 7776000 (90 days)
+     */
+    readonly ttlSeconds?: number;
 }
 /**
  * Creates an audit configuration object with typed schemas.
@@ -33,9 +43,9 @@ export interface AuditConfigInput {
  * config.schemas.app.parse('Invalid'); // ❌ throws
  * ```
  */
-export declare function defineAuditConfig<const C extends AuditConfigInput>(input: C): {
-    service: string | undefined;
-} & C & {
+export declare function defineAuditConfig<const C extends AuditConfigInput>(input: C): C & {
+    ttlSeconds: number;
+    readonly service: string | undefined;
     schemas: {
         app: z.ZodEnum<{
             [x: string]: string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,CAAC,SAAS,gBAAgB,EAAE,KAAK,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;YAkB1D;QACZ,GAAG,oBAAM;QACT,YAAY,6BAAe;KAC5B;EAEJ;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;GAEG;AACH,eAAO,MAAM,mBAAmB,QAAoB,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,CAAC,SAAS,gBAAgB,EAAE,KAAK,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;YAqB1D;QACZ,GAAG,oBAAM;QACT,YAAY,6BAAe;KAC5B;EAEJ;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/config.js

@@ -1,4 +1,8 @@
 import * as z from "zod/v4";
+/**
+ * Default TTL for audit records in seconds (90 days).
+ */
+export const DEFAULT_TTL_SECONDS = 60 * 60 * 24 * 90;
 /**
  * Creates an audit configuration object with typed schemas.
  *
@@ -36,8 +40,11 @@ export function defineAuditConfig(input) {
         }),
     };
     return {
-        service: process.env.SERVICE,
         ...input,
+        ttlSeconds: input.ttlSeconds ?? DEFAULT_TTL_SECONDS,
+        get service() {
+            return input.service ?? process.env.SERVICE;
+        },
         schemas,
         _types: {},
     };

package/dist/repository.d.ts

@@ -1,7 +1,7 @@
 import type { Logger } from "@aws-lambda-powertools/logger";
 import { DynamoDBClient } from "@aws-sdk/client-dynamodb";
 import type { NativeAttributeValue } from "@aws-sdk/util-dynamodb";
-import type { AuditConfig } from "./config.js";
+import { type AuditConfig } from "./config.js";
 import { type Audit } from "./schema/audit.js";
 import { type Pagination } from "./schema/model.js";
 import type { UpsertAuditInput } from "./schema/service.js";
@@ -176,7 +176,7 @@ export declare class AuditRepository<C extends AuditConfig> {
      * - Timestamps (createdAt, updatedAt)
      *
      * @param items - Array of audit records to upsert
-     * @returns True when the operation completes (does not check for unprocessed items)
+     * @returns True when the operation completes (retries unprocessed items with exponential backoff; throws if max retries exceeded)
      *
      * @example
      * ```typescript
@@ -197,6 +197,20 @@ export declare class AuditRepository<C extends AuditConfig> {
      * ```
      */
     upsertBatch(items: Array<UpsertAuditInput>): Promise<boolean>;
+    /**
+     * Writes a batch of items to DynamoDB with exponential backoff retry for unprocessed items.
+     *
+     * DynamoDB's BatchWriteItem can return unprocessed items when throttled or under transient
+     * errors without throwing an exception. This method retries those items automatically.
+     *
+     * @param items - Array of WriteRequests to send
+     * @param tableName - Target DynamoDB table name
+     * @param maxRetries - Maximum number of retry attempts (default: 8)
+     * @param baseDelayMs - Initial delay in milliseconds before first retry (default: 100)
+     * @throws Error if unprocessed items remain after maxRetries attempts
+     * @internal
+     */
+    private writeBatchWithRetry;
     /**
      * Upserts a single audit record with atomic attempt tracking.
      *

package/dist/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../src/repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAEL,cAAc,EAKf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EACL,KAAK,KAAK,EAIX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,UAAU,EAA8B,MAAM,mBAAmB,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AASvF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAAE,CAAC;AAiE7E;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qCAAqC;IACrC,YAAY,EAAE,eAAe,CAAC;CAC/B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,WAAW,IAAI;IACpD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,8CAA8C;IAC9C,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qCAAqC;IACrC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;CACpC,CAAC;AAyCF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,WAAW,IAAI;IACzD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,EAAE;QACR,2BAA2B;QAC3B,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC3B,wCAAwC;QACxC,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,sCAAsC;IACtC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,WAAW,IAAI;IACvD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClB,+BAA+B;IAC/B,QAAQ,CAAC,EAAE;QACT,8BAA8B;QAC9B,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC5B,4BAA4B;QAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,qBAAa,eAAe,CAAC,CAAC,SAAS,WAAW;IAS9C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAVzB;;;;;;OAMG;gBAEgB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,CAAC,EACT,MAAM,GAAE,cAGvB;IAGJ;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,OAAO,CAClB,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,GACnD,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAwB7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACU,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IA4D1E;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,UAAU,CACrB,IAAI,EAAE,gBAAgB,EACtB,cAAc,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;KACZ,GACA,OAAO,CAAC,MAAM,CAAC;IA8ElB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACU,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuChF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACU,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8DnF;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;CAS1B"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../src/repository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAEL,cAAc,EAKf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,EACL,KAAK,KAAK,EAIX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,KAAK,UAAU,EAA8B,MAAM,mBAAmB,CAAC;AAChF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGvF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAA;CAAE,CAAC;AAiE7E;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qCAAqC;IACrC,YAAY,EAAE,eAAe,CAAC;CAC/B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,WAAW,IAAI;IACpD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,8CAA8C;IAC9C,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,qCAAqC;IACrC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;CACpC,CAAC;AAyCF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,WAAW,IAAI;IACzD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,EAAE;QACR,2BAA2B;QAC3B,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC3B,wCAAwC;QACxC,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,sCAAsC;IACtC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,WAAW,IAAI;IACvD,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClB,+BAA+B;IAC/B,QAAQ,CAAC,EAAE;QACT,8BAA8B;QAC9B,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC5B,4BAA4B;QAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,qBAAa,eAAe,CAAC,CAAC,SAAS,WAAW;IAS9C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAVzB;;;;;;OAMG;gBAEgB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,CAAC,EACT,MAAM,GAAE,cAGvB;IAGJ;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,OAAO,CAClB,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,GACnD,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC;IAwB7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACU,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAqD1E;;;;;;;;;;;;OAYG;YACW,mBAAmB;IAyCjC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACU,UAAU,CACrB,IAAI,EAAE,gBAAgB,EACtB,cAAc,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC;KACZ,GACA,OAAO,CAAC,MAAM,CAAC;IA8ElB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACU,SAAS,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuChF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACU,cAAc,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8DnF;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAa3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,sBAAsB;IAc9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAe7B;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAQrB;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;CAS1B"}

package/dist/repository.js

@@ -1,16 +1,12 @@
 import { BatchWriteItemCommand, DynamoDBClient, GetItemCommand, QueryCommand, UpdateItemCommand, } from "@aws-sdk/client-dynamodb";
 import { marshall, unmarshall } from "@aws-sdk/util-dynamodb";
+import { DEFAULT_TTL_SECONDS } from "./config.js";
 import { DynamoDB } from "./constants.js";
 import { decodeNextPageToken, encodeNextPageToken } from "./repository.utils.js";
 import { AuditListItemPayloadSchema, AuditPayloadSchema, AuditSchema, } from "./schema/audit.js";
 import { PaginationCollectionSchema } from "./schema/model.js";
 import { AuditStorageSchema } from "./schema/storage.js";
 import { getTraceParts } from "./utils.js";
-/**
- * Default TTL for audit records in seconds (90 days).
- * Records will be automatically deleted by DynamoDB after this period.
- */
-const DEFAULT_TTL = 60 * 60 * 24 * 90; // 90 days
 /**
  * Repository for managing audit records in DynamoDB.
  *
@@ -126,7 +122,7 @@ export class AuditRepository {
      * - Timestamps (createdAt, updatedAt)
      *
      * @param items - Array of audit records to upsert
-     * @returns True when the operation completes (does not check for unprocessed items)
+     * @returns True when the operation completes (retries unprocessed items with exponential backoff; throws if max retries exceeded)
      *
      * @example
      * ```typescript
@@ -165,7 +161,7 @@ export class AuditRepository {
                             app: payload.target.app,
                         }),
                         ...this.constructSecondaryKeys(payload),
-                        ...this.constructTTLAttribute(DEFAULT_TTL),
+                        ...this.constructTTLAttribute(this.config.ttlSeconds),
                         ...payload,
                     }, {
                         removeUndefinedValues: true,
@@ -180,13 +176,53 @@ export class AuditRepository {
         for (let i = 0, j = Items.length; i < j; i += BATCH_SIZE) {
             ItemBatches.push(Items.slice(i, i + BATCH_SIZE));
         }
-        await Promise.all(ItemBatches.map((ItemBatch) => this.client.send(new BatchWriteItemCommand({
-            RequestItems: {
-                [DynamoDB.Table.Name()]: ItemBatch,
-            },
-        }))));
+        // Process batches sequentially to reduce risk of triggering additional throttling
+        for (const ItemBatch of ItemBatches) {
+            await this.writeBatchWithRetry(ItemBatch, DynamoDB.Table.Name());
+        }
         return true;
     }
+    /**
+     * Writes a batch of items to DynamoDB with exponential backoff retry for unprocessed items.
+     *
+     * DynamoDB's BatchWriteItem can return unprocessed items when throttled or under transient
+     * errors without throwing an exception. This method retries those items automatically.
+     *
+     * @param items - Array of WriteRequests to send
+     * @param tableName - Target DynamoDB table name
+     * @param maxRetries - Maximum number of retry attempts (default: 8)
+     * @param baseDelayMs - Initial delay in milliseconds before first retry (default: 100)
+     * @throws Error if unprocessed items remain after maxRetries attempts
+     * @internal
+     */
+    async writeBatchWithRetry(items, tableName, maxRetries = 8, baseDelayMs = 100) {
+        let requestItems = { [tableName]: items };
+        let attempt = 0;
+        let delayMs = baseDelayMs;
+        while (attempt <= maxRetries) {
+            const response = await this.client.send(new BatchWriteItemCommand({ RequestItems: requestItems }));
+            const unprocessed = response.UnprocessedItems;
+            if (!unprocessed || Object.keys(unprocessed).length === 0) {
+                return; // all items written successfully
+            }
+            attempt++;
+            if (attempt > maxRetries) {
+                this.logger.error("BatchWriteItem: unprocessed items remain after max retries", {
+                    unprocessed,
+                    attempt,
+                });
+                throw new Error(`BatchWriteItem failed: unprocessed items after ${maxRetries} retries`);
+            }
+            this.logger.warn("BatchWriteItem: retrying unprocessed items", {
+                count: Object.values(unprocessed).flat().length,
+                attempt,
+                delayMs,
+            });
+            await new Promise((resolve) => setTimeout(resolve, delayMs));
+            delayMs = Math.min(delayMs * 2, 30_000); // cap at 30 seconds
+            requestItems = unprocessed;
+        }
+    }
     /**
      * Upserts a single audit record with atomic attempt tracking.
      *
@@ -223,7 +259,7 @@ export class AuditRepository {
             app: payload.target.app,
         });
         const secondaryKeys = this.constructSecondaryKeys(payload);
-        const ttlAttribute = this.constructTTLAttribute(DEFAULT_TTL);
+        const ttlAttribute = this.constructTTLAttribute(this.config.ttlSeconds);
         const expressionAttributeNames = {};
         const expressionAttributeValues = {
             ":emptyList": [],
@@ -504,7 +540,7 @@ export class AuditRepository {
      * @returns TTL attribute with Unix timestamp in seconds
      * @internal
      */
-    constructTTLAttribute(ttlSeconds = DEFAULT_TTL, date) {
+    constructTTLAttribute(ttlSeconds = DEFAULT_TTL_SECONDS, date) {
         const ttl = date || new Date();
         if (ttlSeconds) {
             ttl.setSeconds(ttl.getSeconds() + ttlSeconds);
@@ -524,11 +560,11 @@ export class AuditRepository {
      * @internal
      */
     transformItem(item) {
-        return Promise.resolve(AuditSchema.parse({
+        return AuditSchema.parse({
             trace: `${item.GSI1_SN_PK}:${item.GSI1_SN_SK}`,
             ...item,
             id: item.id.split("#").pop(),
-        }));
+        });
     }
     /**
      * Transforms a trace listing item into an audit list item payload.

package/dist/repository.utils.d.ts

@@ -1,34 +1,33 @@
 /**
- * Encodes a pagination object into an encrypted token string.
+ * Encodes a pagination object into a base64url token string.
  *
- * Uses AES-256-CTR encryption to obfuscate the DynamoDB LastEvaluatedKey,
- * preventing clients from tampering with pagination state.
- *
- * The token format is: `{iv}:{encryptedData}` where both parts are hex-encoded.
+ * Pagination tokens are opaque cursors representing DynamoDB LastEvaluatedKey
+ * objects. They do not require confidentiality — base64url encoding provides
+ * a compact, URL-safe representation.
  *
  * @param nextPageObject - DynamoDB LastEvaluatedKey object to encode
- * @returns Encrypted pagination token string, or undefined if input is null/undefined
+ * @returns Base64url-encoded pagination token string, or undefined if input is null/undefined
  *
  * @example
  * ```typescript
  * const lastKey = { PK: 'App1.USER', SK: 'audit-123' };
  * const token = encodeNextPageToken(lastKey);
- * // Returns something like: "a1b2c3d4...:e5f6g7h8..."
+ * // Returns a base64url string like: "eyJQSyI6IkFwcDEuVVNFUiIsIlNLIjoiYXVkaXQtMTIzIn0"
  * ```
  */
 export declare function encodeNextPageToken(nextPageObject?: Record<string, string>): string | undefined;
 /**
- * Decodes an encrypted pagination token back into a DynamoDB key object.
+ * Decodes a base64url pagination token back into a DynamoDB key object.
  *
- * Reverses the encryption performed by {@link encodeNextPageToken} to
+ * Reverses the encoding performed by {@link encodeNextPageToken} to
  * restore the original LastEvaluatedKey for DynamoDB queries.
  *
- * @param nextPageString - Encrypted pagination token from a previous response
+ * @param nextPageString - Base64url-encoded pagination token from a previous response
  * @returns Decoded DynamoDB key object, or undefined if input is null/undefined/invalid
  *
  * @example
  * ```typescript
- * const token = "a1b2c3d4...:e5f6g7h8...";
+ * const token = "eyJQSyI6IkFwcDEuVVNFUiIsIlNLIjoiYXVkaXQtMTIzIn0";
  * const lastKey = decodeNextPageToken(token);
  * // Returns: { PK: 'App1.USER', SK: 'audit-123' }
  * ```

package/dist/repository.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.utils.d.ts","sourceRoot":"","sources":["../src/repository.utils.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAgB/F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAuBpC"}
+{"version":3,"file":"repository.utils.d.ts","sourceRoot":"","sources":["../src/repository.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAM/F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAMpC"}

package/dist/repository.utils.js

@@ -1,70 +1,45 @@
-import * as crypto from "node:crypto";
 /**
- * Encryption algorithm used for pagination tokens.
- * AES-256-CTR provides symmetric encryption with counter mode.
- */
-const ENCRYPTION_ALGORITHM = "aes-256-ctr";
-/**
- * Key size in bytes for AES-256 encryption.
- */
-const KEY_SIZE = 32;
-/**
- * Encodes a pagination object into an encrypted token string.
+ * Encodes a pagination object into a base64url token string.
  *
- * Uses AES-256-CTR encryption to obfuscate the DynamoDB LastEvaluatedKey,
- * preventing clients from tampering with pagination state.
- *
- * The token format is: `{iv}:{encryptedData}` where both parts are hex-encoded.
+ * Pagination tokens are opaque cursors representing DynamoDB LastEvaluatedKey
+ * objects. They do not require confidentiality — base64url encoding provides
+ * a compact, URL-safe representation.
  *
  * @param nextPageObject - DynamoDB LastEvaluatedKey object to encode
- * @returns Encrypted pagination token string, or undefined if input is null/undefined
+ * @returns Base64url-encoded pagination token string, or undefined if input is null/undefined
  *
  * @example
  * ```typescript
  * const lastKey = { PK: 'App1.USER', SK: 'audit-123' };
  * const token = encodeNextPageToken(lastKey);
- * // Returns something like: "a1b2c3d4...:e5f6g7h8..."
+ * // Returns a base64url string like: "eyJQSyI6IkFwcDEuVVNFUiIsIlNLIjoiYXVkaXQtMTIzIn0"
  * ```
  */
 export function encodeNextPageToken(nextPageObject) {
     if (nextPageObject == null) {
         return undefined;
     }
-    const nextPageString = JSON.stringify(nextPageObject);
-    const iv = crypto.randomBytes(16);
-    const cipher = crypto.createCipheriv(ENCRYPTION_ALGORITHM, Buffer.concat([Buffer.alloc(KEY_SIZE)], KEY_SIZE), iv);
-    const encrypted = cipher.update(nextPageString);
-    return [iv.toString("hex"), encrypted.toString("hex")].join(":");
+    return Buffer.from(JSON.stringify(nextPageObject)).toString("base64url");
 }
 /**
- * Decodes an encrypted pagination token back into a DynamoDB key object.
+ * Decodes a base64url pagination token back into a DynamoDB key object.
  *
- * Reverses the encryption performed by {@link encodeNextPageToken} to
+ * Reverses the encoding performed by {@link encodeNextPageToken} to
  * restore the original LastEvaluatedKey for DynamoDB queries.
  *
- * @param nextPageString - Encrypted pagination token from a previous response
+ * @param nextPageString - Base64url-encoded pagination token from a previous response
  * @returns Decoded DynamoDB key object, or undefined if input is null/undefined/invalid
  *
  * @example
  * ```typescript
- * const token = "a1b2c3d4...:e5f6g7h8...";
+ * const token = "eyJQSyI6IkFwcDEuVVNFUiIsIlNLIjoiYXVkaXQtMTIzIn0";
  * const lastKey = decodeNextPageToken(token);
  * // Returns: { PK: 'App1.USER', SK: 'audit-123' }
  * ```
  */
 export function decodeNextPageToken(nextPageString) {
-    if (nextPageString == null) {
-        return undefined;
-    }
-    const textParts = nextPageString.split(":");
-    const iv = textParts.shift();
-    if (!iv) {
+    if (nextPageString == null || nextPageString === "") {
         return undefined;
     }
-    const decipher = crypto.createDecipheriv(ENCRYPTION_ALGORITHM, Buffer.concat([Buffer.alloc(KEY_SIZE)], KEY_SIZE), Buffer.from(iv, "hex"));
-    const decrypted = Buffer.concat([
-        decipher.update(Buffer.from(textParts.join(":"), "hex")),
-        decipher.final(),
-    ]);
-    return JSON.parse(decrypted.toString());
+    return JSON.parse(Buffer.from(nextPageString, "base64url").toString());
 }

package/dist/test-config.d.ts

@@ -3,11 +3,11 @@
  * Provides sample apps and resource types for testing.
  */
 export declare const testConfig: {
-    service: string | undefined;
-} & {
     readonly apps: readonly ["App1", "TestApp"];
     readonly resourceTypes: readonly ["Unknown", "User", "Order"];
 } & {
+    ttlSeconds: number;
+    readonly service: string | undefined;
     schemas: {
         app: import("zod/v4").ZodEnum<{
             [x: string]: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flipboxlabs/aws-audit-sdk",
-  "version": "1.2.0",
+  "version": "1.2.3",
   "description": "AWS Audit SDK - Core SDK for audit logging and event management",
   "keywords": [
     "audit",