@osva-ai/adapter-artifact-azure 0.0.0-stage → 0.1.1

package/README.md

@@ -1,3 +1,90 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# @osva-ai/adapter-artifact-azure
+
+**A1.2** implementation of `ArtifactBlobStore` backed by [Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/).
+
+> **Deployment integration required.** This package is verified with unit mocks, Azurite, and an external pack consumer. End-to-end production readiness depends on OSVA core registering the adapter in your deployment image and passing M12.4.x acceptance in your environment.
+
+## Registration
+
+Install into the OSVA deployment image alongside **`@osva-ai/contracts@1.1.0-rc.4`** (npm `rc` dist-tag), then use the `registered` artifact storage driver:
+
+```bash
+export OSVA_ARTIFACT_STORAGE_DRIVER=registered
+export OSVA_ARTIFACT_BLOB_STORE_REGISTER_MODULE="@osva-ai/adapter-artifact-azure"
+```
+
+The default export satisfies `RegisteredArtifactBlobStoreModule` (`createArtifactBlobStore`).
+
+## Operator configuration
+
+Credentials and container settings are read from the **environment at factory time**. There are no embedded production credentials and no runtime discovery of adapter packages.
+
+| Variable                                                                                                                                        | Required | Description                                                                                  |
+| ----------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------- |
+| `OSVA_ARTIFACT_AZURE_CONTAINER`                                                                                                                 | Yes      | Existing blob container name (lowercase, 3–63 characters).                                   |
+| `OSVA_ARTIFACT_AZURE_CONNECTION_STRING`                                                                                                         | One of   | Azure Storage connection string.                                                             |
+| `OSVA_ARTIFACT_AZURE_ACCOUNT_NAME`                                                                                                              | One of   | Storage account name (with account key below).                                               |
+| `OSVA_ARTIFACT_AZURE_ACCOUNT_KEY`                                                                                                               | One of   | Storage account key.                                                                         |
+| `OSVA_ARTIFACT_AZURE_BLOB_ENDPOINT`                                                                                                             | No       | Custom blob endpoint (Azurite, private link, sovereign cloud). Used with account name + key. |
+| Set **either** `OSVA_ARTIFACT_AZURE_CONNECTION_STRING` **or** `OSVA_ARTIFACT_AZURE_ACCOUNT_NAME` + `OSVA_ARTIFACT_AZURE_ACCOUNT_KEY`, not both. |
+
+Per-request size limits come from OSVA via `ArtifactBlobWriteInput.maxBytes` (aligned with `ArtifactStorageConfigRegistered.maxBytes`).
+
+## Deployment example (Kubernetes)
+
+```yaml
+env:
+  - name: OSVA_ARTIFACT_STORAGE_DRIVER
+    value: registered
+  - name: OSVA_ARTIFACT_BLOB_STORE_REGISTER_MODULE
+    value: "@osva-ai/adapter-artifact-azure"
+  - name: OSVA_ARTIFACT_AZURE_CONTAINER
+    value: osva-artifacts
+  - name: OSVA_ARTIFACT_AZURE_CONNECTION_STRING
+    valueFrom:
+      secretKeyRef:
+        name: osva-azure-storage
+        key: connection-string
+```
+
+Provision the container and IAM outside OSVA (Terraform, Bicep, Azure Portal). OSVA core retains metadata, authorization, and workspace isolation in PostgreSQL.
+
+## Semantics
+
+Aligned with [artifact adapter architecture](../../docs/architecture/ARTIFACT_ADAPTERS.md) and A1.1 reference behavior:
+
+- **Writes** stage to a pending blob, verify SHA-256 (and optional `expectedDigest`), then copy into the final key so failed uploads are not visible via `open`.
+- **Overwrite:** last successful `write` replaces prior bytes.
+- **Missing `open`:** `ARTIFACT_UNAVAILABLE`.
+- **`delete`:** idempotent (`deleteIfExists`).
+- **Streaming:** bounded upload buffer (4 MiB); digest computed while streaming.
+- **Errors:** Azure messages are sanitized before surfacing (no account keys or signatures in logs/errors).
+
+## Known limitations (Azure / Azurite)
+
+- **Staging + copy:** writes land in a pending blob (`.__osva_pending.<uuid>`) and copy to the final key; copy must report success before `write` returns.
+- **Cleanup:** pending blob deletion is best-effort in `finally` (failures are not propagated after a successful copy).
+- **Concurrency:** concurrent writes to the same key are not serialized; last successful copy wins (Azure last-writer-wins).
+- **Azurite vs production:** local Azurite and A1.4 Docker acceptance prove registered-driver wiring and cross-process behavior against an emulator — not Azure SLA, IAM edge cases, or private-link-only endpoints.
+
+## Local development (Azurite)
+
+```bash
+docker compose -f packages/artifact-azure/docker-compose.azurite.yml up -d
+export OSVA_ARTIFACT_AZURE_INTEGRATION=1
+export OSVA_ARTIFACT_AZURE_CONTAINER=osva-artifacts-dev
+export OSVA_ARTIFACT_AZURE_CONNECTION_STRING="DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://127.0.0.1:10000/devstoreaccount1;"
+pnpm --filter @osva-ai/adapter-artifact-azure test:integration
+```
+
+## Install (npm)
+
+```bash
+npm install @osva-ai/adapter-artifact-azure @osva-ai/contracts@1.1.0-rc.4
+```
+
+Requires Node.js `>=24`. See [COMPATIBILITY.md](../../COMPATIBILITY.md) and [MAINTAINER_RELEASE.md](../../docs/release/MAINTAINER_RELEASE.md) for release pinning.
+
+## Errors
+
+Throws `ArtifactBlobStoreError` with `code` from `ARTIFACT_ERROR_CODES` in `@osva-ai/contracts`.

package/dist/azure-artifact-blob-store.d.ts

@@ -0,0 +1,41 @@
+import { BlobServiceClient } from "@azure/storage-blob";
+import { type ArtifactBlobReadHandle, type ArtifactBlobStore, type ArtifactBlobWriteInput, type ArtifactBlobWriteResult, type ArtifactStorageConfigRegistered, type RegisteredArtifactBlobStoreModule } from "@osva-ai/contracts";
+import { type ResolvedAzureArtifactConfig } from "./config.js";
+export interface AzureCopyPollResult {
+    readonly copyStatus?: string | undefined;
+}
+export interface AzureBlockBlobLike {
+    readonly url: string;
+    uploadStream(stream: NodeJS.ReadableStream, bufferSize: number, maxConcurrency: number, options?: unknown): Promise<unknown>;
+    beginCopyFromURL(sourceUrl: string): Promise<{
+        pollUntilDone(): Promise<AzureCopyPollResult>;
+    }>;
+    deleteIfExists(): Promise<unknown>;
+    getProperties(): Promise<{
+        contentLength?: number | undefined;
+    }>;
+    download(offset: number): Promise<{
+        readableStreamBody?: NodeJS.ReadableStream | undefined;
+    }>;
+}
+export interface AzureBlobContainerLike {
+    getBlockBlobClient(blobName: string): AzureBlockBlobLike;
+}
+export interface AzureArtifactBlobStoreOptions {
+    readonly containerClient: AzureBlobContainerLike;
+    readonly registeredMaxBytes?: number | undefined;
+}
+export declare class AzureArtifactBlobStore implements ArtifactBlobStore {
+    private readonly containerClient;
+    private readonly registeredMaxBytes;
+    constructor(options: AzureArtifactBlobStoreOptions);
+    write(input: ArtifactBlobWriteInput): Promise<ArtifactBlobWriteResult>;
+    open(key: string): Promise<ArtifactBlobReadHandle>;
+    delete(key: string): Promise<void>;
+}
+export declare function createAzureArtifactBlobStoreFromConfig(config: ResolvedAzureArtifactConfig, registeredMaxBytes?: number): AzureArtifactBlobStore;
+export declare function createAzureArtifactBlobStoreFromClient(blobServiceClient: BlobServiceClient, containerName: string, registeredMaxBytes?: number): AzureArtifactBlobStore;
+export declare function createArtifactBlobStore(config: ArtifactStorageConfigRegistered): AzureArtifactBlobStore;
+declare const moduleShape: RegisteredArtifactBlobStoreModule;
+export default moduleShape;
+//# sourceMappingURL=azure-artifact-blob-store.d.ts.map

package/dist/azure-artifact-blob-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-artifact-blob-store.d.ts","sourceRoot":"","sources":["../src/azure-artifact-blob-store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAa,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,+BAA+B,EACpC,KAAK,iCAAiC,EACvC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,2BAA2B,EAEjC,MAAM,aAAa,CAAC;AAgBrB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,YAAY,CACV,MAAM,EAAE,MAAM,CAAC,cAAc,EAC7B,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,gBAAgB,CACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,aAAa,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9D,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,aAAa,IAAI,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;IACjE,QAAQ,CACN,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAAC;CAC1D;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,qBAAa,sBAAuB,YAAW,iBAAiB;IAC9D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyB;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;gBAE5C,OAAO,EAAE,6BAA6B;IAK5C,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAgDtE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA2BlD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYzC;AAED,wBAAgB,sCAAsC,CACpD,MAAM,EAAE,2BAA2B,EACnC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,sBAAsB,CAKxB;AAED,wBAAgB,sCAAsC,CACpD,iBAAiB,EAAE,iBAAiB,EACpC,aAAa,EAAE,MAAM,EACrB,kBAAkB,CAAC,EAAE,MAAM,GAC1B,sBAAsB,CAIxB;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,+BAA+B,GACtC,sBAAsB,CAQxB;AAED,QAAA,MAAM,WAAW,EAAE,iCAElB,CAAC;AAEF,eAAe,WAAW,CAAC"}

package/dist/azure-artifact-blob-store.js

@@ -0,0 +1,165 @@
+import { randomUUID } from "node:crypto";
+import { Readable } from "node:stream";
+import { BlobServiceClient, RestError } from "@azure/storage-blob";
+import { SHA256_INTEGRITY_PREFIX, isSha256IntegrityDigest, } from "@osva-ai/contracts";
+import { resolveAzureArtifactConfigFromEnv, } from "./config.js";
+import { ArtifactBlobStoreError, blobUnavailable, digestMismatch, invalidRequest, } from "./errors.js";
+import { sanitizeExternalMessage } from "./sanitize.js";
+import { createDigestingReadable, uploadBufferSizeBytes, } from "./stream-digest.js";
+const SAFE_BLOB_KEY_PATTERN = /^[a-zA-Z0-9._/-]+$/;
+const STAGING_SUFFIX = ".__osva_pending.";
+export class AzureArtifactBlobStore {
+    containerClient;
+    registeredMaxBytes;
+    constructor(options) {
+        this.containerClient = options.containerClient;
+        this.registeredMaxBytes = options.registeredMaxBytes;
+    }
+    async write(input) {
+        assertSafeBlobKey(input.key);
+        const effectiveMaxBytes = resolveEffectiveMaxBytes(input.maxBytes, this.registeredMaxBytes);
+        assertWriteLimits(input, effectiveMaxBytes);
+        const stagingKey = `${input.key}${STAGING_SUFFIX}${randomUUID()}`;
+        const stagingClient = this.containerClient.getBlockBlobClient(stagingKey);
+        const { stream, digestPromise } = createDigestingReadable(input.content, effectiveMaxBytes);
+        try {
+            const { sizeBytes, digest } = await Promise.all([
+                digestPromise,
+                stagingClient.uploadStream(stream, uploadBufferSizeBytes(), 5, {
+                    blobHTTPHeaders: { blobContentType: "application/octet-stream" },
+                }),
+            ]).then(([digestResult]) => digestResult);
+            if (input.expectedDigest !== undefined &&
+                input.expectedDigest !== digest) {
+                throw digestMismatch();
+            }
+            const destination = this.containerClient.getBlockBlobClient(input.key);
+            await copyBlobReplace(destination, stagingClient);
+            return { sizeBytes, digest };
+        }
+        catch (error) {
+            if (error instanceof ArtifactBlobStoreError) {
+                throw error;
+            }
+            throw mapAzureError(error, input.key);
+        }
+        finally {
+            try {
+                await stagingClient.deleteIfExists();
+            }
+            catch {
+                // Best-effort staging cleanup; do not mask the write error.
+            }
+        }
+    }
+    async open(key) {
+        assertSafeBlobKey(key);
+        const blobClient = this.containerClient.getBlockBlobClient(key);
+        try {
+            const properties = await blobClient.getProperties();
+            const sizeBytes = properties.contentLength ?? 0;
+            const download = await blobClient.download(0);
+            const body = download.readableStreamBody;
+            if (body === undefined) {
+                throw blobUnavailable(key);
+            }
+            const nodeStream = Readable.from(body);
+            return {
+                sizeBytes,
+                stream: nodeStream,
+            };
+        }
+        catch (error) {
+            if (error instanceof ArtifactBlobStoreError) {
+                throw error;
+            }
+            throw mapAzureOpenError(error, key);
+        }
+    }
+    async delete(key) {
+        assertSafeBlobKey(key);
+        const blobClient = this.containerClient.getBlockBlobClient(key);
+        try {
+            await blobClient.deleteIfExists();
+        }
+        catch (error) {
+            if (error instanceof ArtifactBlobStoreError) {
+                throw error;
+            }
+            throw mapAzureError(error, key);
+        }
+    }
+}
+export function createAzureArtifactBlobStoreFromConfig(config, registeredMaxBytes) {
+    const containerClient = config.blobServiceClient.getContainerClient(config.containerName);
+    return new AzureArtifactBlobStore({ containerClient, registeredMaxBytes });
+}
+export function createAzureArtifactBlobStoreFromClient(blobServiceClient, containerName, registeredMaxBytes) {
+    const containerClient = blobServiceClient.getContainerClient(containerName);
+    return new AzureArtifactBlobStore({ containerClient, registeredMaxBytes });
+}
+export function createArtifactBlobStore(config) {
+    const azureConfig = resolveAzureArtifactConfigFromEnv();
+    return new AzureArtifactBlobStore({
+        containerClient: azureConfig.blobServiceClient.getContainerClient(azureConfig.containerName),
+        registeredMaxBytes: config.maxBytes,
+    });
+}
+const moduleShape = {
+    createArtifactBlobStore,
+};
+export default moduleShape;
+async function copyBlobReplace(destination, source) {
+    const copyPoller = await destination.beginCopyFromURL(source.url);
+    const copyResult = await copyPoller.pollUntilDone();
+    if (copyResult.copyStatus !== undefined &&
+        copyResult.copyStatus !== "success") {
+        throw invalidRequest("Azure Blob Storage copy to destination failed.");
+    }
+}
+function resolveEffectiveMaxBytes(requestMaxBytes, registeredMaxBytes) {
+    if (registeredMaxBytes === undefined) {
+        return requestMaxBytes;
+    }
+    return Math.min(requestMaxBytes, registeredMaxBytes);
+}
+function assertWriteLimits(input, effectiveMaxBytes) {
+    if (!Number.isFinite(effectiveMaxBytes) || effectiveMaxBytes < 0) {
+        throw invalidRequest("maxBytes must be a non-negative finite number.");
+    }
+    if (input.expectedDigest !== undefined &&
+        !isSha256IntegrityDigest(input.expectedDigest)) {
+        throw invalidRequest(`expectedDigest must use the ${SHA256_INTEGRITY_PREFIX} prefix with 64 hex digits.`);
+    }
+}
+function assertSafeBlobKey(key) {
+    if (typeof key !== "string" || key.length === 0) {
+        throw invalidRequest("Blob key is required.");
+    }
+    if (!SAFE_BLOB_KEY_PATTERN.test(key) ||
+        key.includes("..") ||
+        key.includes(STAGING_SUFFIX)) {
+        throw invalidRequest("Blob key contains unsupported characters.");
+    }
+}
+function mapAzureOpenError(error, key) {
+    if (error instanceof RestError && error.statusCode === 404) {
+        return blobUnavailable(key);
+    }
+    return mapAzureError(error, key);
+}
+function mapAzureError(error, key) {
+    if (error instanceof RestError) {
+        if (error.statusCode === 404) {
+            return blobUnavailable(key);
+        }
+        return invalidRequest(sanitizeExternalMessage(error.message.length > 0
+            ? error.message
+            : "Azure Blob Storage request failed."));
+    }
+    if (error instanceof Error) {
+        return invalidRequest(sanitizeExternalMessage(error.message));
+    }
+    return invalidRequest("Azure Blob Storage request failed.");
+}
+//# sourceMappingURL=azure-artifact-blob-store.js.map

package/dist/azure-artifact-blob-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-artifact-blob-store.js","sourceRoot":"","sources":["../src/azure-artifact-blob-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GAOxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,iCAAiC,GAClC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,qBAAqB,GAAG,oBAAoB,CAAC;AACnD,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAiC1C,MAAM,OAAO,sBAAsB;IAChB,eAAe,CAAyB;IACxC,kBAAkB,CAAqB;IAExD,YAAY,OAAsC;QAChD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA6B;QACvC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,KAAK,CAAC,QAAQ,EACd,IAAI,CAAC,kBAAkB,CACxB,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QAE5C,MAAM,UAAU,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,cAAc,GAAG,UAAU,EAAE,EAAE,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAE1E,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,uBAAuB,CACvD,KAAK,CAAC,OAAO,EACb,iBAAiB,CAClB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9C,aAAa;gBACb,aAAa,CAAC,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC,EAAE;oBAC7D,eAAe,EAAE,EAAE,eAAe,EAAE,0BAA0B,EAAE;iBACjE,CAAC;aACH,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;YAE1C,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;gBAClC,KAAK,CAAC,cAAc,KAAK,MAAM,EAC/B,CAAC;gBACD,MAAM,cAAc,EAAE,CAAC;YACzB,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvE,MAAM,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAClD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,cAAc,EAAE,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC;YACpD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,IAAI,CAAC,CAAC;YAEhD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,kBAAkB,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;YAED,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAiC,CAAC,CAAC;YACpE,OAAO;gBACL,SAAS;gBACT,MAAM,EAAE,UAAU;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,cAAc,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAmC,EACnC,kBAA2B;IAE3B,MAAM,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,CACjE,MAAM,CAAC,aAAa,CACrB,CAAC;IACF,OAAO,IAAI,sBAAsB,CAAC,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,iBAAoC,EACpC,aAAqB,EACrB,kBAA2B;IAE3B,MAAM,eAAe,GACnB,iBAAiB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACtD,OAAO,IAAI,sBAAsB,CAAC,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAuC;IAEvC,MAAM,WAAW,GAAG,iCAAiC,EAAE,CAAC;IACxD,OAAO,IAAI,sBAAsB,CAAC;QAChC,eAAe,EAAE,WAAW,CAAC,iBAAiB,CAAC,kBAAkB,CAC/D,WAAW,CAAC,aAAa,CAC1B;QACD,kBAAkB,EAAE,MAAM,CAAC,QAAQ;KACpC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,WAAW,GAAsC;IACrD,uBAAuB;CACxB,CAAC;AAEF,eAAe,WAAW,CAAC;AAE3B,KAAK,UAAU,eAAe,CAC5B,WAA+B,EAC/B,MAA0B;IAE1B,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,aAAa,EAAE,CAAC;IACpD,IACE,UAAU,CAAC,UAAU,KAAK,SAAS;QACnC,UAAU,CAAC,UAAU,KAAK,SAAS,EACnC,CAAC;QACD,MAAM,cAAc,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,eAAuB,EACvB,kBAAsC;IAEtC,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA6B,EAC7B,iBAAyB;IAEzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,cAAc,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IAED,IACE,KAAK,CAAC,cAAc,KAAK,SAAS;QAClC,CAAC,uBAAuB,CAAC,KAAK,CAAC,cAAc,CAAC,EAC9C,CAAC;QACD,MAAM,cAAc,CAClB,+BAA+B,uBAAuB,6BAA6B,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,cAAc,CAAC,uBAAuB,CAAC,CAAC;IAChD,CAAC;IAED,IACE,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAC5B,CAAC;QACD,MAAM,cAAc,CAAC,2CAA2C,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,GAAW;IAEX,IAAI,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC3D,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,GAAW;IAChD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAC7B,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,cAAc,CACnB,uBAAuB,CACrB,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACtB,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,oCAAoC,CACzC,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,cAAc,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,cAAc,CAAC,oCAAoC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,15 @@
+import { BlobServiceClient } from "@azure/storage-blob";
+/** Environment variables read at factory time (operator-controlled). */
+export declare const AZURE_ARTIFACT_ENV: {
+    readonly CONTAINER: "OSVA_ARTIFACT_AZURE_CONTAINER";
+    readonly CONNECTION_STRING: "OSVA_ARTIFACT_AZURE_CONNECTION_STRING";
+    readonly ACCOUNT_NAME: "OSVA_ARTIFACT_AZURE_ACCOUNT_NAME";
+    readonly ACCOUNT_KEY: "OSVA_ARTIFACT_AZURE_ACCOUNT_KEY";
+    readonly BLOB_ENDPOINT: "OSVA_ARTIFACT_AZURE_BLOB_ENDPOINT";
+};
+export interface ResolvedAzureArtifactConfig {
+    readonly containerName: string;
+    readonly blobServiceClient: BlobServiceClient;
+}
+export declare function resolveAzureArtifactConfigFromEnv(): ResolvedAzureArtifactConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AAK7B,wEAAwE;AACxE,eAAO,MAAM,kBAAkB;;;;;;CAMrB,CAAC;AAEX,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;CAC/C;AAmDD,wBAAgB,iCAAiC,IAAI,2BAA2B,CA0C/E"}

package/dist/config.js

@@ -0,0 +1,72 @@
+import { BlobServiceClient, StorageSharedKeyCredential, } from "@azure/storage-blob";
+import { configurationError } from "./errors.js";
+import { sanitizeExternalMessage } from "./sanitize.js";
+/** Environment variables read at factory time (operator-controlled). */
+export const AZURE_ARTIFACT_ENV = {
+    CONTAINER: "OSVA_ARTIFACT_AZURE_CONTAINER",
+    CONNECTION_STRING: "OSVA_ARTIFACT_AZURE_CONNECTION_STRING",
+    ACCOUNT_NAME: "OSVA_ARTIFACT_AZURE_ACCOUNT_NAME",
+    ACCOUNT_KEY: "OSVA_ARTIFACT_AZURE_ACCOUNT_KEY",
+    BLOB_ENDPOINT: "OSVA_ARTIFACT_AZURE_BLOB_ENDPOINT",
+};
+function readNonEmptyEnv(name) {
+    const value = process.env[name]?.trim();
+    return value === undefined || value.length === 0 ? undefined : value;
+}
+function assertSafeContainerName(containerName) {
+    if (!/^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])?$/.test(containerName)) {
+        throw configurationError("OSVA_ARTIFACT_AZURE_CONTAINER must be a valid Azure container name (3–63 lowercase alphanumeric characters and hyphens).");
+    }
+}
+function createClientFromConnectionString(connectionString) {
+    try {
+        return BlobServiceClient.fromConnectionString(connectionString);
+    }
+    catch (error) {
+        const detail = error instanceof Error
+            ? sanitizeExternalMessage(error.message)
+            : "Invalid connection string.";
+        throw configurationError(`Failed to parse ${AZURE_ARTIFACT_ENV.CONNECTION_STRING}: ${detail}`);
+    }
+}
+function createClientFromSharedKey(accountName, accountKey, blobEndpoint) {
+    const credential = new StorageSharedKeyCredential(accountName, accountKey);
+    const url = blobEndpoint ?? `https://${accountName}.blob.core.windows.net`;
+    try {
+        return new BlobServiceClient(url, credential);
+    }
+    catch (error) {
+        const detail = error instanceof Error
+            ? sanitizeExternalMessage(error.message)
+            : "Invalid blob endpoint.";
+        throw configurationError(`Failed to create Azure Blob service client: ${detail}`);
+    }
+}
+export function resolveAzureArtifactConfigFromEnv() {
+    const containerName = readNonEmptyEnv(AZURE_ARTIFACT_ENV.CONTAINER);
+    if (containerName === undefined) {
+        throw configurationError(`${AZURE_ARTIFACT_ENV.CONTAINER} is required for @osva-ai/adapter-artifact-azure.`);
+    }
+    assertSafeContainerName(containerName);
+    const connectionString = readNonEmptyEnv(AZURE_ARTIFACT_ENV.CONNECTION_STRING);
+    const accountName = readNonEmptyEnv(AZURE_ARTIFACT_ENV.ACCOUNT_NAME);
+    const accountKey = readNonEmptyEnv(AZURE_ARTIFACT_ENV.ACCOUNT_KEY);
+    const blobEndpoint = readNonEmptyEnv(AZURE_ARTIFACT_ENV.BLOB_ENDPOINT);
+    if (connectionString !== undefined) {
+        if (accountName !== undefined || accountKey !== undefined) {
+            throw configurationError(`Set either ${AZURE_ARTIFACT_ENV.CONNECTION_STRING} or ${AZURE_ARTIFACT_ENV.ACCOUNT_NAME} + ${AZURE_ARTIFACT_ENV.ACCOUNT_KEY}, not both.`);
+        }
+        return {
+            containerName,
+            blobServiceClient: createClientFromConnectionString(connectionString),
+        };
+    }
+    if (accountName === undefined || accountKey === undefined) {
+        throw configurationError(`Azure credentials are required: set ${AZURE_ARTIFACT_ENV.CONNECTION_STRING} or both ${AZURE_ARTIFACT_ENV.ACCOUNT_NAME} and ${AZURE_ARTIFACT_ENV.ACCOUNT_KEY}.`);
+    }
+    return {
+        containerName,
+        blobServiceClient: createClientFromSharedKey(accountName, accountKey, blobEndpoint),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExD,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,SAAS,EAAE,+BAA+B;IAC1C,iBAAiB,EAAE,uCAAuC;IAC1D,YAAY,EAAE,kCAAkC;IAChD,WAAW,EAAE,iCAAiC;IAC9C,aAAa,EAAE,mCAAmC;CAC1C,CAAC;AAOX,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACvE,CAAC;AAED,SAAS,uBAAuB,CAAC,aAAqB;IACpD,IAAI,CAAC,wCAAwC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAClE,MAAM,kBAAkB,CACtB,0HAA0H,CAC3H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACvC,gBAAwB;IAExB,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK;YACpB,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,4BAA4B,CAAC;QACnC,MAAM,kBAAkB,CACtB,mBAAmB,kBAAkB,CAAC,iBAAiB,KAAK,MAAM,EAAE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,WAAmB,EACnB,UAAkB,EAClB,YAAgC;IAEhC,MAAM,UAAU,GAAG,IAAI,0BAA0B,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,YAAY,IAAI,WAAW,WAAW,wBAAwB,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK;YACpB,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,wBAAwB,CAAC;QAC/B,MAAM,kBAAkB,CACtB,+CAA+C,MAAM,EAAE,CACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,kBAAkB,CACtB,GAAG,kBAAkB,CAAC,SAAS,mDAAmD,CACnF,CAAC;IACJ,CAAC;IACD,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAEvC,MAAM,gBAAgB,GAAG,eAAe,CACtC,kBAAkB,CAAC,iBAAiB,CACrC,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,eAAe,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,eAAe,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEvE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,WAAW,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,kBAAkB,CACtB,cAAc,kBAAkB,CAAC,iBAAiB,OAAO,kBAAkB,CAAC,YAAY,MAAM,kBAAkB,CAAC,WAAW,aAAa,CAC1I,CAAC;QACJ,CAAC;QACD,OAAO;YACL,aAAa;YACb,iBAAiB,EAAE,gCAAgC,CAAC,gBAAgB,CAAC;SACtE,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,kBAAkB,CACtB,uCAAuC,kBAAkB,CAAC,iBAAiB,YAAY,kBAAkB,CAAC,YAAY,QAAQ,kBAAkB,CAAC,WAAW,GAAG,CAChK,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa;QACb,iBAAiB,EAAE,yBAAyB,CAC1C,WAAW,EACX,UAAU,EACV,YAAY,CACb;KACF,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,11 @@
+import { type ArtifactErrorCode } from "@osva-ai/contracts";
+export declare class ArtifactBlobStoreError extends Error {
+    readonly code: ArtifactErrorCode;
+    constructor(code: ArtifactErrorCode, message: string);
+}
+export declare function payloadTooLarge(maxBytes: number): ArtifactBlobStoreError;
+export declare function digestMismatch(): ArtifactBlobStoreError;
+export declare function blobUnavailable(key: string): ArtifactBlobStoreError;
+export declare function invalidRequest(message: string): ArtifactBlobStoreError;
+export declare function configurationError(message: string): ArtifactBlobStoreError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAE5B,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;gBAErB,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAKxE;AAED,wBAAgB,cAAc,IAAI,sBAAsB,CAKvD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAKnE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CAKtE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CAK1E"}

package/dist/errors.js

@@ -0,0 +1,25 @@
+import { ARTIFACT_ERROR_CODES, } from "@osva-ai/contracts";
+export class ArtifactBlobStoreError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ArtifactBlobStoreError";
+        this.code = code;
+    }
+}
+export function payloadTooLarge(maxBytes) {
+    return new ArtifactBlobStoreError(ARTIFACT_ERROR_CODES.ARTIFACT_PAYLOAD_TOO_LARGE, `Artifact payload exceeds maxBytes (${String(maxBytes)}).`);
+}
+export function digestMismatch() {
+    return new ArtifactBlobStoreError(ARTIFACT_ERROR_CODES.ARTIFACT_DIGEST_MISMATCH, "Artifact digest does not match expectedDigest.");
+}
+export function blobUnavailable(key) {
+    return new ArtifactBlobStoreError(ARTIFACT_ERROR_CODES.ARTIFACT_UNAVAILABLE, `Artifact blob is unavailable for key '${key}'.`);
+}
+export function invalidRequest(message) {
+    return new ArtifactBlobStoreError(ARTIFACT_ERROR_CODES.ARTIFACT_INVALID_REQUEST, message);
+}
+export function configurationError(message) {
+    return new ArtifactBlobStoreError(ARTIFACT_ERROR_CODES.ARTIFACT_INVALID_REQUEST, message);
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,CAAoB;IAEjC,YAAY,IAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,IAAI,sBAAsB,CAC/B,oBAAoB,CAAC,0BAA0B,EAC/C,sCAAsC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,sBAAsB,CAC/B,oBAAoB,CAAC,wBAAwB,EAC7C,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,sBAAsB,CAC/B,oBAAoB,CAAC,oBAAoB,EACzC,yCAAyC,GAAG,IAAI,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,IAAI,sBAAsB,CAC/B,oBAAoB,CAAC,wBAAwB,EAC7C,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,IAAI,sBAAsB,CAC/B,oBAAoB,CAAC,wBAAwB,EAC7C,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { createArtifactBlobStore } from "./azure-artifact-blob-store.js";
+export { default as registeredArtifactBlobStoreModule } from "./azure-artifact-blob-store.js";
+export { ArtifactBlobStoreError, blobUnavailable, digestMismatch, invalidRequest, payloadTooLarge, } from "./errors.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,iCAAiC,EAAE,MAAM,gCAAgC,CAAC;AAC9F,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { createArtifactBlobStore } from "./azure-artifact-blob-store.js";
+export { default as registeredArtifactBlobStoreModule } from "./azure-artifact-blob-store.js";
+export { ArtifactBlobStoreError, blobUnavailable, digestMismatch, invalidRequest, payloadTooLarge, } from "./errors.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,iCAAiC,EAAE,MAAM,gCAAgC,CAAC;AAC9F,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,aAAa,CAAC"}

package/dist/sanitize.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeExternalMessage(message: string): string;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAYA,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAM/D"}

package/dist/sanitize.js

@@ -0,0 +1,19 @@
+const SECRET_PATTERNS = [
+    /AccountKey=[^;\s]+/gi,
+    /SharedAccessSignature=[^;\s]+/gi,
+    /DefaultEndpointsProtocol=[^;\s]+;AccountName=[^;\s]+;AccountKey=[^;\s]+/gi,
+    /sig=[^&\s]+/gi,
+    /se=[^&\s]+/gi,
+    /sp=[^&\s]+/gi,
+    /sv=[^&\s]+/gi,
+    /sr=[^&\s]+/gi,
+    /Bearer\s+[A-Za-z0-9\-._~+/]+=*/gi,
+];
+export function sanitizeExternalMessage(message) {
+    let sanitized = message;
+    for (const pattern of SECRET_PATTERNS) {
+        sanitized = sanitized.replace(pattern, "[redacted]");
+    }
+    return sanitized;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAsB;IACzC,sBAAsB;IACtB,iCAAiC;IACjC,2EAA2E;IAC3E,eAAe;IACf,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,kCAAkC;CACnC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/stream-digest.d.ts

@@ -0,0 +1,12 @@
+import { PassThrough } from "node:stream";
+import { type ArtifactBlobContentStream } from "@osva-ai/contracts";
+export interface DigestingStreamResult {
+    readonly stream: PassThrough;
+    readonly digestPromise: Promise<{
+        sizeBytes: number;
+        digest: string;
+    }>;
+}
+export declare function uploadBufferSizeBytes(): number;
+export declare function createDigestingReadable(content: ArtifactBlobContentStream, maxBytes: number): DigestingStreamResult;
+//# sourceMappingURL=stream-digest.d.ts.map

package/dist/stream-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-digest.d.ts","sourceRoot":"","sources":["../src/stream-digest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAEL,KAAK,yBAAyB,EAC/B,MAAM,oBAAoB,CAAC;AAQ5B,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxE;AAID,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,MAAM,GACf,qBAAqB,CAoDvB"}

package/dist/stream-digest.js

@@ -0,0 +1,51 @@
+import { createHash } from "node:crypto";
+import { PassThrough } from "node:stream";
+import { SHA256_INTEGRITY_PREFIX, } from "@osva-ai/contracts";
+import { ArtifactBlobStoreError, invalidRequest, payloadTooLarge, } from "./errors.js";
+const UPLOAD_BUFFER_SIZE = 4 * 1024 * 1024;
+export function uploadBufferSizeBytes() {
+    return UPLOAD_BUFFER_SIZE;
+}
+export function createDigestingReadable(content, maxBytes) {
+    if (!Number.isFinite(maxBytes) || maxBytes < 0) {
+        throw invalidRequest("maxBytes must be a non-negative finite number.");
+    }
+    const pass = new PassThrough({ highWaterMark: UPLOAD_BUFFER_SIZE });
+    const hash = createHash("sha256");
+    let sizeBytes = 0;
+    const digestPromise = (async () => {
+        try {
+            for await (const chunk of content) {
+                if (chunk === undefined || chunk === null) {
+                    throw invalidRequest("Artifact content stream yielded an empty chunk.");
+                }
+                const buffer = Buffer.from(chunk);
+                sizeBytes += buffer.length;
+                if (sizeBytes > maxBytes) {
+                    throw payloadTooLarge(maxBytes);
+                }
+                hash.update(buffer);
+                const canContinue = pass.write(buffer);
+                if (!canContinue) {
+                    await new Promise((resolve) => pass.once("drain", resolve));
+                }
+            }
+            pass.end();
+            return {
+                sizeBytes,
+                digest: `${SHA256_INTEGRITY_PREFIX}${hash.digest("hex")}`,
+            };
+        }
+        catch (error) {
+            pass.destroy(error instanceof Error ? error : new Error("Stream pipeline failed."));
+            if (error instanceof ArtifactBlobStoreError) {
+                throw error;
+            }
+            throw invalidRequest(error instanceof Error
+                ? error.message
+                : "Artifact content stream failed.");
+        }
+    })();
+    return { stream: pass, digestPromise };
+}
+//# sourceMappingURL=stream-digest.js.map

package/dist/stream-digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-digest.js","sourceRoot":"","sources":["../src/stream-digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,uBAAuB,GAExB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,eAAe,GAChB,MAAM,aAAa,CAAC;AAOrB,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,MAAM,UAAU,qBAAqB;IACnC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAkC,EAClC,QAAgB;IAEhB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,cAAc,CAAC,gDAAgD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,MAAM,aAAa,GAAG,CAAC,KAAK,IAGzB,EAAE;QACH,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC1C,MAAM,cAAc,CAClB,iDAAiD,CAClD,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC;gBAC3B,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;oBACzB,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAClC,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACpB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,OAAO;gBACL,SAAS;gBACT,MAAM,EAAE,GAAG,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC1D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CACtE,CAAC;YACF,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,cAAc,CAClB,KAAK,YAAY,KAAK;gBACpB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,iCAAiC,CACtC,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACzC,CAAC"}

package/package.json

@@ -1,6 +1,46 @@
-{
-  "name": "@osva-ai/adapter-artifact-azure",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "@osva-ai/adapter-artifact-azure",
+  "version": "0.1.1",
+  "description": "Azure Blob Storage ArtifactBlobStore adapter for OSVA (operator-configured credentials)",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Osva-AI/osva-adapters.git",
+    "directory": "packages/artifact-azure"
+  },
+  "homepage": "https://github.com/Osva-AI/osva-adapters/tree/main/packages/artifact-azure",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "lint": "eslint .",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
+    "test": "vitest run --config vitest.config.ts",
+    "test:integration": "vitest run --config vitest.config.ts --testNamePattern Azurite"
+  },
+  "dependencies": {
+    "@azure/storage-blob": "catalog:",
+    "@osva-ai/contracts": "1.1.0-rc.4"
+  },
+  "devDependencies": {
+    "@types/node": "catalog:",
+    "eslint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  }
+}