@unchainedshop/events 5.0.0-alpha.4 → 5.0.0-alpha.5

package/lib/audit/index.d.ts

@@ -1,11 +1,12 @@
-import { type OCSFEvent, OCSF_AUTH_ACTIVITY, OCSF_ACCOUNT_ACTIVITY, OCSF_API_ACTIVITY } from './ocsf-types.ts';
+import { OCSF_AUTH_ACTIVITY, OCSF_ACCOUNT_ACTIVITY, OCSF_API_ACTIVITY } from './ocsf-types.ts';
 export * from './ocsf-types.ts';
-export interface AuditLogConfig {
-    directory?: string;
+export interface AuditLogOptions {
+    log?: boolean;
     collectorUrl?: string;
     collectorHeaders?: Record<string, string>;
     batchSize?: number;
     flushIntervalMs?: number;
+    maxQueueSize?: number;
 }
 export interface AuthenticationInput {
     activity: (typeof OCSF_AUTH_ACTIVITY)[keyof typeof OCSF_AUTH_ACTIVITY];
@@ -41,55 +42,34 @@ export interface ApiActivityInput {
     httpMethod?: string;
     path?: string;
     responseCode?: number;
-}
-export interface AuditLogQuery {
-    classUids?: number[];
-    activityIds?: number[];
-    userId?: string;
-    success?: boolean;
-    startTime?: Date;
-    endTime?: Date;
-    limit?: number;
-    offset?: number;
-}
-export interface VerifyResult {
-    valid: boolean;
-    entries: number;
-    verified: number;
-    error?: string;
+    data?: Record<string, unknown>;
 }
 export declare class AuditLog {
-    private readonly dir;
+    private readonly logEnabled;
+    private readonly auditLogger;
     private readonly collectorUrl?;
     private readonly collectorHeaders;
     private readonly batchSize;
     private readonly flushIntervalMs;
-    private lastEvent;
-    private writeLock;
-    private initialized;
+    private readonly maxQueueSize;
+    private readonly serviceName;
     private pendingEvents;
+    private droppedEvents;
+    private flushing;
     private flushTimer?;
-    constructor(config?: AuditLogConfig);
-    private getFilePath;
-    private init;
-    private computeHash;
+    constructor(config?: AuditLogOptions);
     private createMetadata;
     private createUser;
     private createEndpoint;
-    private writeEvent;
+    private dispatch;
+    private enqueueForCollector;
+    private capPendingEvents;
     private flushToCollector;
-    private matches;
     logAuthentication(input: AuthenticationInput): Promise<string>;
     logAccountChange(input: AccountChangeInput): Promise<string>;
     logApiActivity(input: ApiActivityInput): Promise<string>;
-    find(query?: AuditLogQuery): Promise<OCSFEvent[]>;
-    count(query?: AuditLogQuery): Promise<number>;
-    getFailedLogins(params: {
-        userId?: string;
-        remoteAddress?: string;
-        since?: Date;
-    }): Promise<number>;
-    verify(): Promise<VerifyResult>;
     close(): Promise<void>;
 }
-export declare function createAuditLog(config?: AuditLogConfig | string): AuditLog;
+export declare function createAuditLog(config?: AuditLogOptions): AuditLog;
+export declare function setAuditLogInstance(instance: AuditLog): void;
+export declare function getAuditLogInstance(): AuditLog | null;

package/lib/audit/index.js

@@ -1,70 +1,36 @@
-import { createHash } from 'node:crypto';
-import { mkdir, readFile, appendFile, readdir } from 'node:fs/promises';
-import { join } from 'node:path';
+import { hostname } from 'node:os';
 import { createLogger } from '@unchainedshop/logger';
-import { OCSF_CLASS, OCSF_CATEGORY, OCSF_SEVERITY, OCSF_STATUS, OCSF_AUTH_ACTIVITY, OCSF_ACCOUNT_ACTIVITY, OCSF_API_ACTIVITY, } from "./ocsf-types.js";
+import { OCSF_CLASS, OCSF_CATEGORY, OCSF_SEVERITY, OCSF_STATUS, OCSF_AUTH_ACTIVITY, OCSF_ACCOUNT_ACTIVITY, OCSF_API_ACTIVITY, OCSF_API_ACTIVITY_NAMES, } from "./ocsf-types.js";
+import { exportLogs, resolveCollectorUrl, resolveCollectorHeaders } from "./otlp.js";
 export * from "./ocsf-types.js";
 const logger = createLogger('unchained:audit');
 const OCSF_VERSION = '1.4.0';
 const PRODUCT_NAME = 'Unchained Engine';
-const PRODUCT_VERSION = '4.5';
+const PRODUCT_VERSION = process.env.npm_package_version || '5.0';
 const PRODUCT_VENDOR = 'Unchained';
-const GENESIS_HASH = '0'.repeat(64);
+const ENGINE_HOSTNAME = hostname();
 export class AuditLog {
-    dir;
+    logEnabled;
+    auditLogger;
     collectorUrl;
     collectorHeaders;
     batchSize;
     flushIntervalMs;
-    lastEvent = null;
-    writeLock = Promise.resolve();
-    initialized = false;
+    maxQueueSize;
+    serviceName;
     pendingEvents = [];
+    droppedEvents = 0;
+    flushing = false;
     flushTimer;
     constructor(config = {}) {
-        this.dir = config.directory || './audit-logs';
-        this.collectorUrl = config.collectorUrl;
-        this.collectorHeaders = config.collectorHeaders || {};
+        this.logEnabled = config.log ?? true;
+        this.auditLogger = createLogger('unchained:audit');
+        this.collectorUrl = resolveCollectorUrl(config.collectorUrl);
+        this.collectorHeaders = resolveCollectorHeaders(config.collectorHeaders);
         this.batchSize = config.batchSize || 10;
         this.flushIntervalMs = config.flushIntervalMs || 5000;
-    }
-    getFilePath() {
-        const date = new Date().toISOString().slice(0, 10);
-        return join(this.dir, `audit-${date}.jsonl`);
-    }
-    async init() {
-        if (this.initialized)
-            return;
-        await mkdir(this.dir, { recursive: true });
-        try {
-            const files = (await readdir(this.dir)).filter((f) => f.endsWith('.jsonl')).sort();
-            for (let i = files.length - 1; i >= 0; i--) {
-                const content = await readFile(join(this.dir, files[i]), 'utf-8');
-                const lines = content.trim().split('\n').filter(Boolean);
-                if (lines.length > 0) {
-                    const parsed = JSON.parse(lines[lines.length - 1]);
-                    if (parsed.unmapped?.hash) {
-                        this.lastEvent = parsed;
-                        break;
-                    }
-                }
-            }
-        }
-        catch {
-        }
-        if (this.collectorUrl && !this.flushTimer) {
-            this.flushTimer = setInterval(() => this.flushToCollector(), this.flushIntervalMs);
-        }
-        this.initialized = true;
-    }
-    computeHash(event) {
-        const { unmapped, ...rest } = event;
-        const toHash = {
-            ...rest,
-            unmapped: unmapped ? { seq: unmapped.seq, prev_hash: unmapped.prev_hash } : undefined,
-        };
-        const data = JSON.stringify(toHash, Object.keys(toHash).sort());
-        return createHash('sha256').update(data, 'utf8').digest('hex');
+        this.maxQueueSize = config.maxQueueSize || 1000;
+        this.serviceName = process.env.OTEL_SERVICE_NAME || 'unchained-engine';
     }
     createMetadata(uid) {
         return {
@@ -89,82 +55,55 @@ export class AuditLog {
             return undefined;
         return { ip };
     }
-    async writeEvent(event) {
-        const result = this.writeLock.then(async () => {
-            await this.init();
-            const prevHash = this.lastEvent?.unmapped?.hash || GENESIS_HASH;
-            const seq = (this.lastEvent?.unmapped?.seq || 0) + 1;
-            const eventWithChain = {
-                ...event,
-                unmapped: {
-                    seq,
-                    prev_hash: prevHash,
-                    hash: '',
-                },
-            };
-            const hash = this.computeHash(eventWithChain);
-            eventWithChain.unmapped.hash = hash;
-            const line = JSON.stringify(eventWithChain);
-            await appendFile(this.getFilePath(), line + '\n', 'utf-8');
-            this.lastEvent = eventWithChain;
-            if (this.collectorUrl) {
-                this.pendingEvents.push(eventWithChain);
-                if (this.pendingEvents.length >= this.batchSize) {
-                    this.flushToCollector().catch((err) => logger.error(`Failed to flush to collector: ${err.message}`));
-                }
+    async dispatch(event) {
+        if (this.logEnabled) {
+            this.auditLogger.info(event.message || 'Audit event', { ocsf: event });
+        }
+        if (this.collectorUrl) {
+            this.enqueueForCollector(event);
+        }
+        return event.metadata.uid;
+    }
+    enqueueForCollector(event) {
+        this.pendingEvents.push(event);
+        this.capPendingEvents();
+        if (!this.flushTimer) {
+            this.flushTimer = setInterval(() => {
+                this.flushToCollector().catch((err) => logger.error(`Failed to flush audit events to collector: ${err.message}`));
+            }, this.flushIntervalMs);
+            this.flushTimer.unref?.();
+        }
+        if (this.pendingEvents.length >= this.batchSize) {
+            this.flushToCollector().catch((err) => logger.error(`Failed to flush audit events to collector: ${err.message}`));
+        }
+    }
+    capPendingEvents() {
+        while (this.pendingEvents.length > this.maxQueueSize) {
+            this.pendingEvents.shift();
+            this.droppedEvents += 1;
+            if (this.droppedEvents === 1 || this.droppedEvents % 100 === 0) {
+                logger.warn(`Audit collector queue exceeded ${this.maxQueueSize} events — dropped ${this.droppedEvents} events so far`);
             }
-            logger.debug(`Audit: ${event.message || 'Event'} [class=${event.class_uid}] seq=${seq}`);
-            return eventWithChain.metadata.uid;
-        });
-        this.writeLock = result;
-        return result;
+        }
     }
     async flushToCollector() {
-        if (!this.collectorUrl || this.pendingEvents.length === 0)
+        if (!this.collectorUrl || this.flushing || this.pendingEvents.length === 0)
             return;
-        const events = [...this.pendingEvents];
+        this.flushing = true;
+        const events = this.pendingEvents;
         this.pendingEvents = [];
         try {
-            const response = await fetch(this.collectorUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    ...this.collectorHeaders,
-                },
-                body: JSON.stringify({ events }),
-            });
-            if (!response.ok) {
-                throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-            }
-            logger.debug(`Flushed ${events.length} events to collector`);
+            await exportLogs(this.collectorUrl, this.collectorHeaders, events);
+            logger.debug(`Flushed ${events.length} audit events to collector`);
         }
         catch (err) {
             this.pendingEvents = [...events, ...this.pendingEvents];
+            this.capPendingEvents();
             throw err;
         }
-    }
-    matches(event, query) {
-        if (query.classUids?.length && !query.classUids.includes(event.class_uid))
-            return false;
-        if (query.activityIds?.length && !query.activityIds.includes(event.activity_id))
-            return false;
-        const userId = 'user' in event ? event.user?.uid : undefined;
-        const actorId = 'actor' in event ? event.actor?.user?.uid : undefined;
-        if (query.userId && userId !== query.userId && actorId !== query.userId)
-            return false;
-        if (query.success !== undefined) {
-            const isSuccess = event.status_id === OCSF_STATUS.SUCCESS;
-            if (query.success !== isSuccess)
-                return false;
-        }
-        if (query.startTime || query.endTime) {
-            const ts = new Date(event.time);
-            if (query.startTime && ts < query.startTime)
-                return false;
-            if (query.endTime && ts > query.endTime)
-                return false;
+        finally {
+            this.flushing = false;
         }
-        return true;
     }
     async logAuthentication(input) {
         const activityId = input.activity;
@@ -183,12 +122,13 @@ export class AuditLog {
             message: input.message || activityMessages[activityId] || 'Authentication Event',
             metadata: this.createMetadata(crypto.randomUUID()),
             user: this.createUser(input.userId, input.userName),
+            service: { name: this.serviceName },
             src_endpoint: this.createEndpoint(input.remoteAddress),
             is_mfa: input.isMfa,
             auth_protocol: input.authProtocol,
             session: input.sessionId ? { uid: input.sessionId } : undefined,
         };
-        return this.writeEvent(event);
+        return this.dispatch(event);
     }
     async logAccountChange(input) {
         const activityId = input.activity;
@@ -220,7 +160,7 @@ export class AuditLog {
                 : undefined,
             src_endpoint: this.createEndpoint(input.remoteAddress),
         };
-        return this.writeEvent(event);
+        return this.dispatch(event);
     }
     async logApiActivity(input) {
         const activityId = input.activity;
@@ -238,11 +178,14 @@ export class AuditLog {
         };
         const isAccessDenied = activityId === OCSF_API_ACTIVITY.ACCESS_DENIED;
         const severity = isAccessDenied || input.success === false ? OCSF_SEVERITY.HIGH : OCSF_SEVERITY.INFORMATIONAL;
+        const isExtensionActivity = activityId >= 90 && activityId < 99;
+        const wireActivityId = isExtensionActivity ? OCSF_API_ACTIVITY.OTHER : activityId;
         const event = {
             category_uid: OCSF_CATEGORY.APPLICATION_ACTIVITY,
             class_uid: OCSF_CLASS.API_ACTIVITY,
-            type_uid: OCSF_CLASS.API_ACTIVITY * 100 + activityId,
-            activity_id: activityId,
+            type_uid: OCSF_CLASS.API_ACTIVITY * 100 + wireActivityId,
+            activity_id: wireActivityId,
+            activity_name: OCSF_API_ACTIVITY_NAMES[activityId],
             severity_id: severity,
             status_id: input.success === false ? OCSF_STATUS.FAILURE : OCSF_STATUS.SUCCESS,
             time: Date.now(),
@@ -256,139 +199,16 @@ export class AuditLog {
                 operation: input.operation,
                 response: input.responseCode ? { code: input.responseCode } : undefined,
             },
-            src_endpoint: this.createEndpoint(input.remoteAddress),
+            src_endpoint: this.createEndpoint(input.remoteAddress) || { hostname: ENGINE_HOSTNAME },
             http_request: input.httpMethod || input.path
                 ? {
                     http_method: input.httpMethod,
                     url: input.path ? { path: input.path } : undefined,
                 }
                 : undefined,
+            ...(input.data ? { unmapped: { data: input.data } } : {}),
         };
-        return this.writeEvent(event);
-    }
-    async find(query = {}) {
-        await this.init();
-        const results = [];
-        const limit = query.limit || 100;
-        const offset = query.offset || 0;
-        let skipped = 0;
-        try {
-            const files = (await readdir(this.dir)).filter((f) => f.endsWith('.jsonl')).sort();
-            for (let i = files.length - 1; i >= 0 && results.length < limit; i--) {
-                const content = await readFile(join(this.dir, files[i]), 'utf-8');
-                const lines = content.trim().split('\n').filter(Boolean);
-                for (let j = lines.length - 1; j >= 0 && results.length < limit; j--) {
-                    try {
-                        const event = JSON.parse(lines[j]);
-                        if (!this.matches(event, query))
-                            continue;
-                        if (skipped < offset) {
-                            skipped++;
-                            continue;
-                        }
-                        results.push(event);
-                    }
-                    catch {
-                    }
-                }
-            }
-        }
-        catch {
-        }
-        return results;
-    }
-    async count(query = {}) {
-        await this.init();
-        let count = 0;
-        try {
-            const files = (await readdir(this.dir)).filter((f) => f.endsWith('.jsonl')).sort();
-            for (const file of files) {
-                const content = await readFile(join(this.dir, file), 'utf-8');
-                const lines = content.trim().split('\n').filter(Boolean);
-                for (const line of lines) {
-                    try {
-                        const event = JSON.parse(line);
-                        if (this.matches(event, query))
-                            count++;
-                    }
-                    catch {
-                    }
-                }
-            }
-        }
-        catch {
-        }
-        return count;
-    }
-    async getFailedLogins(params) {
-        const events = await this.find({
-            classUids: [OCSF_CLASS.AUTHENTICATION],
-            activityIds: [OCSF_AUTH_ACTIVITY.LOGON],
-            userId: params.userId,
-            success: false,
-            startTime: params.since,
-        });
-        if (params.remoteAddress) {
-            return events.filter((e) => {
-                const authEvent = e;
-                return authEvent.src_endpoint?.ip === params.remoteAddress;
-            }).length;
-        }
-        return events.length;
-    }
-    async verify() {
-        await this.init();
-        let entries = 0;
-        let verified = 0;
-        let prevHash = GENESIS_HASH;
-        let prevSeq = 0;
-        try {
-            const files = (await readdir(this.dir)).filter((f) => f.endsWith('.jsonl')).sort();
-            for (const file of files) {
-                const content = await readFile(join(this.dir, file), 'utf-8');
-                const lines = content.trim().split('\n').filter(Boolean);
-                for (const line of lines) {
-                    entries++;
-                    let event;
-                    try {
-                        event = JSON.parse(line);
-                    }
-                    catch {
-                        return { valid: false, entries, verified, error: `Parse error at entry ${entries}` };
-                    }
-                    if (!event.unmapped) {
-                        return { valid: false, entries, verified, error: `Missing hash chain at entry ${entries}` };
-                    }
-                    if (event.unmapped.seq !== prevSeq + 1) {
-                        return { valid: false, entries, verified, error: `Sequence gap at ${event.unmapped.seq}` };
-                    }
-                    if (event.unmapped.prev_hash !== prevHash) {
-                        return {
-                            valid: false,
-                            entries,
-                            verified,
-                            error: `Chain broken at seq ${event.unmapped.seq}`,
-                        };
-                    }
-                    const computedHash = this.computeHash(event);
-                    if (computedHash !== event.unmapped.hash) {
-                        return {
-                            valid: false,
-                            entries,
-                            verified,
-                            error: `Hash mismatch at seq ${event.unmapped.seq}`,
-                        };
-                    }
-                    verified++;
-                    prevHash = event.unmapped.hash;
-                    prevSeq = event.unmapped.seq;
-                }
-            }
-        }
-        catch (e) {
-            return { valid: false, entries, verified, error: `Read error: ${e}` };
-        }
-        return { valid: true, entries, verified };
+        return this.dispatch(event);
     }
     async close() {
         if (this.flushTimer) {
@@ -400,17 +220,18 @@ export class AuditLog {
                 await this.flushToCollector();
             }
             catch (err) {
-                logger.error(`Failed to flush pending events on close: ${err.message}`);
+                logger.error(`Failed to flush pending audit events on close: ${err.message}`);
             }
         }
-        await this.writeLock;
-        this.initialized = false;
-        this.lastEvent = null;
     }
 }
-export function createAuditLog(config) {
-    if (typeof config === 'string') {
-        return new AuditLog({ directory: config });
-    }
+export function createAuditLog(config = {}) {
     return new AuditLog(config);
 }
+let _auditLogInstance = null;
+export function setAuditLogInstance(instance) {
+    _auditLogInstance = instance;
+}
+export function getAuditLogInstance() {
+    return _auditLogInstance;
+}

package/lib/audit/ocsf-types.d.ts

@@ -5,7 +5,6 @@ export declare const OCSF_CATEGORY: {
 export declare const OCSF_CLASS: {
     readonly ACCOUNT_CHANGE: 3001;
     readonly AUTHENTICATION: 3002;
-    readonly AUTHORIZE_SESSION: 3003;
     readonly API_ACTIVITY: 6003;
 };
 export declare const OCSF_SEVERITY: {
@@ -62,6 +61,7 @@ export declare const OCSF_API_ACTIVITY: {
     readonly ACCESS_DENIED: 95;
     readonly OTHER: 99;
 };
+export declare const OCSF_API_ACTIVITY_NAMES: Record<number, string>;
 export interface OCSFMetadata {
     version: string;
     product: {
@@ -99,6 +99,11 @@ export interface OCSFEndpoint {
         version?: string;
     }[];
 }
+export interface OCSFService {
+    name?: string;
+    uid?: string;
+    version?: string;
+}
 export interface OCSFApi {
     operation?: string;
     service?: {
@@ -117,22 +122,20 @@ export interface OCSFBaseEvent {
     class_uid: number;
     type_uid: number;
     activity_id: number;
+    activity_name?: string;
     severity_id: number;
     time: number;
     message?: string;
     metadata: OCSFMetadata;
     status_id?: number;
     status_detail?: string;
-    unmapped?: {
-        seq: number;
-        prev_hash: string;
-        hash: string;
-    };
+    unmapped?: Record<string, unknown>;
 }
 export interface OCSFAuthenticationEvent extends OCSFBaseEvent {
     category_uid: 3;
     class_uid: 3002;
     user: OCSFUser;
+    service?: OCSFService;
     src_endpoint?: OCSFEndpoint;
     dst_endpoint?: OCSFEndpoint;
     auth_protocol_id?: number;

package/lib/audit/ocsf-types.js

@@ -5,7 +5,6 @@ export const OCSF_CATEGORY = {
 export const OCSF_CLASS = {
     ACCOUNT_CHANGE: 3001,
     AUTHENTICATION: 3002,
-    AUTHORIZE_SESSION: 3003,
     API_ACTIVITY: 6003,
 };
 export const OCSF_SEVERITY = {
@@ -62,3 +61,17 @@ export const OCSF_API_ACTIVITY = {
     ACCESS_DENIED: 95,
     OTHER: 99,
 };
+export const OCSF_API_ACTIVITY_NAMES = {
+    [OCSF_API_ACTIVITY.UNKNOWN]: 'Unknown',
+    [OCSF_API_ACTIVITY.CREATE]: 'Create',
+    [OCSF_API_ACTIVITY.READ]: 'Read',
+    [OCSF_API_ACTIVITY.UPDATE]: 'Update',
+    [OCSF_API_ACTIVITY.DELETE]: 'Delete',
+    [OCSF_API_ACTIVITY.CHECKOUT]: 'Checkout',
+    [OCSF_API_ACTIVITY.PAYMENT]: 'Payment',
+    [OCSF_API_ACTIVITY.REFUND]: 'Refund',
+    [OCSF_API_ACTIVITY.EXPORT]: 'Export',
+    [OCSF_API_ACTIVITY.IMPORT]: 'Import',
+    [OCSF_API_ACTIVITY.ACCESS_DENIED]: 'Access Denied',
+    [OCSF_API_ACTIVITY.OTHER]: 'Other',
+};

package/lib/audit/otlp-types.d.ts

@@ -0,0 +1,62 @@
+export type OTLPAnyValue = {
+    stringValue: string;
+} | {
+    boolValue: boolean;
+} | {
+    intValue: string;
+} | {
+    doubleValue: number;
+} | {
+    arrayValue: {
+        values: OTLPAnyValue[];
+    };
+} | {
+    kvlistValue: {
+        values: OTLPKeyValue[];
+    };
+};
+export interface OTLPKeyValue {
+    key: string;
+    value: OTLPAnyValue;
+}
+export interface OTLPResource {
+    attributes: OTLPKeyValue[];
+}
+export interface OTLPInstrumentationScope {
+    name: string;
+    version?: string;
+}
+export declare const OTLP_SEVERITY_NUMBER: {
+    readonly UNSPECIFIED: 0;
+    readonly INFO: 9;
+    readonly INFO2: 10;
+    readonly WARN: 13;
+    readonly ERROR: 17;
+    readonly FATAL: 21;
+    readonly FATAL4: 24;
+};
+export interface OTLPLogRecord {
+    timeUnixNano: string;
+    observedTimeUnixNano: string;
+    severityNumber: number;
+    severityText?: string;
+    body: OTLPAnyValue;
+    attributes: OTLPKeyValue[];
+}
+export interface OTLPScopeLogs {
+    scope: OTLPInstrumentationScope;
+    logRecords: OTLPLogRecord[];
+}
+export interface OTLPResourceLogs {
+    resource: OTLPResource;
+    scopeLogs: OTLPScopeLogs[];
+}
+export interface OTLPExportLogsServiceRequest {
+    resourceLogs: OTLPResourceLogs[];
+}
+export interface OTLPExportLogsServiceResponse {
+    partialSuccess?: {
+        rejectedLogRecords?: number | string;
+        errorMessage?: string;
+    };
+}

package/lib/audit/otlp-types.js

@@ -0,0 +1,9 @@
+export const OTLP_SEVERITY_NUMBER = {
+    UNSPECIFIED: 0,
+    INFO: 9,
+    INFO2: 10,
+    WARN: 13,
+    ERROR: 17,
+    FATAL: 21,
+    FATAL4: 24,
+};

package/lib/audit/otlp.d.ts

@@ -0,0 +1,9 @@
+import type { OCSFEvent } from './ocsf-types.ts';
+import { type OTLPAnyValue, type OTLPLogRecord, type OTLPExportLogsServiceRequest } from './otlp-types.ts';
+export declare function toAnyValue(value: unknown): OTLPAnyValue;
+export declare function encodeOCSFLogRecord(event: OCSFEvent, observedTimeMs: number): OTLPLogRecord;
+export declare function buildExportLogsRequest(events: OCSFEvent[], observedTimeMs?: number): OTLPExportLogsServiceRequest;
+export declare function parseOtlpHeaders(raw?: string): Record<string, string>;
+export declare function resolveCollectorUrl(explicit?: string): string | undefined;
+export declare function resolveCollectorHeaders(explicit?: Record<string, string>): Record<string, string>;
+export declare function exportLogs(collectorUrl: string, collectorHeaders: Record<string, string>, events: OCSFEvent[]): Promise<void>;