@zincapp/zn-vault-agent 1.3.0

package/dist/lib/health.js

@@ -0,0 +1,216 @@
+// Path: src/lib/health.ts
+// HTTP health and metrics endpoint for zn-vault-agent
+import http from 'node:http';
+import { healthLogger as log } from './logger.js';
+import { exportMetrics } from './metrics.js';
+import { loadConfig, getTargets, isConfigured } from './config.js';
+// Track health state
+let certWsConnected = false;
+let lastCertWsEvent = null;
+let secretWsConnected = false;
+let lastSecretWsEvent = null;
+let vaultReachable = false;
+let syncedCerts = 0;
+let certErrors = 0;
+let syncedSecrets = 0;
+let secretErrors = 0;
+let server = null;
+/**
+ * Update WebSocket connection status for certificates
+ */
+export function setWebSocketStatus(connected, eventTime) {
+    certWsConnected = connected;
+    if (eventTime) {
+        lastCertWsEvent = eventTime;
+    }
+}
+/**
+ * Update WebSocket connection status for secrets
+ */
+export function setSecretWebSocketStatus(connected, eventTime) {
+    secretWsConnected = connected;
+    if (eventTime) {
+        lastSecretWsEvent = eventTime;
+    }
+}
+/**
+ * Update vault reachability status
+ */
+export function setVaultReachable(reachable) {
+    vaultReachable = reachable;
+}
+/**
+ * Update certificate sync status
+ */
+export function updateCertStatus(synced, errors) {
+    syncedCerts = synced;
+    certErrors = errors;
+}
+/**
+ * Update secret sync status
+ */
+export function updateSecretStatus(synced, errors) {
+    syncedSecrets = synced;
+    secretErrors = errors;
+}
+/**
+ * Get current health status
+ */
+export function getHealthStatus() {
+    const config = loadConfig();
+    const targets = getTargets();
+    const secretTargets = config.secretTargets || [];
+    let status = 'healthy';
+    // Determine overall status
+    const hasTargets = targets.length > 0 || secretTargets.length > 0;
+    const wsConnected = (targets.length === 0 || certWsConnected) &&
+        (secretTargets.length === 0 || secretWsConnected);
+    if (hasTargets && (!wsConnected || !vaultReachable)) {
+        status = 'degraded';
+    }
+    if (certErrors > 0 || secretErrors > 0) {
+        status = 'degraded';
+    }
+    if (!isConfigured()) {
+        status = 'unhealthy';
+    }
+    return {
+        status,
+        timestamp: new Date().toISOString(),
+        uptime: process.uptime(),
+        version: process.env.npm_package_version || '1.0.0',
+        websocket: {
+            certificates: {
+                connected: certWsConnected,
+                lastEvent: lastCertWsEvent?.toISOString(),
+            },
+            secrets: {
+                connected: secretWsConnected,
+                lastEvent: lastSecretWsEvent?.toISOString(),
+            },
+        },
+        vault: {
+            url: config.vaultUrl || 'not configured',
+            reachable: vaultReachable,
+        },
+        certificates: {
+            total: targets.length,
+            synced: syncedCerts,
+            errors: certErrors,
+        },
+        secrets: {
+            total: secretTargets.length,
+            synced: syncedSecrets,
+            errors: secretErrors,
+        },
+    };
+}
+/**
+ * Handle HTTP requests
+ */
+function handleRequest(req, res) {
+    const url = req.url || '/';
+    log.debug({ method: req.method, url }, 'Health endpoint request');
+    // CORS headers for monitoring tools
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
+    if (req.method === 'OPTIONS') {
+        res.writeHead(204);
+        res.end();
+        return;
+    }
+    if (req.method !== 'GET') {
+        res.writeHead(405, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Method not allowed' }));
+        return;
+    }
+    switch (url) {
+        case '/health':
+        case '/health/': {
+            const health = getHealthStatus();
+            const statusCode = health.status === 'unhealthy' ? 503 : 200;
+            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(health, null, 2));
+            break;
+        }
+        case '/ready':
+        case '/ready/': {
+            // Readiness probe - are we configured and at least one WebSocket connected?
+            const ready = isConfigured() && (certWsConnected || secretWsConnected);
+            res.writeHead(ready ? 200 : 503, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ready, timestamp: new Date().toISOString() }));
+            break;
+        }
+        case '/live':
+        case '/live/': {
+            // Liveness probe - is the process running?
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ alive: true, timestamp: new Date().toISOString() }));
+            break;
+        }
+        case '/metrics':
+        case '/metrics/': {
+            // Prometheus metrics
+            res.writeHead(200, { 'Content-Type': 'text/plain; version=0.0.4; charset=utf-8' });
+            res.end(exportMetrics());
+            break;
+        }
+        default:
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Not found' }));
+    }
+}
+/**
+ * Start the health HTTP server
+ */
+export function startHealthServer(port = 9100) {
+    return new Promise((resolve, reject) => {
+        if (server) {
+            log.warn('Health server already running');
+            resolve(server);
+            return;
+        }
+        server = http.createServer(handleRequest);
+        server.on('error', (err) => {
+            if (err.code === 'EADDRINUSE') {
+                log.error({ port }, 'Health server port already in use');
+            }
+            else {
+                log.error({ err }, 'Health server error');
+            }
+            reject(err);
+        });
+        server.listen(port, '0.0.0.0', () => {
+            log.info({ port }, 'Health server started');
+            resolve(server);
+        });
+    });
+}
+/**
+ * Stop the health HTTP server
+ */
+export function stopHealthServer() {
+    return new Promise((resolve) => {
+        if (!server) {
+            resolve();
+            return;
+        }
+        server.close((err) => {
+            if (err) {
+                log.warn({ err }, 'Error closing health server');
+            }
+            else {
+                log.info('Health server stopped');
+            }
+            server = null;
+            resolve();
+        });
+    });
+}
+/**
+ * Check if health server is running
+ */
+export function isHealthServerRunning() {
+    return server !== null && server.listening;
+}
+//# sourceMappingURL=health.js.map

package/dist/lib/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/lib/health.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,sDAAsD;AAEtD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,IAAI,GAAG,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA2BnE,qBAAqB;AACrB,IAAI,eAAe,GAAG,KAAK,CAAC;AAC5B,IAAI,eAAe,GAAgB,IAAI,CAAC;AACxC,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,iBAAiB,GAAgB,IAAI,CAAC;AAC1C,IAAI,cAAc,GAAG,KAAK,CAAC;AAC3B,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,IAAI,UAAU,GAAG,CAAC,CAAC;AACnB,IAAI,aAAa,GAAG,CAAC,CAAC;AACtB,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,MAAM,GAAuB,IAAI,CAAC;AAEtC;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAkB,EAAE,SAAgB;IACrE,eAAe,GAAG,SAAS,CAAC;IAC5B,IAAI,SAAS,EAAE,CAAC;QACd,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAkB,EAAE,SAAgB;IAC3E,iBAAiB,GAAG,SAAS,CAAC;IAC9B,IAAI,SAAS,EAAE,CAAC;QACd,iBAAiB,GAAG,SAAS,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAkB;IAClD,cAAc,GAAG,SAAS,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAc;IAC7D,WAAW,GAAG,MAAM,CAAC;IACrB,UAAU,GAAG,MAAM,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,MAAc;IAC/D,aAAa,GAAG,MAAM,CAAC;IACvB,YAAY,GAAG,MAAM,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IAEjD,IAAI,MAAM,GAAyC,SAAS,CAAC;IAE7D,2BAA2B;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC;QACzC,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,iBAAiB,CAAC,CAAC;IAEtE,IAAI,UAAU,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,UAAU,CAAC;IACtB,CAAC;IACD,IAAI,UAAU,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,UAAU,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACpB,MAAM,GAAG,WAAW,CAAC;IACvB,CAAC;IAED,OAAO;QACL,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;QACxB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO;QACnD,SAAS,EAAE;YACT,YAAY,EAAE;gBACZ,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE;aAC1C;YACD,OAAO,EAAE;gBACP,SAAS,EAAE,iBAAiB;gBAC5B,SAAS,EAAE,iBAAiB,EAAE,WAAW,EAAE;aAC5C;SACF;QACD,KAAK,EAAE;YACL,GAAG,EAAE,MAAM,CAAC,QAAQ,IAAI,gBAAgB;YACxC,SAAS,EAAE,cAAc;SAC1B;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,UAAU;SACnB;QACD,OAAO,EAAE;YACP,KAAK,EAAE,aAAa,CAAC,MAAM;YAC3B,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,YAAY;SACrB;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAyB,EAAE,GAAwB;IACxE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAE3B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAElE,oCAAoC;IACpC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,4EAA4E;YAC5E,MAAM,KAAK,GAAG,YAAY,EAAE,IAAI,CAAC,eAAe,IAAI,iBAAiB,CAAC,CAAC;YACvE,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACzE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM;QACR,CAAC;QAED,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,2CAA2C;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9E,MAAM;QACR,CAAC;QAED,KAAK,UAAU,CAAC;QAChB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,qBAAqB;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0CAA0C,EAAE,CAAC,CAAC;YACnF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;YACzB,MAAM;QACR,CAAC;QAED;YACE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,IAAI;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAE1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,mCAAmC,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE;YAClC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,uBAAuB,CAAC,CAAC;YAC5C,OAAO,CAAC,MAAO,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnB,IAAI,GAAG,EAAE,CAAC;gBACR,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC;AAC7C,CAAC"}

package/dist/lib/logger.d.ts

@@ -0,0 +1,38 @@
+import pino from 'pino';
+/**
+ * Base logger instance
+ *
+ * In development: Uses pino-pretty with colorized output
+ * In production: JSON logs to stdout (captured by journald) + optional file
+ *
+ * Configure via environment variables:
+ * - LOG_LEVEL: trace, debug, info, warn, error, fatal (default: debug in dev, info in prod)
+ * - LOG_FILE: Path to log file (default: /var/log/zn-vault-agent/agent.log in prod)
+ */
+export declare const logger: pino.Logger<never, boolean>;
+/**
+ * Create a child logger with additional context
+ *
+ * @example
+ * const log = createLogger({ module: 'deployer' });
+ * log.info({ certId: 'xxx' }, 'Certificate deployed');
+ */
+export declare function createLogger(context: Record<string, unknown>): pino.Logger;
+export declare const wsLogger: pino.Logger<never, boolean>;
+export declare const apiLogger: pino.Logger<never, boolean>;
+export declare const deployLogger: pino.Logger<never, boolean>;
+export declare const configLogger: pino.Logger<never, boolean>;
+export declare const metricsLogger: pino.Logger<never, boolean>;
+export declare const healthLogger: pino.Logger<never, boolean>;
+/**
+ * Flush logs and close file streams
+ * Call this before process exit for clean shutdown
+ */
+export declare function flushLogs(): Promise<void>;
+/**
+ * Handle log rotation signal (USR1)
+ * Reopens the log file destination
+ */
+export declare function setupLogRotation(): void;
+export type Logger = pino.Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/lib/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAGA,OAAO,IAAI,MAAM,MAAM,CAAC;AAoFxB;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM,6BA6BlB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAE1E;AAGD,eAAO,MAAM,QAAQ,6BAAwC,CAAC;AAC9D,eAAO,MAAM,SAAS,6BAAkC,CAAC;AACzD,eAAO,MAAM,YAAY,6BAAuC,CAAC;AACjE,eAAO,MAAM,YAAY,6BAAqC,CAAC;AAC/D,eAAO,MAAM,aAAa,6BAAsC,CAAC;AACjE,eAAO,MAAM,YAAY,6BAAqC,CAAC;AAE/D;;;GAGG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAM/C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,MAAM,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC"}

package/dist/lib/logger.js

@@ -0,0 +1,161 @@
+// Path: src/lib/logger.ts
+// Centralized Pino logger for zn-vault-agent
+import pino from 'pino';
+import fs from 'node:fs';
+import path from 'node:path';
+const isDev = process.env.NODE_ENV !== 'production';
+const logFile = process.env.LOG_FILE || (isDev ? undefined : '/var/log/zn-vault-agent/agent.log');
+/**
+ * Create file stream for logging if LOG_FILE is set
+ */
+function createFileStream() {
+    if (!logFile)
+        return undefined;
+    // Ensure log directory exists
+    const logDir = path.dirname(logFile);
+    if (!fs.existsSync(logDir)) {
+        try {
+            fs.mkdirSync(logDir, { recursive: true, mode: 0o750 });
+        }
+        catch {
+            // Can't create log directory, skip file logging
+            return undefined;
+        }
+    }
+    try {
+        return pino.destination({
+            dest: logFile,
+            sync: false, // Async writes for performance
+            mkdir: true,
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Check if pino-pretty is available
+ */
+async function hasPinoPretty() {
+    try {
+        await import('pino-pretty');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// Cache the result
+let pinoPrettyAvailable = null;
+/**
+ * Create multi-stream transport for dual output (stdout + file)
+ */
+function createTransport() {
+    if (isDev) {
+        // Check if pino-pretty is available (sync check using require.resolve)
+        if (pinoPrettyAvailable === null) {
+            try {
+                require.resolve('pino-pretty');
+                pinoPrettyAvailable = true;
+            }
+            catch {
+                pinoPrettyAvailable = false;
+            }
+        }
+        if (pinoPrettyAvailable) {
+            // Development: pretty print to stdout only
+            return {
+                target: 'pino-pretty',
+                options: {
+                    colorize: true,
+                    translateTime: 'SYS:standard',
+                    ignore: 'pid,hostname',
+                },
+            };
+        }
+        // Fall through to JSON output if pino-pretty not available
+    }
+    // Production: JSON to stdout (for journald)
+    // File output is handled separately via destination stream
+    return undefined;
+}
+/**
+ * Base logger instance
+ *
+ * In development: Uses pino-pretty with colorized output
+ * In production: JSON logs to stdout (captured by journald) + optional file
+ *
+ * Configure via environment variables:
+ * - LOG_LEVEL: trace, debug, info, warn, error, fatal (default: debug in dev, info in prod)
+ * - LOG_FILE: Path to log file (default: /var/log/zn-vault-agent/agent.log in prod)
+ */
+export const logger = pino({
+    level: process.env.LOG_LEVEL ?? (isDev ? 'debug' : 'info'),
+    transport: createTransport(),
+    base: {
+        service: 'zn-vault-agent',
+        pid: process.pid,
+    },
+    // Redact sensitive fields
+    redact: {
+        paths: [
+            'password',
+            'apiKey',
+            'token',
+            'secret',
+            'auth.password',
+            'auth.apiKey',
+            'config.auth.password',
+            'config.auth.apiKey',
+            'headers.authorization',
+            'headers["x-api-key"]',
+        ],
+        censor: '[REDACTED]',
+    },
+    // Add timestamp in ISO format
+    timestamp: pino.stdTimeFunctions.isoTime,
+}, 
+// In production without transport, we can use multistream for file output
+!isDev && logFile ? createFileStream() : undefined);
+/**
+ * Create a child logger with additional context
+ *
+ * @example
+ * const log = createLogger({ module: 'deployer' });
+ * log.info({ certId: 'xxx' }, 'Certificate deployed');
+ */
+export function createLogger(context) {
+    return logger.child(context);
+}
+// Pre-configured module loggers
+export const wsLogger = createLogger({ module: 'websocket' });
+export const apiLogger = createLogger({ module: 'api' });
+export const deployLogger = createLogger({ module: 'deployer' });
+export const configLogger = createLogger({ module: 'config' });
+export const metricsLogger = createLogger({ module: 'metrics' });
+export const healthLogger = createLogger({ module: 'health' });
+/**
+ * Flush logs and close file streams
+ * Call this before process exit for clean shutdown
+ */
+export async function flushLogs() {
+    return new Promise((resolve) => {
+        logger.flush();
+        // Give some time for async writes to complete
+        setTimeout(resolve, 100);
+    });
+}
+/**
+ * Handle log rotation signal (USR1)
+ * Reopens the log file destination
+ */
+export function setupLogRotation() {
+    if (process.platform !== 'win32') {
+        process.on('SIGUSR1', () => {
+            logger.info('Received SIGUSR1, reopening log files');
+            // Pino destination handles file reopening on next write
+            logger.flush();
+        });
+    }
+}
+//# sourceMappingURL=logger.js.map

package/dist/lib/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,6CAA6C;AAE7C,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AACpD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC;AAElG;;GAEG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,8BAA8B;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;YACtB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,KAAK,EAAE,+BAA+B;YAC5C,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mBAAmB;AACnB,IAAI,mBAAmB,GAAmB,IAAI,CAAC;AAE/C;;GAEG;AACH,SAAS,eAAe;IACtB,IAAI,KAAK,EAAE,CAAC;QACV,uEAAuE;QACvE,IAAI,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;gBAC/B,mBAAmB,GAAG,IAAI,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,mBAAmB,GAAG,KAAK,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,mBAAmB,EAAE,CAAC;YACxB,2CAA2C;YAC3C,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE;oBACP,QAAQ,EAAE,IAAI;oBACd,aAAa,EAAE,cAAc;oBAC7B,MAAM,EAAE,cAAc;iBACvB;aACF,CAAC;QACJ,CAAC;QACD,2DAA2D;IAC7D,CAAC;IAED,4CAA4C;IAC5C,2DAA2D;IAC3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CACxB;IACE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,eAAe,EAAE;IAC5B,IAAI,EAAE;QACJ,OAAO,EAAE,gBAAgB;QACzB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB;IACD,0BAA0B;IAC1B,MAAM,EAAE;QACN,KAAK,EAAE;YACL,UAAU;YACV,QAAQ;YACR,OAAO;YACP,QAAQ;YACR,eAAe;YACf,aAAa;YACb,sBAAsB;YACtB,oBAAoB;YACpB,uBAAuB;YACvB,sBAAsB;SACvB;QACD,MAAM,EAAE,YAAY;KACrB;IACD,8BAA8B;IAC9B,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO;CACzC;AACD,0EAA0E;AAC1E,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAgC;IAC3D,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,gCAAgC;AAChC,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACzD,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,YAAY,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAE/D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,8CAA8C;QAC9C,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACzB,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACrD,wDAAwD;YACxD,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/lib/metrics.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Register a counter metric
+ */
+export declare function registerCounter(name: string, help: string): void;
+/**
+ * Increment a counter
+ */
+export declare function incCounter(name: string, labels?: Record<string, string>, value?: number): void;
+/**
+ * Register a gauge metric
+ */
+export declare function registerGauge(name: string, help: string): void;
+/**
+ * Set a gauge value
+ */
+export declare function setGauge(name: string, value: number, labels?: Record<string, string>): void;
+/**
+ * Register a histogram metric
+ */
+export declare function registerHistogram(name: string, help: string, buckets?: number[]): void;
+/**
+ * Observe a histogram value
+ */
+export declare function observeHistogram(name: string, value: number, labels?: Record<string, string>): void;
+/**
+ * Export all metrics in Prometheus text format
+ */
+export declare function exportMetrics(): string;
+/**
+ * Reset all metrics (useful for testing)
+ */
+export declare function resetMetrics(): void;
+export declare function initializeMetrics(): void;
+export declare const metrics: {
+    syncSuccess: (certName: string) => void;
+    syncFailure: (certName: string, reason: string) => void;
+    syncDuration: (certName: string, durationMs: number) => void;
+    wsConnected: () => void;
+    wsDisconnected: () => void;
+    wsReconnect: () => void;
+    apiRequest: (method: string, status: number, durationMs: number) => void;
+    setCertsTracked: (count: number) => void;
+    setCertExpiry: (certId: string, certName: string, days: number) => void;
+    secretDeployed: (secretName: string, success: boolean, durationMs: number) => void;
+    setSecretsTracked: (count: number) => void;
+    updateCheck: (status: "success" | "error") => void;
+    updateInstall: (status: "success" | "error" | "permission_denied") => void;
+    setVersionInfo: (version: string, channel: string) => void;
+};
+//# sourceMappingURL=metrics.d.ts.map

package/dist/lib/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/lib/metrics.ts"],"names":[],"mappings":"AA6CA;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMhE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EAAE,KAAK,SAAI,GAAG,IAAI,CAe7F;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAM9D;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,IAAI,CAgB/F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAM,EAAoB,GAClC,IAAI,CAQN;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAClC,IAAI,CA6BN;AAWD;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CA+DtC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAUnC;AAGD,wBAAgB,iBAAiB,IAAI,IAAI,CAyBxC;AAGD,eAAO,MAAM,OAAO;4BAEM,MAAM;4BAIN,MAAM,UAAU,MAAM;6BAIrB,MAAM,cAAc,MAAM;;;;yBAU9B,MAAM,UAAU,MAAM,cAAc,MAAM;6BAMtC,MAAM;4BACP,MAAM,YAAY,MAAM,QAAQ,MAAM;iCAKjC,MAAM,WAAW,OAAO,cAAc,MAAM;+BAU9C,MAAM;0BAGX,SAAS,GAAG,OAAO;4BAGjB,SAAS,GAAG,OAAO,GAAG,mBAAmB;8BAGvC,MAAM,WAAW,MAAM;CAGlD,CAAC"}