autotel-audit 0.4.15 → 1.0.0

package/dist/index.cjs

@@ -95,34 +95,35 @@ function lazyCounter(name, description) {
 * Drives both standard-field emission and the reserved-key check for the
 * custom-attribute loop — adding a field here is the whole change.
 */
-const FIELD_ATTRIBUTES = {
-	name: autotel_security_schema.SECURITY_ATTR.event,
-	category: autotel_security_schema.SECURITY_ATTR.category,
-	outcome: autotel_security_schema.SECURITY_ATTR.outcome,
-	severity: autotel_security_schema.SECURITY_ATTR.severity,
-	actorId: autotel_security_schema.SECURITY_ATTR.actorId,
-	targetType: autotel_security_schema.SECURITY_ATTR.targetType,
-	targetId: autotel_security_schema.SECURITY_ATTR.targetId,
-	tenantId: autotel_security_schema.SECURITY_ATTR.tenantId,
-	reason: autotel_security_schema.SECURITY_ATTR.reason
-};
+const FIELD_ATTRIBUTES = /* @__PURE__ */ new Map([
+	["name", autotel_security_schema.SECURITY_ATTR.event],
+	["category", autotel_security_schema.SECURITY_ATTR.category],
+	["outcome", autotel_security_schema.SECURITY_ATTR.outcome],
+	["severity", autotel_security_schema.SECURITY_ATTR.severity],
+	["actorId", autotel_security_schema.SECURITY_ATTR.actorId],
+	["targetType", autotel_security_schema.SECURITY_ATTR.targetType],
+	["targetId", autotel_security_schema.SECURITY_ATTR.targetId],
+	["tenantId", autotel_security_schema.SECURITY_ATTR.tenantId],
+	["reason", autotel_security_schema.SECURITY_ATTR.reason]
+]);
 function flattenSecurityAttributes(metadata) {
-	const attributes = {
-		[autotel_security_schema.SECURITY_ATTR.marker]: true,
-		[autotel_security_schema.SECURITY_ATTR.severity]: metadata.severity ?? "info"
-	};
+	const custom = [];
 	const droppedKeys = [];
 	for (const [key, value] of Object.entries(metadata)) {
-		const standardAttribute = FIELD_ATTRIBUTES[key];
+		const standardAttribute = FIELD_ATTRIBUTES.get(key);
 		if (standardAttribute === void 0 && autotel.REDACTOR_PATTERNS.sensitiveKey.test(key)) {
 			droppedKeys.push(key);
 			continue;
 		}
 		const attr = toAttributeValue(value);
-		if (attr !== void 0) attributes[standardAttribute ?? `security.${key}`] = attr;
+		if (attr !== void 0) custom.push([standardAttribute ?? `security.${key}`, attr]);
 	}
-	if (droppedKeys.length > 0) attributes[autotel_security_schema.SECURITY_ATTR.droppedKeys] = droppedKeys;
-	return attributes;
+	if (droppedKeys.length > 0) custom.push([autotel_security_schema.SECURITY_ATTR.droppedKeys, droppedKeys]);
+	return Object.fromEntries([
+		[autotel_security_schema.SECURITY_ATTR.marker, true],
+		[autotel_security_schema.SECURITY_ATTR.severity, metadata.severity ?? "info"],
+		...custom
+	]);
 }
 const eventsCounter = lazyCounter(autotel_security_schema.SECURITY_METRICS.events, "Security events by name, category, outcome, and severity");
 function countSecurityEvent(metadata) {
@@ -570,12 +571,12 @@ function createMcpSecurityEventBridge(options = {}) {
 //#endregion
 //#region src/index.ts
 function flattenAuditAttributes(metadata) {
-	const attributes = { "autotel.audit": true };
+	const custom = [];
 	for (const [key, value] of Object.entries(metadata)) {
 		const attr = toAttributeValue(value);
-		if (attr !== void 0) attributes[`audit.${key}`] = attr;
+		if (attr !== void 0) custom.push([`audit.${key}`, attr]);
 	}
-	return attributes;
+	return Object.fromEntries([["autotel.audit", true], ...custom]);
 }
 function forceKeepAuditEvent(ctx) {
 	const traceCtx = resolveContextSafe(ctx);

package/dist/index.d.cts

@@ -32,6 +32,8 @@ type SecurityOutcome = 'success' | 'failure' | 'denied' | 'blocked' | 'error';
  * this union exists for autocomplete and consistency across services.
  */
 type SuggestedSecurityEventName = 'auth.login.success' | 'auth.login.failed' | 'auth.mfa.failed' | 'auth.session.revoked' | 'auth.password.reset' | 'auth.account.locked' | 'access.denied' | 'access.role.changed' | 'access.permission.changed' | 'access.tenant.violation' | 'admin.action' | 'config.changed' | 'secret.accessed' | 'secret.rotation.failed' | 'api_key.created' | 'api_key.revoked' | 'rate_limit.exceeded' | 'validation.failed' | 'webhook.signature.failed' | 'dependency.scan.failed' | 'llm.prompt_injection.detected' | 'llm.tool_call.denied' | 'llm.output.blocked' | 'llm.output.budget_exceeded' | 'llm.guard.triggered' | 'llm.action_chain.suspicious' | 'llm.manifest.suspicious' | 'llm.plan.risk.elevated';
+/** An attribute value, as OpenTelemetry allows one on a span. */
+type SecurityAttributeValue = string | number | boolean | string[] | number[] | boolean[];
 interface SecurityEventMetadata {
   /** Stable, dot-separated event name, e.g. `auth.login.failed`. */
   name: SuggestedSecurityEventName | (string & {});
@@ -46,7 +48,8 @@ interface SecurityEventMetadata {
   tenantId?: string;
   /** Short machine-readable reason, e.g. `invalid_password`. */
   reason?: string;
-  [key: string]: unknown;
+  /** Extra fields ride along as span attributes; see AuditMetadataValue. */
+  [key: string]: AuditMetadataValue;
 }
 interface SecurityEventOptions {
   ctx?: AuditContext;
@@ -76,7 +79,7 @@ interface SecurityEventOptions {
 }
 type WithSecurityOptions = SecurityEventOptions;
 interface SecurityAttributeSink {
-  setAttribute(key: string, value: string | number | boolean | string[] | number[] | boolean[]): unknown;
+  setAttribute(key: string, value: SecurityAttributeValue): void;
 }
 declare function applySecurityEventAttributes(sink: SecurityAttributeSink, metadata: SecurityEventMetadata, options?: Pick<SecurityEventOptions, 'forceKeep' | 'metrics'>): void;
 /**
@@ -153,12 +156,18 @@ declare function hashIdentifier(value: string, options?: HashIdentifierOptions):
  * exist, survive sampling, and stay queryable under a stable schema.
  */
 type AttributeValue = string | number | boolean | Array<null | undefined | string> | Array<null | undefined | number> | Array<null | undefined | boolean>;
+/** The parent context OTel hands a processor. This package never reads it. */
+interface SpanParentContext {
+  getValue?: (key: symbol) => ContextValue;
+}
+/** Whatever OTel stored under a context key. This package never reads one. */
+type ContextValue = object | string | number | boolean | undefined;
 interface MutableSpanLike {
   attributes: Record<string, AttributeValue | undefined>;
   spanContext?: {
     traceId: string;
   };
-  setAttribute(key: string, value: AttributeValue): unknown;
+  setAttribute(key: string, value: AttributeValue): void;
 }
 interface ReadableSpanLike {
   attributes: Record<string, AttributeValue | undefined>;
@@ -167,7 +176,7 @@ interface ReadableSpanLike {
   };
 }
 interface SecuritySignalProcessor {
-  onStart(span: MutableSpanLike, parentContext?: unknown): void;
+  onStart(span: MutableSpanLike, parentContext?: SpanParentContext): void;
   onEnd(span: ReadableSpanLike): void;
   shutdown(): Promise<void>;
   forceFlush(): Promise<void>;
@@ -289,7 +298,13 @@ interface SecuritySignalProcessorOptions {
  * Conservative request-target patterns. Tuned for scanner/probe traffic —
  * high signal, low false-positive — not as a WAF. Extend via `extraPatterns`.
  */
-declare const SUSPICIOUS_REQUEST_PATTERNS: Record<string, RegExp>;
+declare const SUSPICIOUS_REQUEST_PATTERNS: {
+  path_traversal: RegExp;
+  sensitive_file_probe: RegExp;
+  sqli_probe: RegExp;
+  xss_probe: RegExp;
+  null_byte: RegExp;
+};
 declare function createSecuritySignalProcessor(options?: SecuritySignalProcessorOptions): SecuritySignalProcessor;
 //#endregion
 //#region src/security-heartbeat.d.ts
@@ -338,7 +353,8 @@ interface McpBridgedSecurityEvent {
   toolName?: string;
   verdict?: string;
   source?: string;
-  [key: string]: unknown;
+  /** Extra fields ride along as span attributes; see AuditMetadataValue. */
+  [key: string]: AuditMetadataValue;
 }
 interface McpSecurityEventBridgeOptions extends SecurityEventOptions {
   /** Optional fixed audit context for bridged events. */
@@ -368,8 +384,17 @@ interface AuditMetadata {
   actorId?: string;
   category?: string;
   outcome?: 'success' | 'failure' | (string & {});
-  [key: string]: unknown;
+  /** Extra fields ride along as span attributes, so they must be attribute-shaped. */
+  [key: string]: AuditMetadataValue;
 }
+/**
+ * What a metadata field can hold: anything `toAttributeValue` can render onto a
+ * span. Scalars and scalar arrays pass through; a Date becomes an ISO string;
+ * anything else nested is JSON-serialized.
+ */
+type AuditMetadataValue = string | number | boolean | null | undefined | Date | Array<AuditMetadataValue> | {
+  [key: string]: AuditMetadataValue;
+};
 interface WithAuditOptions {
   ctx?: AuditContext;
   emitNow?: boolean;
@@ -385,4 +410,4 @@ declare function forceKeepAuditEvent(ctx?: AuditContext): void;
 declare function setAuditAttributes(metadata: AuditMetadata, ctx?: AuditContext): void;
 declare function withAudit<T>(metadata: AuditMetadata, fn: (ctx: AuditContext, logger: RequestLogger) => T | Promise<T>, options?: WithAuditOptions): Promise<T>;
 //#endregion
-export { type AuditContext, AuditMetadata, AuthFailureBurstSignal, BurstOptions, HashIdentifierOptions, LlmActionChainSuspiciousSignal, LlmExcessiveTokensSignal, LlmSignalOptions, LlmTokenBudgetSignal, McpBridgedSecurityEvent, McpSecurityEventBridgeOptions, type OnMissingContext, SUSPICIOUS_REQUEST_PATTERNS, SecurityEventCategory, SecurityEventMetadata, SecurityEventOptions, SecurityHeartbeat, SecurityHeartbeatOptions, SecurityOutcome, type SecuritySeverity, SecuritySignal, SecuritySignalProcessor, SecuritySignalProcessorOptions, SuggestedSecurityEventName, SuspiciousRequestSignal, WithAuditOptions, WithSecurityOptions, applySecurityEventAttributes, createMcpSecurityEventBridge, createSecuritySignalProcessor, forceKeepAuditEvent, hashIdentifier, securityEvent, setAuditAttributes, startSecurityHeartbeat, withAudit, withSecurity };
+export { AttributeValue, type AuditContext, AuditMetadata, AuditMetadataValue, AuthFailureBurstSignal, BurstOptions, ContextValue, HashIdentifierOptions, LlmActionChainSuspiciousSignal, LlmExcessiveTokensSignal, LlmSignalOptions, LlmTokenBudgetSignal, McpBridgedSecurityEvent, McpSecurityEventBridgeOptions, type OnMissingContext, SUSPICIOUS_REQUEST_PATTERNS, SecurityAttributeValue, SecurityEventCategory, SecurityEventMetadata, SecurityEventOptions, SecurityHeartbeat, SecurityHeartbeatOptions, SecurityOutcome, type SecuritySeverity, SecuritySignal, SecuritySignalProcessor, SecuritySignalProcessorOptions, SpanParentContext, SuggestedSecurityEventName, SuspiciousRequestSignal, WithAuditOptions, WithSecurityOptions, applySecurityEventAttributes, createMcpSecurityEventBridge, createSecuritySignalProcessor, forceKeepAuditEvent, hashIdentifier, securityEvent, setAuditAttributes, startSecurityHeartbeat, withAudit, withSecurity };

package/dist/index.d.ts

@@ -32,6 +32,8 @@ type SecurityOutcome = 'success' | 'failure' | 'denied' | 'blocked' | 'error';
  * this union exists for autocomplete and consistency across services.
  */
 type SuggestedSecurityEventName = 'auth.login.success' | 'auth.login.failed' | 'auth.mfa.failed' | 'auth.session.revoked' | 'auth.password.reset' | 'auth.account.locked' | 'access.denied' | 'access.role.changed' | 'access.permission.changed' | 'access.tenant.violation' | 'admin.action' | 'config.changed' | 'secret.accessed' | 'secret.rotation.failed' | 'api_key.created' | 'api_key.revoked' | 'rate_limit.exceeded' | 'validation.failed' | 'webhook.signature.failed' | 'dependency.scan.failed' | 'llm.prompt_injection.detected' | 'llm.tool_call.denied' | 'llm.output.blocked' | 'llm.output.budget_exceeded' | 'llm.guard.triggered' | 'llm.action_chain.suspicious' | 'llm.manifest.suspicious' | 'llm.plan.risk.elevated';
+/** An attribute value, as OpenTelemetry allows one on a span. */
+type SecurityAttributeValue = string | number | boolean | string[] | number[] | boolean[];
 interface SecurityEventMetadata {
   /** Stable, dot-separated event name, e.g. `auth.login.failed`. */
   name: SuggestedSecurityEventName | (string & {});
@@ -46,7 +48,8 @@ interface SecurityEventMetadata {
   tenantId?: string;
   /** Short machine-readable reason, e.g. `invalid_password`. */
   reason?: string;
-  [key: string]: unknown;
+  /** Extra fields ride along as span attributes; see AuditMetadataValue. */
+  [key: string]: AuditMetadataValue;
 }
 interface SecurityEventOptions {
   ctx?: AuditContext;
@@ -76,7 +79,7 @@ interface SecurityEventOptions {
 }
 type WithSecurityOptions = SecurityEventOptions;
 interface SecurityAttributeSink {
-  setAttribute(key: string, value: string | number | boolean | string[] | number[] | boolean[]): unknown;
+  setAttribute(key: string, value: SecurityAttributeValue): void;
 }
 declare function applySecurityEventAttributes(sink: SecurityAttributeSink, metadata: SecurityEventMetadata, options?: Pick<SecurityEventOptions, 'forceKeep' | 'metrics'>): void;
 /**
@@ -153,12 +156,18 @@ declare function hashIdentifier(value: string, options?: HashIdentifierOptions):
  * exist, survive sampling, and stay queryable under a stable schema.
  */
 type AttributeValue = string | number | boolean | Array<null | undefined | string> | Array<null | undefined | number> | Array<null | undefined | boolean>;
+/** The parent context OTel hands a processor. This package never reads it. */
+interface SpanParentContext {
+  getValue?: (key: symbol) => ContextValue;
+}
+/** Whatever OTel stored under a context key. This package never reads one. */
+type ContextValue = object | string | number | boolean | undefined;
 interface MutableSpanLike {
   attributes: Record<string, AttributeValue | undefined>;
   spanContext?: {
     traceId: string;
   };
-  setAttribute(key: string, value: AttributeValue): unknown;
+  setAttribute(key: string, value: AttributeValue): void;
 }
 interface ReadableSpanLike {
   attributes: Record<string, AttributeValue | undefined>;
@@ -167,7 +176,7 @@ interface ReadableSpanLike {
   };
 }
 interface SecuritySignalProcessor {
-  onStart(span: MutableSpanLike, parentContext?: unknown): void;
+  onStart(span: MutableSpanLike, parentContext?: SpanParentContext): void;
   onEnd(span: ReadableSpanLike): void;
   shutdown(): Promise<void>;
   forceFlush(): Promise<void>;
@@ -289,7 +298,13 @@ interface SecuritySignalProcessorOptions {
  * Conservative request-target patterns. Tuned for scanner/probe traffic —
  * high signal, low false-positive — not as a WAF. Extend via `extraPatterns`.
  */
-declare const SUSPICIOUS_REQUEST_PATTERNS: Record<string, RegExp>;
+declare const SUSPICIOUS_REQUEST_PATTERNS: {
+  path_traversal: RegExp;
+  sensitive_file_probe: RegExp;
+  sqli_probe: RegExp;
+  xss_probe: RegExp;
+  null_byte: RegExp;
+};
 declare function createSecuritySignalProcessor(options?: SecuritySignalProcessorOptions): SecuritySignalProcessor;
 //#endregion
 //#region src/security-heartbeat.d.ts
@@ -338,7 +353,8 @@ interface McpBridgedSecurityEvent {
   toolName?: string;
   verdict?: string;
   source?: string;
-  [key: string]: unknown;
+  /** Extra fields ride along as span attributes; see AuditMetadataValue. */
+  [key: string]: AuditMetadataValue;
 }
 interface McpSecurityEventBridgeOptions extends SecurityEventOptions {
   /** Optional fixed audit context for bridged events. */
@@ -368,8 +384,17 @@ interface AuditMetadata {
   actorId?: string;
   category?: string;
   outcome?: 'success' | 'failure' | (string & {});
-  [key: string]: unknown;
+  /** Extra fields ride along as span attributes, so they must be attribute-shaped. */
+  [key: string]: AuditMetadataValue;
 }
+/**
+ * What a metadata field can hold: anything `toAttributeValue` can render onto a
+ * span. Scalars and scalar arrays pass through; a Date becomes an ISO string;
+ * anything else nested is JSON-serialized.
+ */
+type AuditMetadataValue = string | number | boolean | null | undefined | Date | Array<AuditMetadataValue> | {
+  [key: string]: AuditMetadataValue;
+};
 interface WithAuditOptions {
   ctx?: AuditContext;
   emitNow?: boolean;
@@ -385,4 +410,4 @@ declare function forceKeepAuditEvent(ctx?: AuditContext): void;
 declare function setAuditAttributes(metadata: AuditMetadata, ctx?: AuditContext): void;
 declare function withAudit<T>(metadata: AuditMetadata, fn: (ctx: AuditContext, logger: RequestLogger) => T | Promise<T>, options?: WithAuditOptions): Promise<T>;
 //#endregion
-export { type AuditContext, AuditMetadata, AuthFailureBurstSignal, BurstOptions, HashIdentifierOptions, LlmActionChainSuspiciousSignal, LlmExcessiveTokensSignal, LlmSignalOptions, LlmTokenBudgetSignal, McpBridgedSecurityEvent, McpSecurityEventBridgeOptions, type OnMissingContext, SUSPICIOUS_REQUEST_PATTERNS, SecurityEventCategory, SecurityEventMetadata, SecurityEventOptions, SecurityHeartbeat, SecurityHeartbeatOptions, SecurityOutcome, type SecuritySeverity, SecuritySignal, SecuritySignalProcessor, SecuritySignalProcessorOptions, SuggestedSecurityEventName, SuspiciousRequestSignal, WithAuditOptions, WithSecurityOptions, applySecurityEventAttributes, createMcpSecurityEventBridge, createSecuritySignalProcessor, forceKeepAuditEvent, hashIdentifier, securityEvent, setAuditAttributes, startSecurityHeartbeat, withAudit, withSecurity };
+export { AttributeValue, type AuditContext, AuditMetadata, AuditMetadataValue, AuthFailureBurstSignal, BurstOptions, ContextValue, HashIdentifierOptions, LlmActionChainSuspiciousSignal, LlmExcessiveTokensSignal, LlmSignalOptions, LlmTokenBudgetSignal, McpBridgedSecurityEvent, McpSecurityEventBridgeOptions, type OnMissingContext, SUSPICIOUS_REQUEST_PATTERNS, SecurityAttributeValue, SecurityEventCategory, SecurityEventMetadata, SecurityEventOptions, SecurityHeartbeat, SecurityHeartbeatOptions, SecurityOutcome, type SecuritySeverity, SecuritySignal, SecuritySignalProcessor, SecuritySignalProcessorOptions, SpanParentContext, SuggestedSecurityEventName, SuspiciousRequestSignal, WithAuditOptions, WithSecurityOptions, applySecurityEventAttributes, createMcpSecurityEventBridge, createSecuritySignalProcessor, forceKeepAuditEvent, hashIdentifier, securityEvent, setAuditAttributes, startSecurityHeartbeat, withAudit, withSecurity };

package/dist/index.js

@@ -94,34 +94,35 @@ function lazyCounter(name, description) {
 * Drives both standard-field emission and the reserved-key check for the
 * custom-attribute loop — adding a field here is the whole change.
 */
-const FIELD_ATTRIBUTES = {
-	name: SECURITY_ATTR.event,
-	category: SECURITY_ATTR.category,
-	outcome: SECURITY_ATTR.outcome,
-	severity: SECURITY_ATTR.severity,
-	actorId: SECURITY_ATTR.actorId,
-	targetType: SECURITY_ATTR.targetType,
-	targetId: SECURITY_ATTR.targetId,
-	tenantId: SECURITY_ATTR.tenantId,
-	reason: SECURITY_ATTR.reason
-};
+const FIELD_ATTRIBUTES = /* @__PURE__ */ new Map([
+	["name", SECURITY_ATTR.event],
+	["category", SECURITY_ATTR.category],
+	["outcome", SECURITY_ATTR.outcome],
+	["severity", SECURITY_ATTR.severity],
+	["actorId", SECURITY_ATTR.actorId],
+	["targetType", SECURITY_ATTR.targetType],
+	["targetId", SECURITY_ATTR.targetId],
+	["tenantId", SECURITY_ATTR.tenantId],
+	["reason", SECURITY_ATTR.reason]
+]);
 function flattenSecurityAttributes(metadata) {
-	const attributes = {
-		[SECURITY_ATTR.marker]: true,
-		[SECURITY_ATTR.severity]: metadata.severity ?? "info"
-	};
+	const custom = [];
 	const droppedKeys = [];
 	for (const [key, value] of Object.entries(metadata)) {
-		const standardAttribute = FIELD_ATTRIBUTES[key];
+		const standardAttribute = FIELD_ATTRIBUTES.get(key);
 		if (standardAttribute === void 0 && REDACTOR_PATTERNS.sensitiveKey.test(key)) {
 			droppedKeys.push(key);
 			continue;
 		}
 		const attr = toAttributeValue(value);
-		if (attr !== void 0) attributes[standardAttribute ?? `security.${key}`] = attr;
+		if (attr !== void 0) custom.push([standardAttribute ?? `security.${key}`, attr]);
 	}
-	if (droppedKeys.length > 0) attributes[SECURITY_ATTR.droppedKeys] = droppedKeys;
-	return attributes;
+	if (droppedKeys.length > 0) custom.push([SECURITY_ATTR.droppedKeys, droppedKeys]);
+	return Object.fromEntries([
+		[SECURITY_ATTR.marker, true],
+		[SECURITY_ATTR.severity, metadata.severity ?? "info"],
+		...custom
+	]);
 }
 const eventsCounter = lazyCounter(SECURITY_METRICS.events, "Security events by name, category, outcome, and severity");
 function countSecurityEvent(metadata) {
@@ -569,12 +570,12 @@ function createMcpSecurityEventBridge(options = {}) {
 //#endregion
 //#region src/index.ts
 function flattenAuditAttributes(metadata) {
-	const attributes = { "autotel.audit": true };
+	const custom = [];
 	for (const [key, value] of Object.entries(metadata)) {
 		const attr = toAttributeValue(value);
-		if (attr !== void 0) attributes[`audit.${key}`] = attr;
+		if (attr !== void 0) custom.push([`audit.${key}`, attr]);
 	}
-	return attributes;
+	return Object.fromEntries([["autotel.audit", true], ...custom]);
 }
 function forceKeepAuditEvent(ctx) {
 	const traceCtx = resolveContextSafe(ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autotel-audit",
-  "version": "0.4.15",
+  "version": "1.0.0",
   "description": "Audit-focused helpers for Autotel (force-keep + structured audit instrumentation)",
   "type": "module",
   "main": "./dist/index.js",
@@ -27,7 +27,7 @@
   "author": "Jag Reehal <jag@jagreehal.com> (https://jagreehal.com)",
   "license": "Apache-2.0",
   "dependencies": {
-    "autotel": "6.5.0"
+    "autotel": "7.0.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",