SLD-904 - Introduce Azure Blob Storage logging destination

[pr0uxx]

Summary

• What changed?
• Why was this change needed?
• Link to the related jira issue.

Type Of Change

• Bug fix
• New feature
• Refactor
• Performance improvement
• Documentation update
• CI/CD or build change
• Dependency update

Activities Checklist

Code Quality

• I reviewed my own code.
• I kept changes focused and removed dead code.
• I followed repository conventions and naming.
• I added or updated comments where behavior is non-obvious.

Testing And Validation

• I ran npm run validate:package.
• I added or updated tests for the changed behavior.
• I verified no existing tests regressed.

Coverage

• Coverage impact is acceptable for this change.
• If coverage decreased, I explained why in this PR.

Security And Safety

• I did not introduce secrets, tokens, or credentials.
• Inputs are validated and error handling is appropriate.
• Dependency changes were reviewed for risk.

Documentation

• I updated README/docs when behavior or usage changed.
• I updated examples if needed.

Release Impact

• This change is backward compatible.
• If breaking, I documented migration steps.
• I considered versioning impact (patch/minor/major).

Linked Work

• Jira Issue(s):

Notes For Reviewers

• Imports were added back to package.json because The TypeScript path alias is preserved in emitted JavaScript, so Node needs the package imports map to resolve internal #/* module references at runtime. Without it, consumers receive ERR_PACKAGE_IMPORT_NOT_DEFINED.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​coverage-v8@​5.0.0 ⏵ 5.0.1
	vitest@​5.0.0 ⏵ 5.0.1	+1		+1
	@​types/​node@​26.5.0 ⏵ 26.5.1	+1		+1	+1
	@​azure/​storage-blob@​12.33.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Unmaintained: npm events was last published 6 years ago Last Publish: 2/27/2021, 4:51:27 PM From: package-lock.json → npm/@azure/storage-blob@12.33.0 → npm/events@3.3.0 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/events@3.3.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm safe-buffer was last published 6 years ago Last Publish: 5/10/2020, 4:37:30 PM From: package-lock.json → npm/typia@12.1.1 → npm/safe-buffer@5.2.1 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/safe-buffer@5.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Unmaintained: npm safer-buffer was last published 8 years ago Last Publish: 4/8/2018, 10:42:42 AM From: package-lock.json → npm/typia@12.1.1 → npm/safer-buffer@2.1.2 ℹ Read more on: This package | This alert | What are unmaintained packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Package should publish periodic maintenance releases if they are maintained, or deprecate if they have no intention in further maintenance. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/safer-buffer@2.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

🟢 Coverage Report

Metric	Coverage	Threshold	Covered
Statements	95.3%	95%	508/533
Branches	87.98%	85%	337/383
Functions	100%	99%	125/125
Lines	95.38%	95%	496/520

[Copilot]

Pull request overview

Adds an Azure Blob Storage logging destination with hourly operational and audit append blobs, tests, documentation, dependency updates, and CI tooling changes.

Changes:

• Added Azure destination implementation, configuration types, exports, and tests.
• Documented Azure setup and usage.
• Updated package metadata, lockfiles, and workflow tooling.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Summary	Review findings
tests/plugins/AzureStorageDestination.test.ts	Azure destination tests	None
src/plugins/AzureStorageDestination.ts	Azure append-blob destination	4 moderate findings and 1 nit: public Azure type exposure, undefined size fallback, startup predicate checks, and misleading BlobAlreadyExists logging.
src/interfaces/plugins/AzureStorageDestination.ts	Configuration types and defaults	None
src/index.ts	Public exports	None
README.md	Azure usage documentation	1 nit: LogEngine is used without initialization.
package.json	Package and dependency metadata	1 moderate finding: optional Azure peer dependency conflicts with exported declaration requirements.
package-lock.json	Locked dependency updates	None
.github/workflows/Security-Reachability.yml	Security workflow tooling	None
.github/workflows/Publish.yml	Publishing workflow tooling	None

Suppressed comments (5)

README.md:175

• This example imports LogEngine but never initializes logEngine, so it does not compile (Cannot find name 'logEngine'). Add const logEngine = LogEngine.getInstance(); before this call so the documented integration is runnable.

await logEngine.addPlugin({

package.json:67

• Making @azure/storage-blob an optional peer conflicts with exporting AzureStorageDestination from the package root: its public create signature references ContainerClient from that module, so the published declaration graph still requires TypeScript to resolve it. Consumers using only other destinations and following the README's claim that they do not need the SDK can therefore get a missing-module error while type-checking. Either make the peer required or expose SDK-independent structural types in the public declarations.

    "peerDependencies": {
        "@azure/storage-blob": "^12.33.0"
    },
    "peerDependenciesMeta": {
        "@azure/storage-blob": {
            "optional": true

src/plugins/AzureStorageDestination.ts:79

• The shared plugin contract says these predicates are evaluated when a destination processes a log (README.md:95), but this startup guard invokes getShouldWriteOperationalLogs during create and rejects whenever it is currently false. A runtime switch that starts disabled therefore cannot create this destination and later be enabled, unlike the other destinations; leave the predicate check in log as the only gating behavior.

            if (resolvedOptions.getShouldWriteOperationalLogs && !resolvedOptions.getShouldWriteOperationalLogs()) {
                throw new Error('Operational logs are disabled by configuration but an operational log container was provided.');
            }

src/plugins/AzureStorageDestination.ts:97

• This duplicates the startup-time predicate rejection for audit logs. It prevents a valid audit runtime switch from being initially false, even though the callback is intended to control writes at processing time; remove this check and let auditLog perform the per-record check.

            if (resolvedOptions.getShouldWriteAuditLogs && !resolvedOptions.getShouldWriteAuditLogs()) {
                throw new Error('Audit logs are disabled by configuration but an audit log container was provided.');
            }

src/plugins/AzureStorageDestination.ts:273

• createIfNotExists() reports an existing blob as an unsuccessful response with BlobAlreadyExists, which is normal after a restart or when another instance already created the hourly blob. This branch labels that normal case as Failed to create new blob on every such write, producing misleading debug noise even though the subsequent append is valid; only report unexpected error codes.

        if (result.errorCode) {
            this.#writeDebugLog('Failed to create new blob:', result.errorCode);
        }

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 5 comments.

Suppressed comments (1)

src/plugins/AzureStorageDestination.ts:97

• Evaluating the runtime write callback during creation prevents an initially disabled audit stream from ever being enabled later, even though auditLog() reevaluates this callback for every record. Supplying its container while the callback is temporarily false should still be valid.

            if (resolvedOptions.getShouldWriteAuditLogs && !resolvedOptions.getShouldWriteAuditLogs()) {
                throw new Error('Audit logs are disabled by configuration but an audit log container was provided.');
            }

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.

Suppressed comments (1)

src/plugins/AzureStorageDestination.ts:310

• This rounds in the host's local timezone but formats the blob name in UTC. In fractional-offset zones such as Asia/Kolkata, 03:04Z is rounded to 02:30Z, producing a 2025010202 blob and rotating on the half-hour instead of the UTC hour. Round in UTC to keep the documented hourly names stable across hosts.

        const activeHour = new Date().setMinutes(0, 0, 0);