SLD-904 - Introduce Azure Blob Storage logging destination

.github/workflows/Publish.yml

@@ -40,8 +40,8 @@ jobs:
       contents: none
       id-token: write
 
-    # The deploy step runs in the NPM OIDC authorized context
-    environment: NPM-OIDC
+    # The deploy step runs in the NPM authorized context
+    environment: NPM
 
     # Set of commands to run for the build job
     steps:

.github/workflows/Security-Reachability.yml

@@ -80,7 +80,7 @@ jobs:
       # validate:package:skip-reachability command so workflow validation does not modify its checkout.
       - name: Install Socket CLI
         background: true
-        run: sfw pip install socketsecurity==2.7.2 uv --upgrade
+        run: sfw pip install socketsecurity==2.9.0 uv --upgrade
 
       # Bring job back to sync execution by awaiting for all async jobs to finish before continuing
       - name: Steps - Convert Back To Synchronous Execution - Packages Updates/Setup

README.md

@@ -141,6 +141,48 @@ await logEngine.addPlugin(FileDestination, {
 
 The default directory is `./logs/dev`, the default rotation interval is 60 minutes, and the default retention period is one day. Host applications can conditionally add this destination, using the runtime write callbacks to control it.
 
+### AzureStorageDestination
+
+`AzureStorageDestination` appends newline-delimited JSON records to Azure Append Blobs. The Azure Blob SDK is an optional peer dependency: applications that use this destination must install it, while applications using other destinations do not need it.
+
+```bash
+npm install @azure/storage-blob @azure/identity
+```
+
+Create authenticated `ContainerClient` instances in the host application and pass them to the destination factory. The first container receives operational records and the second receives audit records; either container may be omitted, but at least one must be supplied.
+
+```typescript
+import { DefaultAzureCredential } from '@azure/identity';
+import { BlobServiceClient } from '@azure/storage-blob';
+import {
+	AzureStorageDestination,
+	LogEngine
+} from '@software-hardware-integration-lab/log-engine';
+
+const credential = new DefaultAzureCredential();
+const blobService = new BlobServiceClient('https://example.blob.core.windows.net', credential);
+const operationalContainer = blobService.getContainerClient('operational-logs');
+const auditContainer = blobService.getContainerClient('audit-logs');
+
+const azureStorageDestination = await AzureStorageDestination.create(
+	operationalContainer,
+	auditContainer,
+	{
+		'maxAppendBlockBytes': 4 * 1024 * 1024
+	}
+);
+
+const logEngine = LogEngine.getInstance();
+
+await logEngine.addPlugin({
+	'create': async () => azureStorageDestination
+});
+```
+
+The destination creates containers when necessary and uses separate hourly blobs for operational and audit streams. Records queued while a batch is in flight are combined into a single append-blob write, and each write is capped at 4 MiB by default, the stable limit across Azure Storage service versions; set `maxAppendBlockBytes` only after confirming the service version and account capabilities used by the host application. Because Azure limits an append blob to 50,000 blocks, the destination rotates to a suffixed blob (e.g. `2025010203.operational.2.log`) within the same hour once `maxBlocksPerBlob` (default `50000`) is reached, so high-volume streams never exhaust a blob before the hourly rotation.
+
+Configure blob retention with an Azure Storage lifecycle-management policy scoped to the destination container or prefix. The plugin deliberately has only data-plane responsibilities and does not create, replace, or delete storage-account lifecycle rules.
+
 ### LogAnalyticsDestination
 
 `LogAnalyticsDestination` sends operational and audit logs through host-provided structural uploaders. The package intentionally does not depend on an Azure SDK: the host owns credentials and SDK clients, while the destination only needs an object with `upload(ruleId, streamName, logs)`.