feat(core-audit): append-only auditLogs Payload collection

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-audit/src/audit-logs-collection.test.ts

@@ -0,0 +1,47 @@
+import { describe, it, expect } from "vitest";
+import { auditLogsCollection } from "./audit-logs-collection";
+
+describe("auditLogsCollection", () => {
+  it("uses slug 'audit-logs'", () => {
+    expect(auditLogsCollection.slug).toBe("audit-logs");
+  });
+
+  it("is append-only (update: () => false)", () => {
+    const access = auditLogsCollection.access as Record<string, () => boolean>;
+    expect(access.update()).toBe(false);
+  });
+
+  it("has the required fields", () => {
+    const fieldNames = (auditLogsCollection.fields as Array<{ name: string }>).map((f) => f.name);
+    // WHO
+    expect(fieldNames).toContain("actorId");
+    expect(fieldNames).toContain("actorType");
+    expect(fieldNames).toContain("actorRoles");
+    // WHAT
+    expect(fieldNames).toContain("action");
+    expect(fieldNames).toContain("resourceType");
+    expect(fieldNames).toContain("resourceId");
+    expect(fieldNames).toContain("changedFields");
+    // SCOPE
+    expect(fieldNames).toContain("scopeFeature");
+    expect(fieldNames).toContain("scopeEnvironment");
+    expect(fieldNames).toContain("scopeTenant");
+    // WHY
+    expect(fieldNames).toContain("reason");
+    expect(fieldNames).toContain("correlationId");
+    expect(fieldNames).toContain("requestId");
+    // FROM
+    expect(fieldNames).toContain("ipTruncated");
+    expect(fieldNames).toContain("userAgent");
+    // PII
+    expect(fieldNames).toContain("containsPii");
+    expect(fieldNames).toContain("piiCategories");
+    // OUTCOME
+    expect(fieldNames).toContain("outcome");
+    expect(fieldNames).toContain("errorCode");
+  });
+
+  it("enables timestamps so createdAt maps to AuditEntry.at", () => {
+    expect(auditLogsCollection.timestamps).toBe(true);
+  });
+});