fraqtal/agentic-dev
Template
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f77e6ea881a8a2a1c63a0aee897e110616e9fae1
agentic-dev/packages/core-audit/AGENTS.md
Danijel Martinek f77e6ea881 chore(template): clean-slate template snapshot from bb4a0c7 
Curated, product-agnostic snapshot of the post-story-04 tree: demo
content deleted, auth-only reference feature, web-next shell, all gates
green. Product-specific docs, ADRs 027-029, PRDs/epics/archive, editor
library traces, and product naming are curated out; generic template
repairs (coverage provider devDeps, root test:coverage script, live
lint fixes, root-only release-please) are kept. See TEMPLATE.md for
provenance, curation list, and usage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK
2026-07-12 20:40:54 +02:00

1.3 KiB
Raw Blame History

@repo/core-audit

Optional core package providing DPA-compliant audit logging. Scaffold via pnpm turbo gen core-package audit.

Structure

src/
  audit-log.interface.ts          # IAuditLog extends AuditLogProtocol
  audit-logs-collection.ts        # Payload collection (append-only)
  noop-audit-log.ts               # NoopAuditLog
  payload-audit-log.ts            # PayloadAuditLog (local cache impl)
  stdout-json-audit-log.ts        # StdoutJsonAuditLog (log-shipper sink)
  multi-sink-audit-log.ts         # MultiSinkAuditLog (fan-out wrapper)
  trace-id-enriching-audit-log.ts # OTel correlation decorator
  pseudonymize.ts                 # sha256-with-salt for GDPR pseudonymization
  di/bind-audit.ts                # bindAudit binder
  integrations/api/router.ts      # admin tRPC procedure
  hooks/                          # Payload hook factories

Compliance posture

  • AuditEntry type (in @repo/core-shared/audit) has no payload/body/oldValue/newValue fields — type system enforces DPA "what NOT to log".
  • Append-only Payload collection (update: () => false); erasure uses overrideAccess: true for the privileged path.
  • AUDIT_PSEUDONYM_SALT env REQUIRED in production. Validated at bind time.

See docs/guides/audit-and-compliance.md for the full guide.