Audit Logging

Every mutation in @azmr/db and every AI fix attempt is written to a tamper-evident audit log.

How the hash chain works

Entry 1: { action: "createTable", prevHash: "", hash: "a3f..." }
Entry 2: { action: "insert",      prevHash: "a3f...", hash: "9b2..." }
Entry 3: { action: "insert",      prevHash: "9b2...", hash: "c41..." }

Modifying entry 2's content changes its hash. Entry 3's prevHash then no longer matches entry 2's hash — the tamper is immediately detectable by replaying the chain.

Usage

import { createAuditLogger } from "@azmr/security";

const audit = createAuditLogger("payments");

audit.log("payment:processed", { orderId: "abc123", amount: 99.99 });
audit.log("payment:refunded",  { orderId: "abc123" });

Log format

Each line is a JSON object:

{
  "timestamp": "2026-04-08T00:00:00.000Z",
  "context": "payments",
  "action": "payment:processed",
  "meta": { "orderId": "abc123", "amount": 99.99 },
  "prevHash": "a3f2c1...",
  "hash": "9b2d44..."
}

Log location

Default: .azmara/audit.log

Override:

AZMARA_AUDIT_LOG=/var/log/azmara/audit.log

What NOT to log

Never log these

Passwords or password hashes
API keys or tokens
Full PII (name + email + address combined)
Session tokens or JWTs

These never belong in meta — log identifiers (user ID, order ID) instead.