Interface: AuditLogOptions<TCtx>

Defined in: server/src/sync-handler.ts:302

User-facing options for the opt-in audit log. All fields are optional — supplying just audit: {} gives you SOC-2-style clientGroup-scoped hash-chained logging with defaults tuned for B2B deployments. See spec §FR-1..§FR-10.

Type Parameters

TCtx

TCtx

Properties

scopeFor?

readonly optional scopeFor?: (input) => string

Defined in: server/src/sync-handler.ts:308

Derive the audit scope key from the mutation context. Default: input.clientGroupID. Return the tenant id for multi-tenant deployments so each tenant owns an independent chain.

Parameters

input

AuditScopeInput<TCtx>

Returns

string

captureArgs?

readonly optional captureArgs?: CaptureArgs<TCtx>

Defined in: server/src/sync-handler.ts:318

How mutation args are stored in the chain body.

'raw' — canonicalized normalized args in args_raw
'hash' — SHA-256 of the canonicalized args in args_hash
callback — per-mutation choice, including 'redacted' for values that must never touch the chain (PII).

Default: 'hash' — safe for compliance without leaking secrets.

redactCtx?

readonly optional redactCtx?: (input) => unknown

Defined in: server/src/sync-handler.ts:325

Optional pre-flight redaction of auth.ctx before it is stored in actor_ctx. Runs on the object that will land in the chain body; return a shape that carries just the fields you can live with as a permanent record.

Parameters

input

RedactCtxInput<TCtx>

Returns

unknown

onCheckpoint?

readonly optional onCheckpoint?: (checkpoint) => void | Promise<void>

Defined in: server/src/sync-handler.ts:333

External anchor for closed Merkle tiles. Fires post-commit, best-effort — see SyncServerError['audit-onCheckpoint-failed'] for the failure story. Wire the hook up to R2 / blockchain / KMS-signed digest to satisfy compliance regimes that mandate an out-of-DB witness.

Parameters

checkpoint

AuditCheckpoint

Returns

void | Promise<void>

tileSize?

readonly optional tileSize?: number

Defined in: server/src/sync-handler.ts:339

Tile size in entries. Default: 256. Testing may drop this to 4 so tile-boundary paths cover in a small mutation batch; do not lower this in production without a plan for the Merkle proofs.

now?

readonly optional now?: () => number

Defined in: server/src/sync-handler.ts:345

Injectable clock — the audit recorder uses this for the ts column and retry timing so tests can drive tiles / retries deterministically. Default: Date.now.

Returns

number

sleep?

readonly optional sleep?: (ms) => Promise<void>

Defined in: server/src/sync-handler.ts:351

Injectable sleep — used only by the AuditSerializationError retry loop. Default: real setTimeout. Tests replace with an immediate resolve so the retry paths run in-loop.

Parameters

ms

number

Returns

Promise<void>