@basaltkit/audit 1.0.0 → 1.1.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Machize Contributors
+Copyright (c) 2026 Basalt Contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/dist/index.d.ts

@@ -36,9 +36,18 @@ declare class MemoryAuditStore implements AuditStore {
  * 'order.*' matches 'order.created', '**' matches everything.
  */
 declare function patternMatches(pattern: string, name: string): boolean;
+/** Recursively masks sensitive fields so secrets/PII never reach the trail. */
+declare function redactSensitive(value: unknown, depth?: number): unknown;
+type AuditRedactor = (payload: unknown, event: string) => unknown;
+/** Default payload scrubber: masks common secret keys, ignoring the event name. */
+declare const defaultAuditRedactor: AuditRedactor;
 declare class Audit {
     private readonly store;
-    constructor(store: AuditStore);
+    /** Scrubs each payload before it is stored. Default masks common secret keys. */
+    private readonly redact;
+    constructor(store: AuditStore, 
+    /** Scrubs each payload before it is stored. Default masks common secret keys. */
+    redact?: AuditRedactor);
     /** Manual entry — for actions no hook covers. */
     record(event: string, payload?: unknown): Promise<AuditEntry>;
     /** @internal used by the plugin's hook/event taps. */
@@ -59,7 +68,13 @@ interface AuditPluginOptions {
      * Default: everything. Pass [] to disable.
      */
     events?: string[];
+    /**
+     * Scrubs each payload before it is stored. Defaults to masking common secret
+     * keys (password, token, secret, authorization, api-key, …). Pass a custom
+     * function to change the policy, or `(p) => p` to store payloads verbatim.
+     */
+    redact?: AuditRedactor;
 }
 declare function auditPlugin(options?: AuditPluginOptions): _basaltkit_core.BasaltPlugin<unknown>;
 
-export { AUDIT, Audit, type AuditEntry, type AuditPluginOptions, type AuditQuery, type AuditStore, MemoryAuditStore, auditPlugin, patternMatches };
+export { AUDIT, Audit, type AuditEntry, type AuditPluginOptions, type AuditQuery, type AuditRedactor, type AuditStore, MemoryAuditStore, auditPlugin, defaultAuditRedactor, patternMatches, redactSensitive };

package/dist/index.js

@@ -28,11 +28,24 @@ function patternMatches(pattern, name) {
   }
   return patternSegments.length === nameSegments.length;
 }
+var SENSITIVE_KEY = /pass(word|wd)?|secret|token|authorization|api[-_]?key|credential|cookie|session|otp|mfa/i;
+function redactSensitive(value, depth = 0) {
+  if (depth > 6 || value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map((v) => redactSensitive(v, depth + 1));
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    out[k] = SENSITIVE_KEY.test(k) ? "[redacted]" : redactSensitive(v, depth + 1);
+  }
+  return out;
+}
+var defaultAuditRedactor = (payload) => redactSensitive(payload);
 var Audit = class {
-  constructor(store) {
+  constructor(store, redact = defaultAuditRedactor) {
     this.store = store;
+    this.redact = redact;
   }
   store;
+  redact;
   /** Manual entry — for actions no hook covers. */
   async record(event, payload) {
     const entry = this.build("manual", event, payload);
@@ -44,7 +57,8 @@ var Audit = class {
     await this.store.append(this.build(source, event, payload));
   }
   async trail(query = {}) {
-    return this.store.query(query);
+    const tenantId = query.tenantId ?? tryCtx()?.["tenant"]?.id;
+    return this.store.query(tenantId !== void 0 ? { ...query, tenantId } : query);
   }
   build(source, event, payload) {
     const context = tryCtx();
@@ -54,7 +68,7 @@ var Audit = class {
       id: randomUUID(),
       source,
       event,
-      payload,
+      payload: this.redact(payload, event),
       actorId: user?.id,
       tenantId: tenant?.id,
       requestId: context?.requestId,
@@ -70,7 +84,7 @@ function auditPlugin(options = {}) {
   return definePlugin({
     name: "basalt:audit",
     register({ container, hooks }) {
-      container.singleton(AUDIT, () => new Audit(options.store ?? new MemoryAuditStore()));
+      container.singleton(AUDIT, () => new Audit(options.store ?? new MemoryAuditStore(), options.redact ?? defaultAuditRedactor));
       hooks.onAny(async (hook, payload) => {
         if (!hookPatterns.some((pattern) => patternMatches(pattern, hook))) return;
         await container.get(AUDIT).capture("hook", hook, payload);
@@ -91,5 +105,7 @@ export {
   Audit,
   MemoryAuditStore,
   auditPlugin,
-  patternMatches
+  defaultAuditRedactor,
+  patternMatches,
+  redactSensitive
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/audit",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Append-only audit trail for Basalt: automatically records lifecycle hooks and domain events, enriched with actor/tenant/request from the context.",
   "license": "MIT",
   "type": "module",