Skip to content
All features
identity and trustpackages/iam/audit

audit package

Hash-chained, SHA-256 append-only audit log for actor/tenant actions. SOC 2-grade tamper detection, streaming export, and replay-safe queries.

Open docs
Stability
Stable
Scope
Tenant-scoped
Boundary
packages/iam/audit
Last 24h12 actions
2m ago
maria.kimuser.invite
14m ago
j.lopezbilling.cancel
32m ago
tsekaauth.signin
1h ago
r.patelrole.assign
2h ago
n.brownkey.rotate
3h ago
d.huangaccess.deny
chain · 12,847 entrieshash-verifiedsha-256
Usageaudit.ts
typescript
audit.ts
1import { logAudit } from "@nebutra/audit";
2
3await logAudit({
4  actor: { id: userId, role: "admin" },
5  action: "billing.subscription.cancel",
6  target: { type: "subscription", id: sub.id },
7  metadata: { plan: sub.plan, reason: "user_request" },
8  // Tamper-evident hash chain — entry IDs link sequentially.
9});
More in domain · identity and trust
authPackage
packages/iam/auth

Multi-provider auth — Clerk, Better Auth, or NextAuth. Same React surface, swap providers via preset config. MFA-enforced, session HMAC-signed.

Explore
captchaPackage
packages/iam/captcha

Bot challenge with Cloudflare Turnstile / hCaptcha / reCAPTCHA behind one verify() call. Server-side scoring, per-route enable, no third-party tracker on the client.

Explore
identityPackage
packages/iam/identity

Shared actor primitive — usr_/svc_/api_ ID space, role/membership lookup, tenant attachment. The single identity object every iam package reads.

Explore
oauth-serverPackage
packages/iam/oauth-server

Stand up your own OAuth 2.1 / OIDC provider. Authorization code + PKCE, refresh rotation, third-party app consent, JWT issuance with 1h default TTL.

Explore